joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10089f50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d47f1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10100230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.nfapi::EventQueue_class_nfapi::NFEventOut_.0
push 0x18
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10091be2
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea esi, [edi + 0xc]
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10091be2
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x14]
mov byte [ebp - 4], 1
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10091be2
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 2
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10091be2
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x24]
mov byte [ebp - 4], 3
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10091be2
add esp, 0x14
mov dword [eax], eax
push 0
push 0
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push 0
mov dword [esi], eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
mov dword [edi + 0x2c], 0xffffffff
call esi
push 0
push 0
mov dword [edi + 0x2c], eax
push 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
push 0
mov dword [edi + 0x44], 0xffffffff
call esi
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], 0xffffffff
push 0
push 0
push 1
push 0
call esi
lea ecx, [edi + 0x50]
mov dword [edi + 0x48], eax
xorps xmm0, xmm0
mov dword [edi + 0x34], 0
movups xmmword [ecx], xmm0
movq qword [ecx + 0x10], xmm0
call fcn.1008a5e0
mov dword [edi + 0x4c], 1
mov eax, edi
mov byte [edi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008beb0
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, ecx
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
test esi, esi
jg 0x1008bef0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0x14]
test esi, esi
jne 0x1008bee7
mov esi, 1
jmp 0x1008bef0
jle 0x1008bf36
nop dword [eax]
lea eax, [ebp - 4]
push eax
push 0
push edi
push 0x1008aca0
push 0
push 0
call fcn.100a8ff2
add esp, 0x18
mov dword [ebp + 0xc], eax
test eax, eax
je 0x1008bf31
cmp eax, 0xffffffff
je 0x1008bf31
mov edx, dword [edi + 8]
lea ecx, [edi + 4]
cmp edx, dword [ecx + 8]
je 0x1008bf27
mov dword [edx], eax
add dword [ecx + 4], 4
jmp 0x1008bf31
lea eax, [ebp + 0xc]
push eax
push edx
call fcn.100898e0
sub esi, 1
jne 0x1008bef0
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1008c1a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1010008c]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10100088]
mov dword [ebp - 4], 0
test byte [esi + 0x12], 1
mov dword [ebp - 0x10], eax
je 0x1008c1ce
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebp - 8], ecx
lea ebx, [edi + 0x16]
lea eax, [ebx + 0x10]
mov dword [ebp - 0xc], eax
cmp ecx, dword [0x101070a0]
jb 0x1008c1ff
ja 0x1008c1f3
cmp eax, dword [0x1010709c]
jbe 0x1008c1ff
pop edi
pop ebx
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [0x10107038], cl
je 0x1008c34c
cmp dword [0x10100094], 0xffffffff
je 0x1008c34c
mov eax, dword [0x10107094]
or eax, dword [0x10107098]
je 0x1008c34c
push 0x10106f1c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x10107094]
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], ebx
movups xmm0, xmmword [esi]
movups xmmword [ecx + 0x10], xmm0
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x20], eax
mov ax, word [esi + 0x14]
mov word [ecx + 0x24], ax
lea eax, [ecx + 0x26]
push eax
call fcn.10093ce0
mov eax, dword [0x1010008c]
add esp, 0xc
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
push eax
push 0
push 8
lea eax, [ebp - 0xc]
push eax
push dword [0x10100094]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1008c2cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1008c2cc
push 0x10106f1c
mov esi, 0xfffffffc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x1008c2f1
push eax
push dword [0x10100088]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1008c314
push dword [0x10100094]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0x10106f1c
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [0x10100094]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1008c2fd
mov esi, dword [ebp - 4]
neg esi
push 0x10106f1c
sbb esi, esi
neg esi
dec esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov eax, 0xfffffffd
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008c360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1010008c]
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10100088]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
add eax, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
cmp ecx, dword [0x101070a0]
jb 0x1008c3ab
ja 0x1008c3a1
cmp eax, dword [0x1010709c]
jbe 0x1008c3ab
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [0x10107038], cl
je 0x1008c4c3
cmp dword [0x10100094], 0xffffffff
je 0x1008c4c3
mov eax, dword [0x10107094]
or eax, dword [0x10107098]
je 0x1008c4c3
push 0x10106f1c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0xc]
push esi
push dword [0x10107094]
call fcn.10093ce0
mov eax, dword [0x1010008c]
add esp, 0xc
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
