joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2639a90
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov ecx, 0x23e5d56
call fcn.026a74de
cmp dword [ebp + 0xc], 0
je 0x2639acc
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x2639afd
cmp dword [ebp + 0x10], 0
je 0x2639ada
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x2639afd
cmp dword [ebp + 0x14], 0
je 0x2639ae8
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0
jne 0x2639afd
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.02639710
add esp, 8
jmp 0x2639b91
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.02663980
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x14], 0
je 0x2639b2a
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0
je 0x2639b2a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x2639b31
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], 0
je 0x2639b47
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x2639b47
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edx
jmp 0x2639b4e
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 0xc], 0
je 0x2639b64
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x2639b64
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
jmp 0x2639b6b
mov dword [ebp - 0x20], 0
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp esi, esp
call fcn.026a5ffe
push edx
mov ecx, ebp
push eax
lea edx, [0x2639bb4]
call fcn.026a5faa
pop eax
pop edx
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x263ce30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
lea edi, [ebp - 0x58]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x23f6480]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x23e62e8
call fcn.026a74de
mov dword [ebp - 8], 0x3e8
lea eax, [ebp - 0x40]
push eax
call fcn.025fc910
add esp, 4
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
push eax
call fcn.0263a290
add esp, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0263a290
add esp, 4
mov dword [ebp - 0x28], eax
mov esi, esp
push 1
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
je 0x263ceff
cmp dword [ebp - 0x24], 0
je 0x263ced9
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.026b63a6
add esp, 4
mov dword [ebp - 0x24], 0
xor edx, edx
jne 0x263cec0
cmp dword [ebp - 0x28], 0
je 0x263cef6
mov eax, dword [ebp - 0x28]
push eax
call fcn.026b63a6
add esp, 4
mov dword [ebp - 0x28], 0
xor ecx, ecx
jne 0x263cedd
jmp 0x263cfcf
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x14]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
mov dword [edx + 0xc], ecx
lea edx, [ebp - 0x50]
push edx
call fcn.025fc910
add esp, 0xfffffff4
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
call fcn.025fca70
add esp, 0x20
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0
jl 0x263cf77
jg 0x263cf5b
cmp dword [ebp - 0x30], 0
jb 0x263cf77
mov eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x54]
jl 0x263cfb8
jg 0x263cf77
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x58]
jbe 0x263cfb8
cmp dword [ebp - 0x24], 0
je 0x263cf90
mov eax, dword [ebp - 0x24]
push eax
call fcn.026b63a6
add esp, 4
mov dword [ebp - 0x24], 0
xor ecx, ecx
jne 0x263cf77
cmp dword [ebp - 0x28], 0
je 0x263cfad
mov edx, dword [ebp - 0x28]
push edx
call fcn.026b63a6
add esp, 4
mov dword [ebp - 0x28], 0
xor eax, eax
jne 0x263cf94
mov eax, 1
jmp 0x263cfd1
mov esi, esp
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.026a5ffe
nop
jmp 0x263cea3
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x263cffc]
call fcn.026a5faa
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.026a6086
add esp, 0x58
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x263e3d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x23e667e
call fcn.026a74de
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call fcn.026e9950
add esp, 0x18
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x263e41b
cmp dword [ebp - 4], 0xffffffff
jne 0x263e41f
xor eax, eax
jmp 0x263e422
mov eax, dword [ebp - 4]
add esp, 8
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret

Function at 0x26424f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x23e684f
call fcn.026a74de
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.026a9140
add esp, 0xc
push 2
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
je 0x264252b
mov eax, 2
jmp 0x264252d
xor eax, eax
cmp ebp, esp
call fcn.026a5ffe
pop ebp
ret
Function at 0x2648a60
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
lea edi, [ebp - 0x3c]
mov ecx, 0xf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x23e6b40
call fcn.026a74de
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 4
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.026a9140
add esp, 0xc
mov esi, esp
push 0xf0000040
mov eax, dword [ebp + 0x18]
push eax
push 0
push 0
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x2648ade
jmp 0x2648bb8
mov esi, esp
lea edx, [ebp - 0x14]
push edx
push 0
push 0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x2648b03
jmp 0x2648b82
mov esi, esp
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x2648b26
jmp 0x2648b82
mov esi, esp
push 0
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x20]
