joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000523d
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1004f080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.cabalmain.exe
mov byte [ebp - 9], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor cl, cl
mov ebx, dword [eax + 0xc7bf5c]
mov eax, dword [ebx + 0x41a8]
add ebx, 0x41a8
mov dword [ebp - 0x10], eax
shr eax, 0x18
cmp al, 4
je 0x100051ca
cmp al, 0x24
je 0x100051ca
cmp al, 0x34
je 0x100051ca
cmp al, 0x44
jne 0x100051cc
mov cl, 1
movzx edi, byte [ebp - 9]
dec edi
cmp edi, 8
ja case.0x100051d6.2
jmp dword [edi*4 + 0x100052f4]
movups xmm0, xmmword [0x1004fb8c]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb9c]
mov dword [ecx + 0x10], eax
jmp 0x10005246
movups xmm0, xmmword [0x1004fb3c]
add cl, 8
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb4c]
mov dword [ecx + 0x10], eax
jmp 0x10005246
movups xmm0, xmmword [0x1004fb54]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb64]
mov dword [ecx + 0x10], eax
jmp 0x10005246
add cl, 0xc
shl cl, 2
mov byte [ebp - 0xd], cl
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 9]
mov byte [0x1004fb51], al
cmp edi, 8
ja case.0x10005277.0
jmp dword [edi*4 + 0x10005318]
movups xmm0, xmmword [0x1004fb78]
add cl, 0x10
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb88]
mov dword [ecx + 0x10], eax
jmp 0x10005246
push 0x1004fb34
jmp 0x100052dd
push 0x1004fb18
jmp 0x100052dd
push 0x1004fb6c
jmp 0x100052dd
push 0x1004fb70
jmp 0x100052dd
push 0x1004fb74
jmp 0x100052dd
push 0x1004fb38
jmp 0x100052dd
push str.4654
jmp 0x100052dd
push str.3_n1_f_t__n123
jmp 0x100052dd
push 0x1004fb30
call dword [0x10051564]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001dd16
mov esp, ebp
pop ebp
ret
Function at 0x10005240
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1004f080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.cabalmain.exe
mov byte [ebp - 9], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor cl, cl
mov ebx, dword [eax + 0xc7bf5c]
mov eax, dword [ebx + 0x41a8]
add ebx, 0x41a8
mov dword [ebp - 0x10], eax
shr eax, 0x18
cmp al, 4
je 0x100051ca
cmp al, 0x24
je 0x100051ca
cmp al, 0x34
je 0x100051ca
cmp al, 0x44
jne 0x100051cc
mov cl, 1
movzx edi, byte [ebp - 9]
dec edi
cmp edi, 8
ja case.0x100051d6.2
jmp dword [edi*4 + 0x100052f4]
movups xmm0, xmmword [0x1004fb8c]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb9c]
mov dword [ecx + 0x10], eax
jmp 0x10005246
movups xmm0, xmmword [0x1004fb3c]
add cl, 8
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb4c]
mov dword [ecx + 0x10], eax
jmp 0x10005246
movups xmm0, xmmword [0x1004fb54]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb64]
mov dword [ecx + 0x10], eax
jmp 0x10005246
add cl, 0xc
shl cl, 2
mov byte [ebp - 0xd], cl
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 9]
mov byte [0x1004fb51], al
cmp edi, 8
ja case.0x10005277.0
jmp dword [edi*4 + 0x10005318]
movups xmm0, xmmword [0x1004fb78]
add cl, 0x10
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb88]
mov dword [ecx + 0x10], eax
jmp 0x10005246
push 0x1004fb34
jmp 0x100052dd
push 0x1004fb18
jmp 0x100052dd
push 0x1004fb6c
jmp 0x100052dd
push 0x1004fb70
jmp 0x100052dd
push 0x1004fb74
jmp 0x100052dd
push 0x1004fb38
jmp 0x100052dd
push str.4654
jmp 0x100052dd
push str.3_n1_f_t__n123
jmp 0x100052dd
push 0x1004fb30
call dword [0x10051564]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001dd16
mov esp, ebp
pop ebp
ret
Function at 0x1000527e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1004f080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.cabalmain.exe
mov byte [ebp - 9], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor cl, cl
mov ebx, dword [eax + 0xc7bf5c]
mov eax, dword [ebx + 0x41a8]
add ebx, 0x41a8
mov dword [ebp - 0x10], eax
shr eax, 0x18
cmp al, 4
je 0x100051ca
cmp al, 0x24
je 0x100051ca
cmp al, 0x34
je 0x100051ca
cmp al, 0x44
jne 0x100051cc
mov cl, 1
movzx edi, byte [ebp - 9]
dec edi
cmp edi, 8
ja case.0x100051d6.2
jmp dword [edi*4 + 0x100052f4]
movups xmm0, xmmword [0x1004fb8c]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb9c]
mov dword [ecx + 0x10], eax
jmp 0x10005246
movups xmm0, xmmword [0x1004fb3c]
add cl, 8
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb4c]
mov dword [ecx + 0x10], eax
jmp 0x10005246
movups xmm0, xmmword [0x1004fb54]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb64]
mov dword [ecx + 0x10], eax
jmp 0x10005246
add cl, 0xc
shl cl, 2
mov byte [ebp - 0xd], cl
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 9]
mov byte [0x1004fb51], al
cmp edi, 8
ja case.0x10005277.0
jmp dword [edi*4 + 0x10005318]
movups xmm0, xmmword [0x1004fb78]
add cl, 0x10
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x1004fb88]
mov dword [ecx + 0x10], eax
jmp 0x10005246
push 0x1004fb34
jmp 0x100052dd
push 0x1004fb18
jmp 0x100052dd
push 0x1004fb6c
jmp 0x100052dd
push 0x1004fb70
jmp 0x100052dd
push 0x1004fb74
jmp 0x100052dd
push 0x1004fb38
jmp 0x100052dd
push str.4654
jmp 0x100052dd
push str.3_n1_f_t__n123
jmp 0x100052dd
push 0x1004fb30
call dword [0x10051564]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001dd16
mov esp, ebp
pop ebp
ret
Function at 0x100078d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100078ee
push 0
push 0
push 0
push 0x100076e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1000b360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003def0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
