joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427c82
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax], dh
xor byte [eax], dh
xor byte [ecx], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax + esi + 0x4f], al
mov al, 0xf
mov edi, 0xced81d52
xor byte [eax], dh
xor byte [eax + esi + 0x4f], al
mov al, 0xf
mov edi, 0xced81d52
mov al, byte [0xc6e1b378]
loopne 0x427cf3
cmp eax, 0x30305082
xor byte [edi + 0x76], dh
cmp dword [ecx + 0x68], 0x7d
cli
rcr dword [ebx + 0x1a], 0x6c
jg 0x427c6f
push cs
int1
push 0x302cb291
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax + 0x30], bl
jo 0x427cf0
push ebp
xor byte [ebx - 0x5ccf56d0], al
xor byte [eax + esi + 0x309d3095], ah
xor byte [eax], 0x9f
xor byte [edi + 0x5530a430], bl
xor byte [eax + esi + 0x30a930a3], cl
mov dword [0x9530a430], eax
xor byte [ebp + 0x62306330], bl
xor byte [eax + esi + 0x30913097], cl
popfd
xor byte [ebp - 0x57cf5ad0], dl
xor byte [esi + 0x30], bl
xchg esp, eax
xor byte [eax + esi + 0x305c309c], bl
pop ebp
xor byte [ecx + 0x30], ah
pushal
xor byte [ebx + 0x30], ah
xor byte [ebp + 0x5e30a830], ah
xor byte [eax + esi + 0x309c309c], dl
pop esp
xor byte [ebp + 0x30], bl
popal
xor byte [eax + 0x30], ah
arpl word [eax], si
pushal
xor byte [edi + 0x30], ah
imul esi, dword [eax], 0x55
xor byte [eax - 0x60cf5dd0], al
xor byte [edi - 0x6ecf5dd0], dl
xor byte [ebp - 0x66cf89d0], bl
xor byte [eax + esi + 0x30a33095], bl
push ebp
xor byte [eax + esi + 0x3099307d], cl
xchg ebx, eax
xor byte [edx - 0x5ccf60d0], ah
xor byte [edi - 0x5bcf69d0], bl
xor byte [eax + 0x30], dl
ja 0x427d74
xchg ecx, eax
xor byte [ebp - 0x5ccf6ad0], bl
xor byte [eax + esi + 0x30a53080], cl
mov byte [0x9c309230], al
xor byte [ebp - 0x7fcfafd0], dl
xor byte [eax + esi + 0x30933091], bl
xchg ebp, eax
xor byte [eax + esi + 0x30a53080], cl
mov byte [0x9c309230], al
xor byte [ebp - 0x63cf7fd0], dl
xor byte [eax], 0x9c
xor byte [ecx - 0x6acf6cd0], dl
xor byte [esi + 0x30], bl
xchg ebp, eax
xor byte [eax + 0x58309530], ch
xor byte [eax], dh
xor byte [ecx], bh
xor byte [eax], dh
ror byte [eax + esi + 0x30], 1
cmp dword [eax], esi
xor al, dl
dec esp
xor byte [eax], dh
xor byte [ecx - 0x7d], ah
add byte [ebx + 0x7688ba12], 0xec
jl 0x427e05
jae 0x427d8a
sub al, 0x43
ret
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x432fff
Capabilities:
Encode data using xor

Disassembly:
pop edi
xor eax, 0x35713535
xor eax, 0x36353535
xor eax, 0x35353535
xor eax, 0x7b353535
xor eax, 0x35353535
test dword [0x35a435a7], esi
pushfd
xor eax, 0x359635a7
mov byte [0x7b355535], al
xor eax, 0x35a1359e
lcall 0x7535, 0x3535a835
xor eax, 0x359d35a8
lcall 0x6835, 0xa135a135
xor eax, 0x35633567
cdq
xor eax, 0x35a135a1
popal
mov eax, dword [0x6135a135]
xor eax, 0x35673562
xor ax, 0x356c
insd dword es:[edi], dx
xor eax, 0x35353566
dec ebp
xor eax, 0x3566357f
xor eax, 0x79353535
xor al, 0x80
inc ebp
xor eax, 0x96ab967f
xor eax, 0x3d356b35
xor eax, 0xf3243539
jns 0x432f56
invalid
xor eax, 0x3566357f
xor eax, 0x79353535
xor cl, 0x80
inc ebp
xor eax, 0x6c9aa79f
xor eax, 0x3d356b35
xor eax, 0xf3243539
jns 0x432fa0
invalid
Function at 0x409948
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x41764c
mov dword [ebp - 4], edx
mov esi, ecx
cmp dword [edi + 4], 0
mov ebx, eax
jne 0x409968
call fcn.00409910
mov eax, dword [ebp - 4]
jmp 0x409981
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x409989
test al, 7
jne 0x40996d
cmp esi, 8
jb 0x409a12
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x409992
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x409a34
mov ecx, dword [ebp - 8]
mov edx, ebx
shr ebx, 8
xor dl, byte [eax + ecx]
and edx, 0xff
mov ecx, dword [edi + edx*4]
xor ecx, ebx
mov ebx, ecx
inc dword [ebp - 8]
cmp esi, dword [ebp - 8]
ja 0x409a19
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x40a190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x40a1a7
test esi, esi
jg 0x40a1ae
xor eax, eax
jmp 0x40a252
mov edx, dword [ebp - 4]
add edx, 4
lea eax, [ebp - 0x28]
mov ecx, 0x10
call fcn.004107f0
test esi, esi
jns 0x40a1c8
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov esi, dword [ebp - 8]
test esi, esi
jle 0x40a239
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040a504
mov eax, dword [ebp - 0x28]
xor dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
xor dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x20]
xor dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0xc], eax
mov eax, ebx
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec esi
test esi, esi
jg 0x40a1d5
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 0x10
call fcn.004107f0
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a25c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ecx, 0x20
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 4
call fcn.004107f0
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x40a2c3
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x40a28e
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x40a2bb
cmp ecx, 4
jl 0x40a28c
cmp ecx, 4
jne 0x40a2c3
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x40a2ce