push eax
push 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x2648b4b
jmp 0x2648b82
mov edx, dword [ebp + 0x14]
cmp edx, dword [ebp - 0x20]
jae 0x2648b55
jmp 0x2648b82
mov esi, esp
push 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 2
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
je 0x2648b7a
jmp 0x2648b82
xor eax, eax
jne 0x2648ade
cmp dword [ebp - 0x14], 0
je 0x2648b9c
mov esi, esp
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp esi, esp
call fcn.026a5ffe
nop
cmp dword [ebp - 8], 0
je 0x2648bb8
mov esi, esp
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, esp
call fcn.026a5ffe
nop
push edx
mov ecx, ebp
push eax
lea edx, [0x2648bdc]
call fcn.026a5faa
pop eax
pop edx
pop edi
pop esi
add esp, 0x3c
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x2648db0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov ecx, 0x23e6bd5
call fcn.026a74de
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0x8000
mov esi, esp
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [0x23ea0a0]
add esp, 8
cmp esi, esp
call fcn.026a5ffe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2648e27
mov esi, esp
mov edx, dword [ebp - 4]
push edx
call dword [0x23ea09c]
add esp, 4
cmp esi, esp
call fcn.026a5ffe
xor eax, eax
jmp 0x2648e93
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp esi, esp
call fcn.026a5ffe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x2648e67
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
je 0x2648e67
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jbe 0x2648e81
mov esi, esp
mov ecx, dword [ebp - 4]
push ecx
call dword [0x23ea09c]
add esp, 4
cmp esi, esp
call fcn.026a5ffe
xor eax, eax
jmp 0x2648e93
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
jae 0x2648e8e
mov eax, dword [ebp - 4]
jmp 0x2648e93
jmp 0x2648dea
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.026a5ffe
mov esp, ebp
pop ebp
ret
Function at 0x266a950
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, 0x23e89a5
call fcn.026a74de
mov esi, esp
push 0xf0000040
push 0x18
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x266a987
mov eax, 0x1b
jmp 0x266a9d9
mov ecx, dword [ebp + 8]
add ecx, 4
mov esi, esp
push ecx
push 0
push 0
push 0x800c
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp esi, esp
call fcn.026a5ffe
test eax, eax
jne 0x266a9d7
mov esi, esp
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, esp
call fcn.026a5ffe
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, 2
jmp 0x266a9d9
xor eax, eax
pop esi
cmp ebp, esp
call fcn.026a5ffe
pop ebp
ret

Function at 0x266fcf0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x23e9288
call fcn.026a74de
push 0x20
push 0x2570528
mov eax, dword [ebp + 8]
add eax, 0x40
push eax
call fcn.026a8640
add esp, 0xc
mov ecx, dword [ebp + 8]
xor edx, edx
xor eax, eax
mov dword [ecx + 0x60], edx
mov dword [ecx + 0x64], eax
cmp ebp, esp
call fcn.026a5ffe
pop ebp
ret

Function at 0x26a55f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.026eaa0a
mov eax, dword [eax + 0x14]
test eax, eax
je 0x26a563b
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x26a563b
sub eax, 1
je 0x26a5636
sub eax, 1
je 0x26a5632
xor eax, eax
leave
ret
push 3
jmp 0x26a563d
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x26a83b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x26a83f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x26a83f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x26a83f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x26a83f7
cmp dword [ecx + 0x74], 0xe
jbe 0x26a83f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x26c5740
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.026a6d30
mov eax, dword [0x23f6480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.026f5ca5
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x26c5782
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x26c58de
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.026a6bc0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x255fce0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.026e9ec7
mov ecx, dword [esi*4 + 0x255fce0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x26c58d7
cmp eax, dword [ecx + edi + 0x24]
jne 0x26c58d7
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x26c58d7
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.026e9ec7
add esp, 0x14
test edx, edx
jl 0x26c58d7
jg 0x26c584d
test eax, eax
jb 0x26c58d7
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x26c58d7
jl 0x26c5867
cmp dword [ebp - 0x1008], eax
ja 0x26c58d7
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x26c5885
test ebx, ebx
je 0x26c58be
cmp ecx, edi
jae 0x26c58be
mov al, byte [ecx]
cmp al, 0xd
jne 0x26c589f
lea eax, [edi - 1]
cmp ecx, eax
jae 0x26c58ab
cmp byte [ecx + 1], 0xa
jne 0x26c58ab
inc ecx
jmp 0x26c58ab
movzx eax, al
movsx eax, byte [eax + 0x23f6660]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x26c5885
cmp edx, ebx
jne 0x26c5885
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x26c58dc
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.026a6086
leave
ret
Function at 0x26e8903
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x23f6480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x25921f0
push esi
call fcn.026e5768
pop ecx
pop ecx
test eax, eax
jne 0x26e8931
xor al, al
jmp 0x26e89ae
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.026e8560
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x26e896b
push dword [ebp - 0x210]
call fcn.026b63a6
xor al, al
jmp 0x26e89ac
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x26e8971
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x26e8991
push edx
call fcn.026e883a
pop ecx
test al, al
je 0x26e895c
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x26e899f
mov bl, 1
push dword [ebp - 0x210]
call fcn.026b63a6
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.026a6086
leave
ret

Function at 0x26ef480
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x26ef4bf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x26ef4bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x26ef4bf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x26ef4bf
cmp dword [ecx + 0x74], 0xe
jbe 0x26ef4bf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x26f3e89
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x255fce0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x26f3ec9
cmp byte [ebx], 0xa
jne 0x26f3ec9
or byte [edi + eax + 0x28], 4
jmp 0x26f3ece
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x26f3fcd
mov dl, byte [eax]
cmp dl, 0x1a
je 0x26f3fb0
inc eax
cmp dl, 0xd
je 0x26f3efa
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x26f3f20
cmp eax, ecx
jae 0x26f3f2e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x26f3ee2
jmp 0x26f3fcd
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x26f3fab
cmp dword [ebp - 0x10], 0
je 0x26f3fab
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x255fce0]
test byte [eax + edi + 0x28], 0x48
je 0x26f3f85
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x26f3f70
mov byte [esi], dl
jmp 0x26f3f81
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x255fce0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x26f3fcd
cmp byte [ebp - 1], 0xa
jne 0x26f3f94
cmp esi, ebx
jne 0x26f3f94
mov byte [esi], 0xa
jmp 0x26f3fcc
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.026e9ee5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x26f3fcd
mov byte [esi], 0xd
jmp 0x26f3fcc
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x255fce0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x26f3fca
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x26f3fcd
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x26f3fd6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x255fce0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x26f401c
cmp word [ebx], dx
jne 0x26f401c
or byte [eax + edi + 0x28], 4
jmp 0x26f4021
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x26f4184
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x26f4164
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x26f4062
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x26f4098
cmp eax, edx
jae 0x26f40a6
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x26f403d
jmp 0x26f4184
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x26f415f
cmp dword [ebp - 0x18], 0
je 0x26f415f
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x255fce0]
test byte [eax + edi + 0x28], 0x48
je 0x26f4135
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x26f40f9
mov word [esi], cx
jmp 0x26f4130
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x255fce0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x255fce0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x255fce0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x26f4184
pop eax
cmp word [ebp - 4], ax
jne 0x26f4145
cmp esi, ebx
jne 0x26f4145
mov word [esi], ax
jmp 0x26f4181
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.026e9ee5
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x26f4184
push 0xd
pop eax
jmp 0x26f4140
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x255fce0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x26f417e
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x26f4184
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x26f864b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x2594314
push 0x259430c
push 0x2591068
push 0x1f
call fcn.026f8319
mov esi, eax
add esp, 0x10
test esi, esi
je 0x26f867f
push dword [ebp + 8]
mov ecx, esi
call dword [0x25613c0]
call esi
jmp 0x26f8685
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x26f86c9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x2594324
push 0x259431c
push 0x259108c
push 0x21
call fcn.026f8319
mov esi, eax
add esp, 0x10
test esi, esi
je 0x26f8700
push dword [ebp + 8]
mov ecx, esi
call dword [0x25613c0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x26f8708
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x259432c
push 0x2594324
push 0x25910a0
push 0x22
call fcn.026f8319
mov esi, eax
add esp, 0x10
test esi, esi
je 0x26f8742
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x25613c0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]