joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
push edi
lea edi, [ebp - 0x38]
mov ecx, 0xe
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10076240]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10079161
call fcn.10015880
nop
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100051e0
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
call fcn.10015920
add esp, 4
mov dword [ebp - 0xf4], eax
mov edx, dword [ebp - 0xf4]
mov dword [ebp - 0x28], edx
mov esi, esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
add edx, 5
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015850
nop
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.10017d60
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov byte [edx + ecx], 0xe9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x28]
add eax, dword [edx + 4]
push eax
call fcn.10005190
add esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + edx + 1], eax
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x10], 0xe9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10005190
add esp, 8
mov edx, 1
shl edx, 0
mov dword [ebp + edx - 0x10], eax
push 5
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10017d60
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x10005154]
call fcn.100157f0
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100158c0
add esp, 0xf8
cmp ebp, esp
call fcn.10015850
mov esp, ebp
pop ebp
ret
Function at 0x100051e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10079161
call fcn.10015880
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015850
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x10076180
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015850
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x10076188
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015850
nop
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x10076180
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10018c40
add esp, 0xc
test eax, eax
jne 0x10005284
mov eax, 0xb
jmp 0x100052af
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x10076188
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10018c40
add esp, 0xc
test eax, eax
jne 0x100052ac
mov eax, 5
jmp 0x100052af
mov eax, dword [ebp + 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x100052d4]
call fcn.100157f0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10015850
mov esp, ebp
pop ebp
ret

Function at 0x10007830
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10079176
call fcn.10015880
nop
push 0x6c078965
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.100077c0
nop
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10015850
mov esp, ebp
pop ebp
ret 4
Function at 0x10009a00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10079176
call fcn.10015880
nop
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x10009a41
mov ecx, dword [ebp - 8]
call fcn.1000c3f0
nop
jmp 0x10009a55
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4e0
jb 0x10009a55
mov ecx, dword [ebp - 8]
call fcn.1000c200
nop
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x12
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10015850
mov esp, ebp
pop ebp
ret

Function at 0x1000a650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10079177
call fcn.10015880
nop
mov dword [ebp - 8], 0
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015850
nop
mov esi, esp
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.10015850
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.10015850
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015850
nop
push edx
mov ecx, ebp
push eax
lea edx, [0x1000a710]
call fcn.100157f0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10015850
mov esp, ebp
pop ebp
ret
Function at 0x1000c200
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x70]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10079176
call fcn.10015880
nop
mov dword [ebp - 0x14], 0x26f
mov dword [ebp - 0x20], 0xe3
mov dword [ebp - 0x2c], 0
jmp 0x1000c24b
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xe3
jae 0x1000c2c0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
and eax, 1
je 0x1000c292
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000c29c
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x38]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 + 0xff8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000c242
mov dword [ebp - 0x44], 0xe3
jmp 0x1000c2d2
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x26f
jae 0x1000c347
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
and eax, 1
je 0x1000c319
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000c323
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x50]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000c2c9
mov dword [ebp - 0x5c], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
and eax, 1
je 0x1000c393
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000c39d
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x68]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 8]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 8]
mov dword [eax + edx + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
add esp, 0x130
cmp ebp, esp
call fcn.10015850
mov esp, ebp
pop ebp
ret
Function at 0x1000c3f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x28]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10079176
call fcn.10015880
nop
mov dword [ebp - 0x14], 0x270
jmp 0x1000c42d
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4e0
jae 0x1000c4a2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 - 0x9bc]
and edx, 0x80000000
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 - 0x9b8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x1000c474
mov dword [ebp - 0xe8], 0x9908b0df
jmp 0x1000c47e
mov dword [ebp - 0xe8], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000c424
pop edi
pop esi
pop ebx
add esp, 0xe8
cmp ebp, esp
call fcn.10015850
mov esp, ebp
pop ebp
ret
Function at 0x10010b80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x58]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1007916b
call fcn.10015880
nop
cmp dword [ebp + 0x10], 0
jg 0x10010bc2
jl 0x10010bb9
cmp dword [ebp + 0xc], 0
ja 0x10010bc2
xor eax, eax
xor edx, edx
jmp 0x10010cfb
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10010be4
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.10010d60
jmp 0x10010cfb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
call fcn.1000b390
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jbe 0x10010c54
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.100021e0
add esp, 8
mov edx, dword [eax]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000e750
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10004720
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x3c]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000e1b0
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x10010cec
mov ecx, dword [ebp - 8]
call fcn.1000c4c0
nop
mov dword [ebp - 0x48], 0xfff
cmp dword [ebp - 0x14], 0xfff
jbe 0x10010cc5
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
push 0xfff
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.1002edd0
add esp, 0x10
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x54]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x54], 0xfff
je 0x10010cc3
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
jmp 0x10010cfb
jmp 0x10010c71
cmp dword [ebp - 0x14], 0
jbe 0x10010cec
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1002edd0
add esp, 0x10
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x10010d24]
call fcn.100157f0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x118
cmp ebp, esp
call fcn.10015850
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012f20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100130d0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10012fed
mov edx, dword [ebp - 4]
cmp edx, dword [0x100761fc]
jb 0x10012f6a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10076200]
ja 0x10012f6a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10012f3a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10019600
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10012f90
jmp 0x10012fed
cmp dword [ebp - 0x14], 0x10000
jne 0x10012fd3
cmp dword [ebp - 0x18], 0x10000
jb 0x10012fd3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012fc6
mov eax, dword [ebp - 8]
jmp 0x10012fef
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10012fe8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100130d0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10012f3a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10013000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10013100
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100130c5
mov edx, dword [ebp - 4]
cmp edx, dword [0x100761fc]
jb 0x10013045
mov eax, dword [ebp - 4]
cmp eax, dword [0x10076200]
ja 0x10013045
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10013015
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10019600
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1001306b
jmp 0x100130c5
cmp dword [ebp - 0x14], 0x10000
jne 0x100130ae
cmp dword [ebp - 0x18], 0x10000
jb 0x100130ae
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100130a1
mov eax, dword [ebp - 8]
jmp 0x100130c7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100130c0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10013100
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10013015
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100144d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100774e0], eax
je 0x100144ee
mov eax, 0x10dd
jmp 0x100145cf
mov eax, dword [0x100774f0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001456c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1001454a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1001454a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10013580
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10016760
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x100144f6
mov dword [0x100774f0], 0
call fcn.10013e60
mov ecx, dword [0x100774ec]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100145b9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10016760
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10014584
mov dword [0x100774ec], 0
mov dword [0x100774e0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10014ab0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100774e4], 0
je 0x10014ac9
mov eax, dword [0x100774e4]
jmp 0x10014b69
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10014adb
xor eax, eax
jmp 0x10014b69
push 8
call fcn.10015780
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10014b31
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10014b1a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10016760
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100774e4], eax
mov dword [0x100774e8], 0
mov eax, dword [ebp - 8]
jmp 0x10014b69
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10014b4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10014afb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100774ec]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100774ec], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c130
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1001bd40
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001c162
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005d190]
call dword [ebp - 8]
jmp 0x1001c16c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x1003f820
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003f0a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003f854
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005d190]
call dword [ebp - 8]
jmp 0x1003f85a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003f8b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003f0e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003f8e4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005d190]
call dword [ebp - 8]
jmp 0x1003f8ee
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003f900
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003f100
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003f938
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x1005d190]
call dword [ebp - 8]
jmp 0x1003f946
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x1003f950
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1003f180
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003f990
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1005d190]
call dword [ebp - 8]
jmp 0x1003f9ae
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.1003fba0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1003ff40
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1003ff67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10031cd0
add esp, 4
or eax, 0xffffffff
jmp 0x1003ff69
xor eax, eax
pop ebp
ret