cmp esi, 0xa
jle 0x40a2b0
cmp esi, 0xa
jg 0x40a461
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x417cf4]
xor byte [esp + 0xc], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 0xa]
mov dl, byte [eax + 0x417cf4]
xor byte [esp + 0xd], dl
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x417cf4]
xor byte [esp + 0xe], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 8]
mov dl, byte [eax + 0x417cf4]
xor byte [esp + 0xf], dl
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x417ef4]
xor byte [esp + 0xc], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x40a371
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x40a40f
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x40a351
inc edx
cmp edx, dword [esp + 8]
jl 0x40a34f
jmp 0x40a40f
mov edx, 1
jmp 0x40a38f
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x40a37a
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x40a39a
adc eax, 0
cmp edx, eax
jl 0x40a378
mov eax, dword [esp + 8]
sar eax, 1
jns 0x40a3a9
adc eax, 0
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov dl, byte [edx + 0x417cf4]
xor byte [esp + eax*4 + 0xc], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov dl, byte [edx + 0x417cf4]
xor byte [esp + eax*4 + 0xd], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov dl, byte [edx + 0x417cf4]
xor byte [esp + eax*4 + 0xe], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov dl, byte [edx + 0x417cf4]
xor byte [esp + eax*4 + 0xf], dl
mov edx, eax
inc edx
cmp edx, dword [esp + 8]
jge 0x40a40f
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x40a3f4
inc edx
cmp edx, dword [esp + 8]
jl 0x40a3f2
xor edx, edx
jmp 0x40a44d
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x40a417
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x40a445
cmp ecx, 4
jl 0x40a415
cmp ecx, 4
jne 0x40a44d
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x40a458
cmp esi, 0xa
jle 0x40a43a
cmp esi, 0xa
jle 0x40a2d7
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40a46c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp], eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
add edx, dword [esp]
shl ebx, 2
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx edi, byte [edx + 1]
mov bl, byte [edx]
lea edi, [edi*4 + 0x41a312]
lea ebx, [ebx*4 + 0x419f12]
mov bl, byte [ebx + eax]
xor bl, byte [edi + eax]
movzx edi, byte [edx + 2]
movzx edx, byte [edx + 3]
lea edi, [edi*4 + 0x41a712]
lea edx, [edx*4 + 0x41ab12]
xor bl, byte [edi + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4 + 4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x40a47e
inc eax
cmp eax, 4
jl 0x40a47c
mov eax, esi
lea edx, [esp + 4]
shl eax, 4
mov ecx, 0x10
add eax, dword [esp]
add eax, 0x14
call fcn.004107f0
inc esi
cmp esi, 0xa
jl 0x40a47a
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x401220
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x843160]
mov ecx, dword [0x8420b4]
shr eax, 3
sub esp, 0x81c
test eax, eax
jbe 0x401310
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x843160], 0x959
jne 0x4012f6
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push str.ducofikinevodugucexejayeyide_jofubupazekatajikuwayoj
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
lea eax, [ebp - 0x81c]
push eax
push 0
push str.lebogegimoramigefunolerulodidi_peyewuvuhicucalikid_suyucedizejabije
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 0
push 0
push 0
push 0
push str.laduvig_xupewufodarahut
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
push edx
call fcn.00401030
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x401260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004962
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1000fff0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100066b6
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100049a4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10004b00
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1000ff40
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10018ef8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100069c1
mov ecx, dword [esi*4 + 0x10018ef8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10004af9
cmp eax, dword [ecx + edi + 0x24]
jne 0x10004af9
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10004af9
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100069c1
add esp, 0x14
test edx, edx
jl 0x10004af9
jg 0x10004a6f
test eax, eax
jb 0x10004af9
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10004af9
jl 0x10004a89
cmp dword [ebp - 0x1008], eax
ja 0x10004af9
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10004aa7
test ebx, ebx
je 0x10004ae0
cmp ecx, edi
jae 0x10004ae0
mov al, byte [ecx]
cmp al, 0xd
jne 0x10004ac1
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10004acd
cmp byte [ecx + 1], 0xa
jne 0x10004acd
inc ecx
jmp 0x10004acd
movzx eax, al
movsx eax, byte [eax + 0x10018208]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10004aa7
cmp edx, ebx
jne 0x10004aa7
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10004afe
