joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a6f
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 2
call fcn.004060b1
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405a93
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405bcc
mov ebx, dword [sym.imp.kernel32.dll_GetShortPathNameA]
mov dword [0x4226f0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x4226f0
je 0x405ad7
push 1
push 0
push esi
call fcn.004059f8
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405bd2
cmp eax, edi
jg 0x405bd2
mov esi, 0x422168
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405bd2
cmp eax, edi
jg 0x405bd2
push esi
push ebp
push str._s_s_r_n
push 0x421d68
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423f70]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00402ca5
push 4
push 0xc0000000
push esi
call fcn.004059f8
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405bcc
push 0
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405bc5
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x405bc5
cmp edi, dword [esp + 0x18]
jne 0x405bc5
push str._Rename__r_n
push esi
call fcn.0040596d
test eax, eax
jne 0x405bd9
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405d21
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421d68
push eax
call fcn.004059b9
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
inc dword [0x423ff0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409404
push eax
call fcn.0040596d
test eax, eax
je 0x405b90
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405c00
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405bf5
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405b92

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x70023a23
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [0x7016a5f0]
cmp eax, 0xffffffff
push esi
mov esi, ecx
je 0x70023a3a
push dword [esi + 4]
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [esi]
add eax, 0x38
push eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop esi
ret
Function at 0x7002ca98
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x7014bd35
call fcn.70055494
sub esp, 0x10
push esi
mov esi, ecx
cmp dword [esi + 0xdc], 0
je 0x7002cbe5
mov ecx, dword [esi + 0xa0]
call fcn.70026bb2
cmp eax, 5
je 0x7002cbe5
push ebx
push edi
lea eax, [esi + 0xc0]
push eax
lea ecx, [ebp - 0x10]
call fcn.700e1dcd
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
and dword [ebp - 4], 0
call ebx
mov edi, eax
mov eax, dword [esi + 0xd8]
test eax, eax
je 0x7002cb23
mov ecx, dword [esi + 0xdc]
lea ecx, [eax + ecx - 0x7d]
push ecx
push eax
push edi
call fcn.700e1dcd
add esp, 0xc
test eax, eax
je 0x7002cb23
cmp dword [ebp - 0x10], 0
je 0x7002cbe3
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x7002cbe3
lea ecx, [ebp - 0x10]
mov dword [esi + 0xd8], edi
call fcn.7002ab32
push esi
lea ecx, [ebp - 0x1c]
call fcn.700e1dcd
mov eax, dword [esi + 0x54]
and eax, 0x400000
neg eax
sbb eax, eax
and eax, 0x70170c20
push eax
lea ecx, [ebp - 0x14]
call fcn.700e1dcd
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.7002c223
xor edi, edi
cmp dword [esi + 0x84], edi
je 0x7002cbc1
mov eax, dword [esi + 0x54]
test al, 4
jne 0x7002cbc1
cmp word [esi + 0x8c], di
je 0x7002cbc1
test eax, 0x40000
jne 0x7002cbc1
mov ecx, esi
call fcn.70026b58
mov ecx, eax
call fcn.700e1dcd
mov eax, dword [esi + 0x90]
cmp eax, edi
je 0x7002cbb1
mov ecx, dword [eax + 4]
test byte [ecx + 0x24], 0x10
jne 0x7002cba5
mov eax, dword [eax]
jmp 0x7002cb94
push dword [eax + 4]
mov ecx, esi
call fcn.700e1dcd
jmp 0x7002cb8e
push edi
push edi
call dword [sym.imp.oleaut32.dll_CreateErrorInfo]
call ebx
mov dword [esi + 0xd8], eax
cmp dword [ebp - 0x14], edi
mov esi, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
je 0x7002cbd1
push dword [ebp - 0x14]
call esi
lea ecx, [ebp - 0x1c]
call fcn.70023a23
cmp dword [ebp - 0x10], edi
je 0x7002cbe3
push dword [ebp - 0x10]
call esi
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x70030deb
Capabilities:
Move file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x70030e18
push dword [esi + 4]
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_MoveFileW]
test eax, eax
jne 0x70030e0d
mov eax, 0x80004005
pop esi
ret
mov ecx, esi
call fcn.70030a50
xor eax, eax
pop esi
ret
mov eax, dword [esi]
test eax, eax
je 0x70030e27
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi], 0
push edi
push dword [esi + 8]
mov ecx, esi
push dword [esi + 4]
call fcn.700e1dcd
mov edi, eax
test edi, edi
jl 0x70030e42
mov ecx, esi
call fcn.70030a50
mov eax, edi
pop edi
pop esi
ret