lea eax, [ecx + 4]
mov dword [ebp - 0x14], ecx
lea ebx, [ecx + 0x24]
mov dword [ecx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
lea edi, [ecx + 0x28]
mov dword [ebp - 0x14], eax
push 8
mov dword [eax], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
call fcn.1001df29
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1001d349
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [eax + 0x34], esi
call fcn.1000d0b0
mov eax, dword [ebp - 0x10]
lea edx, [eax + 8]
lea ecx, [eax + 0x14]
lea esi, [eax + 4]
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [eax + 0xc], esi
mov esi, eax
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], edx
mov dword [eax + 0x1c], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov esi, dword [ebp - 0x14]
mov dword [edx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov dword [ebx], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [0x10052ef0]
mov edx, dword [0x10052ef4]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bf70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e02c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1004f080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea ebx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], ebx
mov dword [ebx + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1000c024
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [ebx + 0x24], eax
mov al, byte [ebp + 0xc]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.1000b8e0
mov byte [ebp - 4], 6
xor ebx, ebx
mov ecx, dword [edi + 0x1c]
mov edx, dword [edi + 0x10]
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], edx
test ecx, ecx
jns 0x1000c06f
mov eax, ecx
neg eax
cmp ebx, eax
jae 0x1000c06f
add ecx, ebx
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x1000c079
add ecx, ebx
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
and ecx, 0x1f
lea eax, [ebp - 0xd]
push ecx
push edx
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x10]
call fcn.1000eff0
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1000c0a7
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30

Function at 0x1000d110
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e220
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1004f080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1001df29
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1001d349
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.1000d0b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10019be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10019d90
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10019cad
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10019c2a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1004f004]
ja 0x10019c2a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10019bfa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001fac0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10019c50
jmp 0x10019cad
cmp dword [ebp - 0x14], 0x10000
jne 0x10019c93
cmp dword [ebp - 0x18], 0x10000
jb 0x10019c93
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10019c86
mov eax, dword [ebp - 8]
jmp 0x10019caf
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10019ca8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10019d90
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10019bfa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10019cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10019dc0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10019d85
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10019d05
mov eax, dword [ebp - 4]
cmp eax, dword [0x1004f004]
ja 0x10019d05
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10019cd5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001fac0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10019d2b
jmp 0x10019d85
cmp dword [ebp - 0x14], 0x10000
jne 0x10019d6e
cmp dword [ebp - 0x18], 0x10000
jb 0x10019d6e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10019d61
mov eax, dword [ebp - 8]
jmp 0x10019d87
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10019d80
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10019dc0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10019cd5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10019df0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1001a1e0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100503a4], 0
jne 0x10019e2d
cmp dword [0x100503a0], 0
je 0x10019e2d
mov eax, dword [0x100503a0]
mov dword [0x100503a4], eax
cmp dword [0x100503a4], 0
je 0x10019eaa
mov ecx, dword [0x100503a4]
cmp dword [ecx + 8], 0
je 0x10019eaa
mov edx, dword [0x100503a4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10019eaa
mov ecx, dword [0x100503a4]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10019eaa
mov eax, dword [0x100503a4]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10019e79
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10019e80
xor eax, eax
jmp 0x10019fc9
mov ecx, dword [0x100503a4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001fac0
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10019fc9
mov edx, dword [0x100503a0]
mov dword [0x100503a4], edx
jmp 0x10019ec6
mov eax, dword [0x100503a4]
mov ecx, dword [eax + 4]
mov dword [0x100503a4], ecx
cmp dword [0x100503a4], 0
je 0x10019f06
cmp dword [0x100503a4], 0
je 0x10019f04
mov edx, dword [0x100503a4]
cmp dword [edx + 8], 0
je 0x10019f04
mov eax, dword [0x100503a4]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10019f04
mov edx, dword [0x100503a4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10019f04
jmp 0x10019e5e
jmp 0x10019eb8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10019fd0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10019fc7
mov eax, dword [ebp - 0x18]
mov dword [0x100503a4], eax
mov ecx, dword [0x100503a4]
mov dword [ecx], 0x52727464
mov edx, dword [0x100503a4]
mov dword [edx + 8], 0
mov eax, dword [0x100503a4]
mov ecx, dword [0x100503a0]
mov dword [eax + 4], ecx
mov edx, dword [0x100503a4]
mov dword [0x100503a0], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100503a4]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10019f97
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10019fb7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x10019f8e
mov eax, dword [0x100503a4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10019e5e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002b59d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002b5dc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002b5dc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002b5dc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002b5dc
cmp dword [ecx + 0x74], 0xe
jbe 0x1002b5dc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10030ced
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10044260
push 0x10044258
push str.FlsAlloc
push 0x1f
call fcn.10030bb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10030d21
push dword [ebp + 8]
mov ecx, esi
call dword [0x100401d0]
call esi
jmp 0x10030d27
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10030d6b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10044270
push 0x10044268
push str.FlsGetValue
push 0x21
call fcn.10030bb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10030da2
push dword [ebp + 8]
mov ecx, esi
call dword [0x100401d0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10030daa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10044278
push 0x10044270
push str.FlsSetValue
push 0x22
call fcn.10030bb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10030de4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100401d0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100314e9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1001ef00
mov eax, dword [0x1004f080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1002c172
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1003152b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10031687
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1003d2e0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10050d68]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100322ea
mov ecx, dword [esi*4 + 0x10050d68]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10031680
cmp eax, dword [ecx + edi + 0x24]
jne 0x10031680
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10031680
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100322ea
add esp, 0x14
test edx, edx
jl 0x10031680
jg 0x100315f6
test eax, eax
jb 0x10031680
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10031680
jl 0x10031610
cmp dword [ebp - 0x1008], eax
ja 0x10031680
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1003162e
test ebx, ebx
je 0x10031667
cmp ecx, edi
jae 0x10031667
mov al, byte [ecx]
cmp al, 0xd
jne 0x10031648
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10031654
cmp byte [ecx + 1], 0xa
jne 0x10031654
inc ecx
jmp 0x10031654
movzx eax, al
movsx eax, byte [eax + 0x1004f4d8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1003162e
cmp edx, ebx
jne 0x1003162e
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10031685
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1001dd16
leave
ret
Function at 0x10031782
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10050d68]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100317c2
cmp byte [ebx], 0xa
jne 0x100317c2
or byte [edi + eax + 0x28], 4
jmp 0x100317c7
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x100318c6
mov dl, byte [eax]
cmp dl, 0x1a
je 0x100318a9
inc eax
cmp dl, 0xd
je 0x100317f3
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10031819
cmp eax, ecx
jae 0x10031827
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x100317db
jmp 0x100318c6
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100318a4
cmp dword [ebp - 0x10], 0
je 0x100318a4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10050d68]
test byte [eax + edi + 0x28], 0x48
je 0x1003187e
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10031869
mov byte [esi], dl
jmp 0x1003187a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10050d68]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100318c6
cmp byte [ebp - 1], 0xa
jne 0x1003188d
cmp esi, ebx
jne 0x1003188d
mov byte [esi], 0xa
jmp 0x100318c5
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10032308
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100318c6
mov byte [esi], 0xd
jmp 0x100318c5
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10050d68]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100318c3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100318c6
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret