joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10010380], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x10010390]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1000a49c
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x10010390], 0
call fcn.10001a30
mov ecx, dword [0x1001038c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1000a49c
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x1001038c], 0
mov dword [0x10010380], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10010384], 0
je 0x10002679
mov eax, dword [0x10010384]
jmp 0x10002719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000268b
xor eax, eax
jmp 0x10002719
push 8
call fcn.10009dbe
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100026e1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100026ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1000a49c
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10010384], eax
mov dword [0x10010388], 0
mov eax, dword [ebp - 8]
jmp 0x10002719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100026fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100026ab
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1001038c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1001038c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10004840
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10010040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
mov dword [0x10010844], 0
xor esi, esi
lea eax, [esi + 1]
push eax
mov esi, eax
lea eax, [ebp - 0x38]
push str.ACCOUNT_i
push eax
call fcn.10003020
imul eax, dword [0x10010844], 0xb
add esp, 0xc
push str..logins.ini
push 0xc
add eax, 0x100106f8
push eax
push 0x1000d42d
push 0x1000d4bc
lea eax, [ebp - 0x38]
push eax
call ebx
imul eax, dword [0x10010844], 0xb
push str..logins.ini
push 0xc
add eax, 0x10010848
push eax
push 0x1000d42d
push 0x1000d4c4
lea eax, [ebp - 0x38]
push eax
call ebx
mov edx, dword [0x10010844]
imul eax, edx, 0xb
add eax, 0x100106f8
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100048d5
sub eax, edi
cmp eax, 1
jb 0x100048f3
inc edx
mov dword [0x10010844], edx
cmp esi, 0x1e
jl 0x10004865
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009db0
mov esp, ebp
pop ebp
ret
Function at 0x100057d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10010040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10005800
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009db0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000583c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1000583c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009db0
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10005913
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10005864
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10005870
movsx eax, bl
jmp 0x100058a8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100058d2
sub eax, 1
je 0x100058d2
sub eax, 2
jne 0x10005913
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009db0
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100058f0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10005913
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009db0
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009db0
mov esp, ebp
pop ebp
ret 4
Function at 0x10005e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10010040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10005f3c
cmp byte [esi + 0x3d], 0
je 0x10005f3c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10005f2a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10005ef1
sub eax, 1
je 0x10005ef5
sub eax, 2
jne 0x10005f2a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009db0
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10005f13
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10005f2a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009db0
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009db0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10009db0
mov esp, ebp
pop ebp
ret

Function at 0x10006b40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10006b76
push str.Main.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10006b76
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x100067e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x10006b80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10010040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp + 8]
cmp al, 0xff
je 0x10006bac
mov byte [esi], al
mov eax, dword [ebp + 0x10]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10009db0
mov esp, ebp
pop ebp
ret
Function at 0x100113e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100113f0
pop dword [ebp - 0x4c]
mov eax, 0x100113f0
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xe1bd34b3
sub dword [ebp - 0x5c], 0x936aef68
mov dword [ebp - 0x58], 0xa93e75d0
sub dword [ebp - 0x58], 0x770b298b
mov dword [ebp - 0x54], 0x588a6c04
sub dword [ebp - 0x54], 0xc3e27d6
mov dword [ebp - 0x50], 0xbc3732f2
sub dword [ebp - 0x50], 0xbc3732f2
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x8dc7e4a8
add eax, 0x823949b0
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xbf06e460
sub dword [ebp - 0x5c], 0x4a947b0a
mov dword [ebp - 0x58], 0x611e3a51
add dword [ebp - 0x58], 0xe04e2724
mov dword [ebp - 0x54], 0xa67e1072
add dword [ebp - 0x54], 0xbcf15bfa
mov dword [ebp - 0x50], 0x3e86b6aa
add dword [ebp - 0x50], 0xc1794956
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x4297788d
add eax, 0xcd69b5cf
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x33702
push 0
call eax
mov ecx, 0x3bba
mov esi, eax
mov edi, 0xf57077e4
sub edi, 0xe56efde4
add edi, dword [ebp - 0x4c]
mov ebx, 0x59b2b8a6
sub dword [ebp - 0x38], ebx
mov edx, dword [edi]
xor dword [ebp - 0x14], 0xfadefe41
xor edx, ebx
xor dword [ebp - 0x20], 0x570fd30a
mov dword [esi], edx
xor dword [ebp - 8], 0xfd70599
add esi, 4
add edi, 4
loop 0x10011501
add eax, 0xe45ab21f
sub eax, 0xe459d064
mov ebx, eax
add eax, 5
mov ecx, 0x629ce2c4
add ecx, 0xad631d3c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x2e014de1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e03078d
call fcn.2e001511
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014e1b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014e81
lea eax, [ebp - 0x14]
mov edi, 0x2e033941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014e78
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014e78
inc eax
push eax
call fcn.2e01672d
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014e6a
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010e6c
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e01672d
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00155b
ret 8

Function at 0x2e01672d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2e01673c
pop dword [ebp - 0x48]
mov eax, 0x2e01673c
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xf919293c
sub dword [ebp - 0x58], 0xaac6e3f1
mov dword [ebp - 0x54], 0x2aaed68e
sub dword [ebp - 0x54], 0xf87b8a49
mov dword [ebp - 0x50], 0xbcfaff67
add dword [ebp - 0x50], 0x8f5144c7
mov dword [ebp - 0x4c], 0xab6ef6f1
sub dword [ebp - 0x4c], 0xab6ef6f1
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xf56f0b20
add dword [ebp - 0x58], 0x7f035e36
mov dword [ebp - 0x54], 0x3bc903d6
add dword [ebp - 0x54], 0x5a35d9f
mov dword [ebp - 0x50], 0x25d6a707
add dword [ebp - 0x50], 0x3d98c565
mov dword [ebp - 0x4c], 0xe447ffed
sub dword [ebp - 0x4c], 0xe447ffed
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xab032b56
add eax, 0x83000566
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x479ad
push 0
call eax
mov ecx, 0x478b2176
sub ecx, 0x478abf54
xor ebx, ebx
add ebx, eax
mov edx, 0x2e057e00
add edx, dword [ebp - 0x48]
mov edi, 0x67facc43
sub edi, 0xeb0a3869
mov esi, dword [edx]
xor esi, edi
sub dword [ebp - 0x2c], ebx
mov dword [ebx], esi
xor dword [ebp - 0x28], 0x7dd27a80
add ebx, 0x12794023
sub ebx, 0x1279401f
add edx, 0xc00382e0
sub edx, 0xc00382dc
loop 0x2e016850
add eax, 0x17b5b
mov ebx, eax
add eax, 5
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4e7b00
Capabilities:
Check http status code

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x518d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x57de00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x5b3e30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push 0x71859c
call fcn.005e0700
add esp, 4
mov eax, dword [0x7185a0]
test eax, eax
jne 0x5b3eb8
mov dword [0x7185a0], 1
lea eax, [ebp - 8]
push eax
push 0
push 0x1001
call fcn.005c09a0
add esp, 0xc
push 0x105
mov edi, dword [ebp - 8]
push edi
push str.FORT0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x5b3e87
cmp eax, 0x105
jb 0x5b3e8e
test edi, edi
je 0x5b3e8e