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10001437
leave
ret

Function at 0x10005915
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10005954
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10005954
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10005954
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10005954
cmp dword [ecx + 0x74], 0xe
jbe 0x10005954
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10007132
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10018ef8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10007172
cmp byte [ebx], 0xa
jne 0x10007172
or byte [edi + eax + 0x28], 4
jmp 0x10007177
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10007276
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10007259
inc eax
cmp dl, 0xd
je 0x100071a3
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100071c9
cmp eax, ecx
jae 0x100071d7
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1000718b
jmp 0x10007276
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10007254
cmp dword [ebp - 0x10], 0
je 0x10007254
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10018ef8]
test byte [eax + edi + 0x28], 0x48
je 0x1000722e
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10007219
mov byte [esi], dl
jmp 0x1000722a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10018ef8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10007276
cmp byte [ebp - 1], 0xa
jne 0x1000723d
cmp esi, ebx
jne 0x1000723d
mov byte [esi], 0xa
jmp 0x10007275
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100069df
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10007276
mov byte [esi], 0xd
jmp 0x10007275
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10018ef8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10007273
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10007276
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1000727f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10018ef8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100072c5
cmp word [ebx], dx
jne 0x100072c5
or byte [eax + edi + 0x28], 4
jmp 0x100072ca
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1000742d
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1000740d
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1000730b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10007341
cmp eax, edx
jae 0x1000734f
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100072e6
jmp 0x1000742d
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10007408
cmp dword [ebp - 0x18], 0
je 0x10007408
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10018ef8]
test byte [eax + edi + 0x28], 0x48
je 0x100073de
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100073a2
mov word [esi], cx
jmp 0x100073d9
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10018ef8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10018ef8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10018ef8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1000742d
pop eax
cmp word [ebp - 4], ax
jne 0x100073ee
cmp esi, ebx
jne 0x100073ee
mov word [esi], ax
jmp 0x1000742a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100069df
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1000742d
push 0xd
pop eax
jmp 0x100073e9
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10018ef8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10007427
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1000742d
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10009f85
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000a022
push ebx
push esi
call fcn.10009f4e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10009ee2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10009fcf
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a021
push edi
push eax
call fcn.100089ee
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10009fef
call fcn.10007ca4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a020
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10009ee2
add esp, 0x20
test eax, eax
jne 0x1000a00e
push edi
call fcn.10007ca4
jmp 0x1000a016
push ebx
call fcn.10007ca4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000a28f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012a40
push 0x10012a38
push str.FlsAlloc
push 0x1f
call fcn.1000a1ab
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a2c3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011130]
call esi
jmp 0x1000a2c9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000a30d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012a50
push 0x10012a48
push str.FlsGetValue
push 0x21
call fcn.1000a1ab
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a344
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000a34c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012a58
push 0x10012a50
push str.FlsSetValue
push 0x22
call fcn.1000a1ab
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a386
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10011130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]