Function at 0x7003378c
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x7014c28a
call fcn.70055494
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
inc ebx
xor edi, edi
sub eax, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
je 0x70033884
dec eax
je 0x700337ed
dec eax
je 0x700337cf
dec eax
jne 0x700337cf
push edi
push edi
mov dword [ebp - 4], 4
call dword [sym.imp.oleaut32.dll_CreateErrorInfo]
call fcn.7006977d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
mov dword [ebp - 4], edi
call fcn.700e1dcd
cmp eax, edi
mov dword [0x70170c00], eax
jne 0x70033809
push 0x700043f4
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov eax, dword [ebp + 8]
push 0x70170ae0
push ebx
mov dword [0x70170ae4], eax
call dword [sym.imp.ole32.dll_CoGetMalloc]
cmp dword [0x70170ae0], edi
je 0x7003386d
cmp eax, edi
jl 0x7003386d
mov esi, dword [sym.imp.kernel32.dll_InitializeCriticalSection]
push 0x70170af0
call esi
push 0x70170b08
call esi
call fcn.7005a8ed
cmp eax, edi
jl 0x7003386d
cmp dword [0x70170adc], edi
jne 0x70033860
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x34]
mov dword [0x70170adc], eax
call fcn.7006162e
cmp eax, ebx
je 0x700337cf
mov dword [ebp - 0x14], edi
jmp 0x700337cf
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], 2
je 0x70033897
mov eax, ebx
jmp 0x700337d2
push edi
push edi
call dword [sym.imp.oleaut32.dll_CreateErrorInfo]
cmp dword [0x70170acc], edi
je 0x700338ae
xor eax, eax
jmp 0x700337d2
call fcn.7006977d
call fcn.700fb369
mov esi, dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push 0x70170af0
call esi
push 0x70170b08
call esi
mov eax, dword [0x70170ae0]
cmp eax, edi
je 0x700338db
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x70170ae0], edi
call fcn.70060fab
jmp 0x700337cf
Function at 0x70043558
Capabilities:
Create thread

Disassembly:
mov eax, 0x7014c950
call fcn.70055494
push ecx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.700e1dcd
xor edi, edi
push edi
push edi
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.kernel32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 0x18], eax
jne 0x70043590
push 0x9b1
jmp 0x700435ad
push esi
push edi
push 0x70043545
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
jne 0x700435db
push 0x9b0
push 0x70007088
push 0x80004005
call fcn.700e1dcd
add esp, 0xc
cmp dword [ebp - 0x10], edi
mov esi, eax
je 0x700435cf
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x700435f0
push 1
call dword [sym.imp.kernel32.dll_Sleep]
test byte [esi], 2
je 0x700435d3
cmp dword [ebp - 0x10], edi
je 0x700435ee
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x700531b7
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.kernel32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x700531d7
push 0x9b1
jmp 0x700531f4
push esi
push edi
push 0x70053185
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
jne 0x70053208
push 0x9b0
push 0x70007088
push 0x80004005
call fcn.700e1dcd
add esp, 0xc
jmp 0x7005320a
xor eax, eax
pop edi
pop esi
ret

Function at 0x700555ea
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [section..cdata]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.700555ea
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [section..cdata]
jne 0x700555f3
ret
jmp 0x700554b8
Function at 0x70055a6a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
push dword [0x7016a5f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x70055aa5
mov edi, dword [sym.imp.kernel32.dll_IsBadReadPtr]
push 0x4c
push esi
call edi
test eax, eax
jne 0x70055aa5
mov esi, dword [esi + 0xc]
test esi, esi
je 0x70055aa5
push 0x2018
push esi
call edi
test eax, eax
jne 0x70055aa5
inc eax
jmp 0x70055aa7
xor eax, eax
pop edi
pop esi
ret

Function at 0x7006002d
Capabilities:
Get socket status
Read file on windows

Disassembly:
mov eax, 0x7014d4cd
call fcn.70055494
sub esp, 0x210
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
neg eax
lea ecx, [esi + 0x28]
sbb eax, eax
and eax, ecx
push edi
push eax
lea ecx, [ebp - 0x10]
call fcn.700e1dcd
mov eax, dword [esi]
xor edi, edi
test eax, 0x10000000
mov dword [ebp - 4], edi
je 0x70060088
call fcn.7006107f
push edi
push 6
mov ecx, eax
call fcn.700e1dcd
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
mov esi, eax
je 0x70060081
call fcn.700e1dcd
mov eax, esi
jmp 0x70060173
test al, 1
je 0x700600e5
lea eax, [esi + 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x700600d1
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
je 0x700600d1
call fcn.7006107f
push 0xffffffffffffffff
push 0x70001d68
push esi
push 4
push 0xfffffffffffffffa
mov ecx, eax
call fcn.700e1dcd
jmp 0x70060073
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
je 0x700600dd
call fcn.700e1dcd
xor eax, eax
inc eax
jmp 0x70060173
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
cmp eax, edi
push ebx
mov dword [ebp + 8], eax
mov dword [ebp - 0x118], edi
jbe 0x70060163
cmp dword [esi + 0x3c], edi
jne 0x7006013e
mov ebx, dword [esi + 0x1c]
cmp ebx, edi
je 0x7006013e
test byte [esi + 3], 0x20
jne 0x7006013e
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
mov dword [ebp - 0x21c], edi
call fcn.700e1dcd
push ebx
lea eax, [ebp - 0x118]
push eax
push eax
lea eax, [ebp - 0x21c]
push eax
push 1
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
je 0x70060183
push edi
push dword [ebp + 8]
mov ecx, esi
push dword [ebp - 0x14]
push dword [esi + 4]
call fcn.700e1dcd
cmp eax, 0xffffffff
je 0x700601a8
cmp eax, edi
je 0x700601a8
sub dword [ebp + 8], eax
add dword [ebp - 0x14], eax
cmp dword [ebp + 8], edi
ja 0x700600fc
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
je 0x7006016f
call fcn.700e1dcd
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8
or byte [esi + 3], 0x10
call fcn.7006107f
push edi
push 6
mov ecx, eax
call fcn.700e1dcd
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
mov esi, eax
je 0x700601a4
call fcn.700e1dcd
mov eax, esi
jmp 0x70060172
call fcn.7006107f
push 0x1456
push 0xfffffffffffffffa
jmp 0x7006018f

Function at 0x70060fc8
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7016a5f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax + 0xc]
jmp fcn.7005afdf
Function at 0x7006107f
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7016a5f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax + 0xc]
ret

Function at 0x700616b6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x7016a5f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax + 0xc]
push 0xffffffffffffffff
push 0
push 0
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.700e1dcd
pop ebp
ret

Function at 0x700616e4
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7016a5f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
ret

Function at 0x700616fc
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7016a5f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 8]
ret

Function at 0x70061714
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7016a5f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
ret

Function at 0x7006172c
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7016a5f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax + 0xc]
add eax, 0x10
ret

Function at 0x70061870
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x7014d59a
call fcn.70055494
push ecx
push esi
call dword [sym.imp.kernel32.dll_TlsAlloc]
or esi, 0xffffffff
cmp eax, esi
mov dword [0x7016a5f0], eax
je 0x70061901
call fcn.7005bea2
cmp eax, 1
je 0x700618b6
push 0x7000433b
push 0xc001007b
push 6
call fcn.700e1dcd
push 0x29
push esi
call fcn.700e1dcd
add esp, 0x14
jmp 0x70061903
call fcn.7005a8ed
test eax, eax
jge 0x700618cb
push 0x29
push esi
call fcn.700e1dcd
pop ecx
pop ecx
jmp 0x70061903
call fcn.7006159c
push 0x264
mov esi, eax
call fcn.700e1dcd
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x700618f1
call fcn.70061229
jmp 0x700618f3
xor eax, eax
test eax, eax
mov dword [0x70170c18], eax
jne 0x70061901
push 0xfffffffffffffffb
pop eax
jmp 0x70061903
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x7008156e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x7014dfc3
call fcn.70055494
sub esp, 0x6c
mov eax, dword [ecx + 4]
cmp ecx, dword [eax + 0xbc]
push esi
mov dword [ebp - 0x14], ecx
je 0x70081592
xor esi, esi
inc esi
jmp 0x70081723
push ebx
push edi
push dword [eax + 0x94]
lea ecx, [ebp - 0x28]
call fcn.700e1dcd
lea ecx, [ebp - 0x28]
call fcn.7006810f
xor ebx, ebx
jmp 0x70081716
push ebx
push dword [eax + 0x4c]
call fcn.700e1dcd
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x7008170e
cmp word [edi], bx
je 0x7008170e
push 1
push ebx
lea ecx, [ebp - 0x78]
call fcn.7005cc25
push 0x700092d0
push 0x700092c8
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], ebx
call fcn.700e1dcd
mov esi, eax
cmp esi, 1
lea ecx, [ebp - 0x78]
jne 0x70081747
push edi
call fcn.700e1dcd
xor edi, edi
mov esi, eax
inc edi
cmp esi, edi
lea ecx, [ebp - 0x78]
jne 0x70081747
lea eax, [ebp - 0x10]
push eax
push 0x70001e00
call fcn.700e1dcd
mov esi, eax
cmp esi, edi
jne 0x70081744
cmp dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x78]
je 0x70081705
lea eax, [ebp - 0x10]
push eax
push 0x70001e34
call fcn.700e1dcd
mov esi, eax
cmp esi, edi
jne 0x70081744
cmp dword [ebp - 0x10], ebx
je 0x70081702
mov dword [ebp - 0x18], edi
push ebx
lea ecx, [ebp - 0x3c]
call fcn.700e1dcd
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.700e1dcd
mov esi, eax
cmp esi, edi
jne 0x70081732
mov eax, dword [ebp - 0x38]
cmp eax, ebx
mov esi, eax
je 0x700816d3
cmp word [eax], bx
je 0x700816d3
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1b0]
jne 0x700816bc
cmp eax, ebx
je 0x700816ab
mov eax, dword [eax]
jmp 0x700816ad
xor eax, eax
push 0x100
push esi
mov ecx, eax
call fcn.700e1dcd
jmp 0x700816d3
cmp eax, ebx
je 0x700816c4
mov eax, dword [eax]
jmp 0x700816c6
xor eax, eax
push 0x100
push esi
mov ecx, eax
call fcn.700e1dcd
lea eax, [ebp - 0x18]
push eax
push 0x2c
lea ecx, [ebp - 0x78]
call fcn.700e1dcd
lea ecx, [ebp - 0x3c]
mov esi, eax
mov dword [ebp - 0x3c], 0x700020a8
mov byte [ebp - 4], bl
call fcn.70026b2f
cmp esi, edi
jne 0x70081744
cmp dword [ebp - 0x18], ebx
jne 0x7008165b
lea ecx, [ebp - 0x78]
or dword [ebp - 4], 0xffffffff
call fcn.7005cc85
lea ecx, [ebp - 0x28]
call fcn.70067ed8
cmp eax, ebx
jne 0x700815b1
xor esi, esi
inc esi
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
mov dword [ebp - 0x3c], 0x700020a8
call fcn.70026b2f
lea ecx, [ebp - 0x78]
or dword [ebp - 4], 0xffffffff
call fcn.7005cc85
jmp 0x70081721
Function at 0x700e0a0b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x54], edi
jne 0x700e0a22
push edi
push edi
push edi
push 1
call fcn.700e1dcd
mov eax, dword [esi + 0x54]
cmp eax, edi
jne 0x700e0a30
pop edi
pop esi
jmp fcn.700616e4
mov eax, dword [eax + 4]
cmp eax, edi
je 0x700e0a3c
mov eax, dword [eax + 0x38]
jmp 0x700e0a3e
xor eax, eax
cmp eax, edi
push ebx
jne 0x700e0a68
mov edi, dword [esi + 0x38]
xor ebx, ebx
inc ebx
cmp edi, ebx
jl 0x700e0a68
push ebx
lea ecx, [esi + 0x28]
call fcn.700e1dcd
mov ecx, dword [esi + 0x54]
push eax
call fcn.700e1dcd
test eax, eax
je 0x700e0a7c
inc ebx
cmp ebx, edi
jle 0x700e0a4d
mov ecx, dword [esi + 0x54]
push 0
add ecx, 8
call fcn.700e1dcd
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
ret
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
push 0
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x700e0a78
Function at 0x7012e379
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x701534a3
call fcn.70055494
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.700e1dcd
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
xor edi, edi
sub eax, edi
mov dword [ebp - 4], edi
mov dword [esi], 0x700154e4
je 0x7012e3be
dec eax
je 0x7012e3be
dec eax
jne 0x7012e3c5
mov eax, 0x700155e0
jmp 0x7012e3c8
mov eax, 0x700155dc
jmp 0x7012e3c8
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_fopen]
cmp eax, edi
pop ecx
pop ecx
mov dword [esi + 0x5c], eax
jne 0x7012e3ef
call dword [sym.imp.msvcrt.dll__errno]
push dword [eax]
push dword [ebp + 8]
push 0x700155b4
push 1
jmp 0x7012e445
push ebx
push 2
push edi
mov edi, dword [sym.imp.msvcrt.dll_fseek]
push eax
call edi
push dword [esi + 0x5c]
call dword [sym.imp.msvcrt.dll_ftell]
push 0
push 0
push dword [esi + 0x5c]
mov ebx, eax
mov dword [esi + 0x60], ebx
call edi
mov eax, dword [esi + 0x1c]
or ecx, 0xffffffff
add esp, 0x1c
cmp eax, ecx
je 0x7012e424
cmp eax, ebx
jbe 0x7012e427
mov dword [esi + 0x1c], ebx
mov eax, dword [esi + 0x1c]
test eax, eax
pop ebx
jne 0x7012e44f
push dword [esi + 0x5c]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
push 0
push dword [ebp + 8]
push 0x7001557c
push 2
lea ecx, [esi + 4]
call fcn.7012e00f
jmp 0x7012e499
cmp eax, ecx
jbe 0x7012e460
cmp dword [esi + 0x14], 0
jne 0x7012e45d
inc eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ecx
cmp dword [esi + 0x14], ecx
jbe 0x7012e468
mov dword [esi + 0x14], ecx
push dword [esi + 0x1c]
call fcn.700e1dcd
push dword [esi + 0x5c]
mov dword [esi + 0x28], eax
push dword [esi + 0x1c]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x14
sub dword [esi + 0x60], eax
mov dword [esi + 0x34], eax
je 0x7012e492
cmp eax, dword [esi + 0x1c]
jae 0x7012e499
mov ecx, esi
call fcn.7012d2b1
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x70144149
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x14], edi
je 0x701441d3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_WaitForSingleObject]
push 0x2710
push dword [esi + 0x20]
call ebx
cmp eax, 0x102
jne 0x7014417a
push edi
push dword [esi + 0x18]
call dword [sym.imp.kernel32.dll_TerminateThread]
jmp 0x701441ae
push dword [esi + 0x1c]
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov edi, dword [sym.imp.kernel32.dll_SetEvent]
call edi
push dword [esi + 0x20]
call edi
push 0x2710
push dword [esi + 0x18]
call ebx
cmp eax, 0x102
jne 0x701441ac
push 0
push dword [esi + 0x18]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
push dword [esi + 0x1c]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
call ebx
push dword [esi + 0x20]
call ebx
push dword [esi + 0x18]
call ebx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x2c], edi
pop ebx
xor eax, eax
pop edi
inc eax
pop esi
ret