mov byte [edi], 0
mov edi, dword [ebp - 8]
cmp byte [edi], 0
je 0x5b3eaf
push 2
call fcn.00647235
push eax
push 0x697654
push edi
call fcn.006572e0
add esp, 0x10
mov edi, dword [ebp - 8]
push edi
call fcn.005c0a60
add esp, 4
mov dword [0x71859c], 0
lea esp, [ebp - 4]
pop edi
pop ebp
ret
Function at 0x5e02d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
sub esp, 0xc
mov edi, 1
mov dword [ebp - 0x10], 0
xor esi, esi
mov edx, 0x718ef8
mov eax, 1
xchg dword [edx], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x5e0323
mov eax, 0x66666667
imul edi
sar edx, 2
lea ecx, [edx + edx*4]
add ecx, ecx
cmp ecx, edi
jne 0x5e0323
cmp edi, 0x2710
jle 0x5e031c
mov esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x5e0333
inc edi
cmp edi, 0x7ffffff
jl 0x5e02e6
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x5e034d
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.005fb8f0
add esp, 4
mov eax, dword [0x718efc]
test eax, eax
jne 0x5e038b
cmp dword [0x6d32a4], 1
je 0x5e048b
xor esi, esi
xor edi, edi
cmp dword [0x718ef4], 0
je 0x5e0448
mov dword [0x718efc], 1
cmp dword [0x6d32a4], 1
je 0x5e0430
push dword [0x718ef0]
mov dword [0x718ef8], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
test edx, edx
je 0x5e03b5
mov eax, dword [ebp + 8]
mov dword [eax], edx
xor eax, eax
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x74
call fcn.005c09a0
add esp, 0xc
test eax, eax
je 0x5e03dc
mov edx, dword [ebp + 8]
mov dword [edx], 0
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [0x6d3270]
mov dword [edx + 0x70], eax
mov eax, 0x70
mov ecx, dword [eax + 0x6d31fc]
mov dword [edx + eax - 4], ecx
mov esi, dword [eax + 0x6d31f8]
mov dword [edx + eax - 8], esi
mov edi, dword [eax + 0x6d31f4]
mov dword [edx + eax - 0xc], edi
mov ecx, dword [eax + 0x6d31f0]
mov dword [edx + eax - 0x10], ecx
sub eax, 0x10
jne 0x5e03ec
push dword [ebp - 0x10]
push dword [0x718ef0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [ebp - 0x10]
jmp 0x5e03a7
push edi
push 2
call fcn.00658467
push esi
push 0x16
call fcn.00658467
add esp, 0x10
jmp 0x5e038b
mov dword [0x718ef4], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x718ef0], eax
cmp eax, 0xffffffff
jne 0x5e046f
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5e0374
push 0x5e02b0
call fcn.0063f925
push 0x5e0270
call fcn.0063f925
add esp, 8
jmp 0x5e0374
push 1
push 2
call fcn.00658467
mov edi, eax
push 1
push 0x16
call fcn.00658467
mov esi, eax
add esp, 0x10
jmp 0x5e0367
Function at 0x5e04b0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
sub esp, 0xc
mov edi, 1
mov dword [ebp - 0x10], 0
xor esi, esi
mov edx, 0x718ef8
mov eax, 1
xchg dword [edx], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x5e0503
mov eax, 0x66666667
imul edi
sar edx, 2
lea ecx, [edx + edx*4]
add ecx, ecx
cmp ecx, edi
jne 0x5e0503
cmp edi, 0x2710
jle 0x5e04fc
mov esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x5e0513
inc edi
cmp edi, 0x7ffffff
jl 0x5e04c6
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x5e052d
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.005fb8f0
add esp, 4
mov eax, dword [0x718efc]
test eax, eax
jne 0x5e056b
cmp dword [0x6d32a4], 1
je 0x5e0691
xor esi, esi
xor edi, edi
cmp dword [0x718ef4], 0
je 0x5e064e
mov dword [0x718efc], 1
cmp dword [0x6d32a4], 1
je 0x5e0636
push dword [0x718ef0]
mov dword [0x718ef8], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x5e05be
mov eax, dword [ebp + 8]
mov dword [eax], esi
cmp dword [0x6d32a4], 1
je 0x5e05a1
xor eax, eax
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
push 1
push 2
call fcn.00658467
push 1
push 0x16
mov dword [esi + 0x64], eax
call fcn.00658467
add esp, 0x10
mov dword [esi + 0x68], eax
jmp 0x5e0598
lea eax, [ebp - 0x10]
push eax
push 0
push 0x74
call fcn.005c09a0
add esp, 0xc
test eax, eax
je 0x5e05e2
mov edx, dword [ebp + 8]
mov dword [edx], 0
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [0x6d3270]
mov dword [edx + 0x70], eax
mov eax, 0x70
mov ecx, dword [eax + 0x6d31fc]
mov dword [edx + eax - 4], ecx
mov esi, dword [eax + 0x6d31f8]
mov dword [edx + eax - 8], esi
mov edi, dword [eax + 0x6d31f4]
mov dword [edx + eax - 0xc], edi
mov ecx, dword [eax + 0x6d31f0]
mov dword [edx + eax - 0x10], ecx
sub eax, 0x10
jne 0x5e05f2
push dword [ebp - 0x10]
push dword [0x718ef0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [ebp - 0x10]
jmp 0x5e058a
push edi
push 2
call fcn.00658467
push esi
push 0x16
call fcn.00658467
add esp, 0x10
jmp 0x5e056b
mov dword [0x718ef4], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x718ef0], eax
cmp eax, 0xffffffff
jne 0x5e0675
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x5e0554
push 0x5e02b0
call fcn.0063f925
push 0x5e0270
call fcn.0063f925
add esp, 8
jmp 0x5e0554
push 1
push 2
call fcn.00658467
mov edi, eax
push 1
push 0x16
call fcn.00658467
mov esi, eax
add esp, 0x10
jmp 0x5e0547
Function at 0x5e40e0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x54]
mov ebx, dword [esi + 0x50]
test edx, edx
je 0x5e40fa
sub ebx, edx
jmp 0x5e40ff
mov edx, dword [esi + 0x4c]
sub ebx, edx
lea edx, [ebx + 4]
cmp edx, dword [esi + 0x10c]
ja 0x5e457f
movzx edx, word [esi + 0x18a]
test edx, edx
jg 0x5e4334
movsx edx, byte [esi + 0x18c]
cmp edx, 8
ja 0x5e42ca
movzx eax, word [edx*2 + 0x698d08]
add eax, 0x5e413c
jmp eax
push 0x37f
push str.for_put.c
push 2
push 8
call fcn.005b16e0
add esp, 0x10
mov edx, dword [esi + 0x54]
test edx, edx
je 0x5e455d
mov eax, esi
mov ecx, ebx
call fcn.005e463c
and byte [esi + 0x1a4], 0xbf
cmp eax, 0xffffffff
je 0x5e4544
test byte [esi + 0x1a5], 8
je 0x5e4351
push dword [esi + 0x104]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x5e452e
xor eax, eax
and byte [esi + 0x1a5], 0xf7
test eax, eax
jne 0x5e460e
jmp 0x5e4351
mov edx, dword [esi + 0x54]
test edx, edx
je 0x5e456e
mov eax, esi
mov ecx, ebx
call fcn.005e463c
cmp eax, 0xffffffff
je 0x5e4544
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x108], eax
mov eax, 0x26
jmp 0x5e4323
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x108], eax
mov eax, 0x26
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, esi
mov ecx, ebx
mov edx, dword [esi + 0x4c]
call fcn.005e463c
jmp 0x5e42f4
mov eax, esi
mov ecx, ebx
mov edx, dword [esi + 0x4c]
call fcn.005e463c
jmp 0x5e4348
push 0x200
push 4
push esi
call fcn.005e7350
add esp, 0xc
test eax, eax
je 0x5e410e
cmp ebx, dword [esi + 0x10c]
ja 0x5e45ac
cmp byte [esi + 0x18c], 1
je 0x5e410e
mov edx, dword [esi + 0x20]
test edx, edx
je 0x5e4616
test byte [edx + 0x44], 2
je 0x5e45e3
mov ecx, 0x42
mov dword [edx + 0x38], ecx
mov edx, dword [esi + 0x20]
mov dword [edx + 0x3c], ecx
mov edx, dword [esi + 0x7c]
test edx, edx
je 0x5e45d6
xor ecx, ecx
mov dword [edx + 4], ecx
mov dword [esi + 0x7c], ecx
mov eax, 0x42
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
movzx ecx, byte [esi + 0x1ae]
mov edx, 0x42
and ecx, 0x10
movzx ebx, byte [esi + 0x1a4]
push edx
shr ecx, 1
and ebx, 7
push edx
or ebx, ecx
push ebx
push 0xffffffffffffffff
push esi
call fcn.005e8d00
add esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
mov eax, 0x42
push eax
push eax
push 1
call fcn.005b0150
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x5e4630
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x5e7860
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x11c
mov eax, dword [0x6d159c]
mov edx, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
test edx, edx
je 0x5e797f
push 0x105
lea ebx, [ebp - 0x118]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x5e78a2
cmp eax, 0x105
jae 0x5e78a2
inc eax
jmp 0x5e78a9
mov byte [ebp - 0x118], 0
test eax, eax
jne 0x5e78b4
xor eax, eax
jmp 0x5e795e
movsx esi, byte [ebp - 0x118]
cmp esi, 0x54
je 0x5e7959
cmp esi, 0x59
je 0x5e7959
cmp esi, 0x74
je 0x5e7959
cmp esi, 0x79
je 0x5e7959
test esi, esi
je 0x5e78ad
mov eax, esi
and eax, 0xff
lea edi, [ebp - 0x117]
push eax
call fcn.0064d300
add esp, 4
test eax, eax
je 0x5e7911
movsx esi, byte [edi]
inc edi
mov eax, esi
and eax, 0xff
push eax
call fcn.0064d300
add esp, 4
test eax, eax
jne 0x5e78f9
test esi, esi
jne 0x5e78ad
xor esi, esi
lea eax, [ebp - 0x11c]
mov dword [eax], esi
mov esi, 0x6990a0
mov dword [eax - 0xc], esi
mov dword [eax - 8], eax
call fcn.00634220
mov ecx, eax
lea eax, [ebp - 0x124]
push eax
xor edx, edx
push edx
push esi
push 0xffffffffffffffff
push ebx
push dword [ecx + 4]
push dword [ecx]
call fcn.00652d4f
add esp, 0x1c
cmp dword [ebp - 0x11c], 0
je 0x5e78ad
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
xor ecx, ebp
cmp ecx, dword [0x6d159c]
jne 0x5e797a
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call fcn.0063f93a
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
xor ecx, ebp
cmp ecx, dword [0x6d159c]
jne 0x5e797a
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret