joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bf00
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043278
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
mov dword [esp + 0x10], 0
test eax, eax
je 0x1003bf53
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bf53
mov esi, dword [eax + 0x14]
test esi, esi
je 0x1003bf53
mov eax, dword [esp + 0x18]
cmp dword [esi], eax
je 0x1003bfc0
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x1003bf48
call fcn.1003bc40
lea esi, [eax + 0x14]
push esi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.10021de0
add esp, 0x10
mov dword [esi], eax
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], 0xffffffff
test esi, esi
je 0x1003bfaf
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bfaf
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bfaf
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret
cmp byte [esp + 0x28], 0
je 0x1003bfd9
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1003bfd9
mov eax, dword [ecx]
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 4]
push edx
call eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 4]
call fcn.1003bb20
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], edx
jmp 0x1003bf75
Function at 0x1003bff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.10021de0
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80

Function at 0x1003c1ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006b894]
jne 0x1003c1f4
repz ret
jmp fcn.1003c9ee
Function at 0x100031f0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x10043008
push edi
push dword [ebp + 0xc]
call fcn.100027e0
push dword [ebp + 8]
mov ecx, 0x10043020
call fcn.100027e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x10003248
push str.Eosp.
push 0x100446e0
call fcn.100012d0
push eax
call fcn.10001830
add esp, 0xc
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 4
call fcn.10014edd
mov esi, eax
mov dword [ebp - 8], eax
add esp, 4
test esi, esi
je 0x10003264
mov dword [esi], 0x2a
jmp 0x10003269
xor esi, esi
mov dword [ebp - 8], esi
push ebx
push 0x40
push 0x1000
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
jne 0x100032a8
push 0x1003467c
push 0x100446e0
call fcn.100012d0
push eax
call fcn.10001830
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 4
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100032c0
push str.wpms
jmp 0x100032e0
push 0
push 0
push ebx
push 0x100011f0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
jne 0x10003310
push str.ecreate.
push 0x100446e0
call fcn.100012d0
push eax
call fcn.10001830
add esp, 0xc
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push 0x1770
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call esi
push 0
lea ecx, [ebp - 1]
call fcn.10002900
push 4
push dword [ebp - 8]
call fcn.10014f0d
add esp, 8
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10006770
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
Function at 0x100081f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10032f1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.100124e2
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x1000827b
push eax
push esi
call fcn.1001297c
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.100126ab
int3
Function at 0x1000a100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1003306d
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10014edd
mov edi, eax
add esp, 4
test edi, edi
je 0x1000a192
push 1
mov dword [ebp - 4], 0
call fcn.1001287e
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000a194
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
push ebx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10007c40
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x30]
mov ecx, eax
call edx
movzx ebx, ax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1000a1f1
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x1000a1f1
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov word [esi + 0x40], bx
pop ebx
jne 0x1000a20f
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1000a230
cmp byte [ebp + 0xc], 0
je 0x1000a21e
push esi
call fcn.10014670
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1000a23c
mov esi, str.ios_base::badbit_set
jmp 0x1000a24c
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.100055c0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10002320
push 0x1003ec08
lea eax, [ebp - 0x28]
push eax
call fcn.1001633b
int3
Function at 0x1000b6f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10032ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 4]
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10014edd
mov edi, eax
add esp, 4
test edi, edi
je 0x1000b793
push 1
mov dword [ebp - 4], 0
call fcn.1001287e
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000b795
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.100090f0
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi + 0x1c], ecx
lea edi, [esi + 0x24]
mov dword [esi + 0x2c], edi
lea edx, [esi + 0x18]
mov dword [esi], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
lea ebx, [esi + 0x28]
mov dword [esi + 0x30], ebx
mov byte [esi + 0x48], 0
mov byte [esi + 0x3e], 0
mov dword [esi + 0x20], edx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x10044580]
mov ecx, dword [0x10044584]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [esi + 0x38], 0
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1000dab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10032ac0
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
push 8
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10014edd
mov edi, eax
add esp, 4
test edi, edi
je 0x1000db4c
push 1
mov dword [ebp - 4], 0
call fcn.1001287e
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000db4e
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.100090f0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010d70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100326b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
mov eax, ecx
mov dword [ebp - 0x18], 0
push ebx
push esi
push edi
mov ebx, dword [eax + 4]
mov dword [ebp - 0x24], eax
or ebx, 0x2001f
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push ecx
push ebx
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0x18]
test esi, esi
jne 0x10010eaf
xor esi, esi
test eax, eax
je 0x10010deb
push eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x20]
and ebx, 0x300
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x10010eaf
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x2c]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x100
push ecx
lea ecx, [ebp - 0x22c]
push ecx
push esi
push eax
call ebx
test eax, eax
jne 0x10010e68
nop dword [eax]
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x18]
call fcn.10010d70
mov esi, eax
test esi, esi
jne 0x10010eac
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push dword [ebp - 0x18]
call ebx
test eax, eax
je 0x10010e30
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10010e79
push eax
call edi
mov dword [ebp - 0x18], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], 0
call fcn.10010590
mov ecx, dword [ebp - 0x18]
mov esi, eax
test ecx, ecx
je 0x10010e97
push ecx
call edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10010e97
push eax
jmp 0x10010e95
Function at 0x10011060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10033688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x420], 0
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
jne 0x100110de
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp + 8], eax
test esi, esi
jne 0x100110de
call fcn.1000ff50
mov edi, eax
jmp 0x100111e5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x100110fb
call fcn.1000ff50
jmp 0x100111d8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp + 0x10], ebx
test ebx, ebx
jne 0x10011116
call fcn.1000ff50
jmp 0x100111d8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp + 0xc], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x10011134
mov edi, 0x8007000e
jmp 0x100111da
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x10011213
jb 0x10011152
cmp eax, 0xffffffff
ja 0x10011213
cmp eax, 0x400
jbe 0x10011167
push eax
lea ecx, [ebp - 0x420]
call fcn.1000fa20
jmp 0x10011184
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], eax
jmp 0x10011184
cmp dword [ebp - 0x420], 0
mov dword [ebp - 4], 1
jne 0x1001119b
mov edi, 0x8007000e
jmp 0x100111da
push edi
push dword [ebp - 0x420]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x100111bb
call fcn.1000ff50
jmp 0x100111d8
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x18]
push dword [ebp - 0x420]
call fcn.10010ed0
mov edi, eax
test esi, esi
je 0x100111e5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x100111fe
lea ecx, [ebp - 0x420]
call fcn.100106b0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.100031d0
int3
Function at 0x10013ef6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x10013f17
jl 0x10013f0e
test edi, edi
jne 0x10013f17
xor eax, eax
xor edx, edx
jmp 0x10013fd8
cmp dword [ebx + 0x38], 0
je 0x10013f2c
push eax
push edi
push dword [ebp + 8]
call fcn.10013fde
jmp 0x10013fd8
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10013f73
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10013f73
cmp eax, edi
jb 0x10013f4d
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.10016760
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x10013f79
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x10013fcd
mov ecx, ebx
call fcn.100136df
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10013fb8
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.1001ee0a
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x10013fcd
jmp 0x10013f8b
test edx, edx
je 0x10013fcd
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.1001ee0a
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x100142c1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x100142e8
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x100142eb
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1001429d
pop esi
leave
ret 8

Function at 0x1001fd8a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001fdc9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001fdc9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001fdc9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001fdc9
cmp dword [ecx + 0x74], 0xe
jbe 0x1001fdc9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10024476
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10038d78
push 0x10038d70
push str.FlsAlloc
push 0x1f
call fcn.1002433e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100244aa
push dword [ebp + 8]
mov ecx, esi
call dword [0x10034208]
call esi
jmp 0x100244b0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x100244f4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10038d88
push 0x10038d80
push str.FlsGetValue
push 0x21
call fcn.1002433e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002452b
push dword [ebp + 8]
mov ecx, esi
call dword [0x10034208]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10024533
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10038d90
push 0x10038d88
push str.FlsSetValue
push 0x22
call fcn.1002433e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002456d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10034208]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100263be
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10015470
mov eax, dword [0x10043100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10023ce7
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10026400
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1002655c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10015380
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10045120]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100267e3
mov ecx, dword [esi*4 + 0x10045120]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10026555
cmp eax, dword [ecx + edi + 0x24]
jne 0x10026555
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10026555
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100267e3
add esp, 0x14
test edx, edx
jl 0x10026555
jg 0x100264cb
test eax, eax
jb 0x10026555
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10026555
jl 0x100264e5
cmp dword [ebp - 0x1008], eax
ja 0x10026555
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10026503
test ebx, ebx
je 0x1002653c
cmp ecx, edi
jae 0x1002653c
mov al, byte [ecx]
cmp al, 0xd
jne 0x1002651d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10026529
cmp byte [ecx + 1], 0xa
jne 0x10026529
inc ecx
jmp 0x10026529
movzx eax, al
movsx eax, byte [eax + 0x100433c0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10026503
cmp edx, ebx
jne 0x10026503
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1002655a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100157fe
leave
ret