push eax
push 0
push 8
lea eax, [ebp - 0xc]
push eax
push dword [0x10100094]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1008c447
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1008c447
push 0x10106f1c
mov esi, 0xfffffffc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x1008c46c
push eax
push dword [0x10100088]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1008c48d
push dword [0x10100094]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0x10106f1c
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [0x10100094]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1008c478
mov esi, dword [ebp - 4]
neg esi
push 0x10106f1c
sbb esi, esi
neg esi
dec esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffd
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008d8b0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008d8f6
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.DisableTaskOffload
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x1008daa0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10100230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServices_s
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.1008e630
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
push 3
push 0
lea eax, [ebp - 0x108]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1008db06
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10091bd4
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 8], 0
je 0x1008db3a
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 4
push eax
push esi
lea eax, [ebp - 0x114]
push eax
push 0
push 0x100db348
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x1008db52
push 4
push esi
push 4
push 0
push 0x100db34c
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
test esi, esi
pop esi
sete al
xor ecx, ebp
call fcn.10091bd4
mov esp, ebp
pop ebp
ret
Function at 0x1008db80
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetControlGroupOrderList
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1008dba8
xor al, al
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 8], 0
push esi
push edi
je 0x1008dc37
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push edi
push 0
push eax
push 0
push 0x100db380
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1008dbe9
mov eax, dword [edi]
add eax, 4
push eax
call fcn.100a44d7
mov esi, dword [ebp + 0xc]
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x1008dbfa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x100db388
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
je 0x1008dc68
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi]
call fcn.1009ece6
add esp, 4
mov dword [esi], 0
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
cmp edx, 4
jbe 0x1008dc47
shr edx, 2
dec edx
jmp 0x1008dc49
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [eax], edx
push dword [esi]
push dword [ecx]
push 3
push 0
push str.PNP_TDI
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008dc80
Capabilities:
Create service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x10100230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor bl, bl
push edi
push eax
push 0x100db1e8
mov dword [ebp - 0x434], eax
xor edi, edi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x43c], 0
push 0x104
push eax
call fcn.1008e670
test esi, esi
mov eax, esi
mov ecx, 0x100db1f0
cmove eax, dword [ebp - 0x434]
push eax
mov eax, 0x100db1f8
cmovne eax, ecx
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.1008e670
add esp, 0x20
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x438], eax
test eax, eax
jne 0x1008dd20
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10091bd4
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
lea ecx, [ebp - 0x43c]
push ecx
push 0x100db228
lea ecx, [ebp - 0x414]
push ecx
push 1
push 3
push 1
push 0xf01ff
lea ecx, [ebp - 0x20c]
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test byte [0x10106efc], 8
mov esi, eax
je 0x1008dd91
test esi, esi
je 0x1008dd70
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bl, 1
jmp 0x1008de41
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, 0x431
jne 0x1008de47
mov bl, 1
jmp 0x1008de47
test esi, esi
je 0x1008ddc3
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
jmp 0x1008de47
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x431
jne 0x1008de41
push 0x14
push dword [ebp - 0x434]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x1008de38
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1008de0c
cmp dword [ebp - 0x42c], 4
jne 0x1008de0c
mov bl, 1
jmp 0x1008de24
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
movzx ebx, bl
mov edx, 1
cmovne ebx, edx
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
jmp 0x1008de47
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edi, eax
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x438]
call esi
push 0
push dword [ebp - 0x434]
call fcn.1008e280
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
movzx eax, bl
xor ecx, ebp
pop esi
dec eax
pop ebx
call fcn.10091bd4
mov esp, ebp
pop ebp
ret
Function at 0x1008e160
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x10100230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.NDIS]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [0x100db284]
mov byte [ebp - 8], al
mov eax, dword [str.tcpip]
mov dword [ebp - 0x14], eax
mov ax, word [0x100db28c]
push ecx
mov word [ebp - 0x10], ax
movzx eax, byte [0x100db28e]
push 0x100db298
mov byte [ebp - 0xe], al
lea eax, [ebp - 0x120]
push 0x104
push eax
mov dword [ebp - 0x1c], 0x5f504e50
mov dword [ebp - 0x18], 0x494454
call fcn.1008e630
add esp, 0x10
lea eax, [ebp - 0x124]
push eax
push 3
push 0
lea eax, [ebp - 0x120]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1008e1fd
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10091bd4
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
push esi
je 0x1008e23a
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0xc]
push 5
push eax
push 1
push 0
push 0x100db2c0
push dword [ebp - 0x124]
call esi
push 7
lea eax, [ebp - 0x14]
push eax
push 7
push 0
push str.DependOnService
push dword [ebp - 0x124]
call esi
jmp 0x1008e255
push 8
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push str.Group
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x124]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
test esi, esi
pop esi
sete al
xor ecx, ebp
call fcn.10091bd4
mov esp, ebp
pop ebp
ret
Function at 0x1008fb12
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1008faee
pop esi
leave
ret 8

Function at 0x100b072f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100e0504
push 0x100e04fc
push str.FlsAlloc
push 0x1e
call fcn.100b055c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b0763
push dword [ebp + 8]
mov ecx, esi
call dword [0x100d83e4]
call esi
jmp 0x100b0769
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100b07ad
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100e0514
push 0x100e050c
push str.FlsGetValue
push 0x20
call fcn.100b055c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b07e4
push dword [ebp + 8]
mov ecx, esi
call dword [0x100d83e4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100b36e9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10093150
mov eax, dword [0x10100230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100b1e07
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100b372b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100b3887
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100c11e0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10107e18]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.100b3b0f
mov ecx, dword [esi*4 + 0x10107e18]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x100b3880
cmp eax, dword [edi + ecx + 0x24]
jne 0x100b3880
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b3880
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100b3b0f
add esp, 0x14
test edx, edx
jl 0x100b3880
jg 0x100b37f6
test eax, eax
jb 0x100b3880
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100b3880
jl 0x100b3810
cmp dword [ebp - 0x1008], eax
ja 0x100b3880
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100b382e
test ebx, ebx
je 0x100b3867
cmp ecx, edi
jae 0x100b3867
mov al, byte [ecx]
cmp al, 0xd
jne 0x100b3848
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100b3854
cmp byte [ecx + 1], 0xa
jne 0x100b3854
inc ecx
jmp 0x100b3854
movzx eax, al
movsx eax, byte [eax + 0x10100680]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100b382e
cmp edx, ebx
jne 0x100b382e
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100b3885
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10091bd4
leave
ret
Function at 0x100b3b8b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10107e18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100b3bcb
cmp byte [ebx], 0xa
jne 0x100b3bcb
or byte [eax + edi + 0x28], 4
jmp 0x100b3bd0
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x100b3cce
mov al, byte [edx]
cmp al, 0x1a
je 0x100b3cb0
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x100b3bff
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x100b3c24
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x100b3c2e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x100b3be1
jmp 0x100b3cce
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b3cab
cmp dword [ebp - 0xc], 0
je 0x100b3cab
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x10107e18]
test byte [eax + edi + 0x28], 0x48
je 0x100b3c85
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100b3c70
mov byte [esi], dl
jmp 0x100b3c81
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10107e18]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100b3cce
cmp byte [ebp - 1], 0xa
jne 0x100b3c94
cmp esi, ebx
jne 0x100b3c94
mov byte [esi], 0xa
jmp 0x100b3ccd
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100b3b2d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100b3cce
mov byte [esi], 0xd
jmp 0x100b3ccd
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x10107e18]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100b3cca
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100b3cce
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret