joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4643e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8ad8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov ecx, dword [ebp + 8]
mov dword [esi], 0x4ef71c
mov dword [esi + 0x20], ecx
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0
call fcn.00403070
mov ecx, eax
test ecx, ecx
je 0x464477
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x2c], eax
mov al, byte [ebp + 0xc]
mov byte [esi + 0x30], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00402980
int3

Function at 0x468d70
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4830
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0x30]
call fcn.0043d1c0
mov edx, dword [edi + 0x94]
or esi, 0xffffffff
sub edx, 0x10
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x468dbf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [edi + 0x64]
call fcn.0040d570
mov edx, dword [edi + 0x5c]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x468de1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x58]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x468dfb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x54]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x468e15
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x50]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x468e2f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [edi + 0x30]
call fcn.0043d1c0
mov edx, dword [edi + 8]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x468e51
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 4]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x468e6b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi]
sub edx, 0x10
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x468e82
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495060
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcc31
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov esi, dword [0x4df5dc]
mov dword [edi], 0x4fa3a8
mov dword [edi + 0x20], 0
mov dword [edi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x34], 0x4e1570
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], edi
mov dword [edi + 0x40], 0x3ef
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0x4e1570
mov dword [edi + 0x60], esi
mov dword [edi + 0x64], edi
mov dword [edi + 0x68], 0x454
mov dword [edi + 0x6c], 0
lea ecx, [edi + 0x70]
call fcn.0048c360
lea ecx, [edi + 0xcc]
call fcn.0048c360
lea ecx, [edi + 0x128]
mov byte [ebp - 4], 4
call fcn.00431d50
lea ecx, [edi + 0x130]
mov byte [ebp - 4], 5
call fcn.0042f910
push 0
push 0
push ecx
mov eax, esp
mov byte [ebp - 4], 6
push ecx
lea ecx, [edi + 0x194]
mov dword [eax], 0x4f9970
mov eax, esp
mov dword [eax], 0x8b
call fcn.0042f820
push 1
push 0
push ecx
mov eax, esp
mov byte [ebp - 4], 7
push ecx
lea ecx, [edi + 0x1f8]
mov dword [eax], 0x4f9974
mov eax, esp
mov dword [eax], 0x7f
call fcn.0042f820
mov dword [edi + 0x25c], 0
mov dword [edi + 0x260], 0
mov dword [edi + 0x264], 0
mov dword [edi + 0x268], 0
mov dword [edi + 0x26c], 0
mov dword [edi + 0x274], 0
mov dword [edi + 0x284], 0
mov dword [edi + 0x288], 0
mov dword [edi + 0x28c], 0
mov dword [edi + 0x290], esi
mov dword [edi + 0x294], 8
mov dword [edi + 0x298], 0
mov dword [edi + 0x2ac], 0
and dword [edi + 0x2b4], 0xfffffff0
mov dword [edi + 0x2b0], 0
mov dword [edi + 0x29c], 0xffffffff
mov dword [edi + 0x2a0], 0xffffffff
mov dword [edi + 0x2a4], 0xffffffff
mov dword [edi + 0x2a8], 0xffffffff
mov dword [edi + 0x270], 0x4e08b4
mov dword [edi + 0x2b8], 0
call fcn.00403070
mov ecx, eax
test ecx, ecx
je 0x49529b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x2bc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x2c4], eax
mov eax, edi
mov byte [edi + 0x2c0], 0
mov dword [edi + 0x2d0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402980
int3
Function at 0x4c5647
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c54c6
Function at 0x10007d84
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor esi, esi
push 0x10
call edi
push 2
pop ecx
test ax, ax
push 0x11
cmovs esi, ecx
call edi
test ax, ax
jns 0x10007da7
or esi, 1
push 0x12
call edi
test ax, ax
jns 0x10007db3
or esi, 4
pop edi
mov eax, esi
pop esi
ret
Function at 0x10009366
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1021383e
call fcn.10210210
push ecx
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
or dword [ecx + 0x10], 0xffffffff
or dword [ecx + 0x14], 0xffffffff
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x54], eax
mov eax, ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
leave
ret

Function at 0x1000b65c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set global application hook
Set thread local storage value

Disassembly:
mov eax, dword [0x102ae450]
cmp eax, 0xffffffff
jne 0x1000b676
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x102ae450], eax
cmp eax, 0xffffffff
je 0x1000b6a8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1000b6a8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x1000b585
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
je 0x1000b6a8
push eax
push dword [0x102ae450]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
ret

Function at 0x1000b798
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 6
lea eax, [ebp - 8]
push eax
push 0x1004
movzx eax, cx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0xa
lea eax, [ebp - 8]
push 0
push eax
call fcn.101dbe27
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10015e9c
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x10214122
call fcn.10210210
sub esp, 0xc
and dword [esp], 0
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push edi
mov ebp, ecx
lea ecx, [esp + 0xc]
push ebx
call fcn.1000fdf5
and dword [esp + 0x20], 0
lea ecx, [esp + 0x2c]
push dword [esp + 0x30]
and dword [esp + 0x30], 0
call fcn.1000fdf5
mov edi, dword [esp + 0x34]
mov ecx, ebp
push edi
mov byte [esp + 0x24], 1
call fcn.10036c80
cmp dword [esp + 0x30], ebx
je 0x10015f4e
test ebx, ebx
je 0x10015f4e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x494]
cmp eax, ebp
jne 0x10015f4e
push esi
push edi
push dword [esp + 0x38]
mov ecx, ebx
push ebp
call fcn.1006d713
push eax
mov ecx, ebp
call fcn.10015e9c
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call dword [eax + 0x464]
mov esi, dword [edi + 0x18]
mov ecx, ebx
mov edx, dword [edi + 0x14]
push edi
sub esi, dword [eax + 4]
sub edx, dword [eax]
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], esi
mov eax, dword [ebx]
push ebp
call dword [eax + 0xb8]
pop esi
test al, al
je 0x10015f4e
or dword [edi + 4], 0x10000
mov bl, byte [edi + 6]
mov byte [esp + 0x20], 0
and bl, 1
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x10015f66
mov eax, dword [ecx]
call dword [eax + 4]
or dword [esp + 0x20], 0xffffffff
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x10015f78
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
mov al, bl
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x1001c04c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1001c0f6
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov cl, byte [ebp + 0x1c]
shr eax, 0x1c
and al, 1
cmp cl, al
je 0x1001c0a3
test cl, cl
je 0x1001c082
push 8
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1001c0d7
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x1001c098
push dword [edi + 0x19c]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1001c0f6
mov eax, dword [ebp + 0xc]
sub esp, 0x10
mov ecx, esp
mov edx, esi
sub esp, 0x10
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ecx + 0xc], eax
mov ecx, esp
call fcn.1001bd79
call fcn.1001d7a2
add esp, 0x20
test al, al
jne 0x1001c0f6
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp + 0x10]
push 1
inc eax
push eax
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0xc]
inc eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x10026108
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x17
push ecx
push dword [0x102b7444]
mov edi, edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x10026125
xor al, al
jmp 0x1002615a
push esi
push dword [0x102b7444]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10026121
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [edi], eax
test eax, eax
je 0x10026121
push esi
push dword [0x102b7444]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0xc]
add eax, dword [edi]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
ret

Function at 0x100261b2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov edi, edx
mov esi, ecx
push dword [0x102b7444]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100261d0
xor al, al
jmp 0x100261f3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi], eax
test eax, eax
je 0x100261cc
push dword [esp + 0xc]
push dword [0x102b7444]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, dword [esi]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
ret
Function at 0x1002a730
Capabilities:
Log keystrokes via input method manager

Disassembly:
movzx eax, word [ecx + 2]
push ebx
push edi
or edi, 0xffffffff
and eax, 0x3ff
mov ebx, edi
sub eax, 0x11
je 0x1002a764
dec eax
jne 0x1002a7e9
test dword [esp + 0x10], 0x4000
je 0x1002a7e9
xor ebx, ebx
xor edi, edi
inc ebx
jmp 0x1002a7e9
test byte [esp + 0x10], 0x10
je 0x1002a7e9
push ebp
push esi
xor esi, esi
push esi
push esi
push 0x10
push dword [esp + 0x20]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov ebp, eax
test ebp, ebp
jle 0x1002a7e7
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], esi
call fcn.1002aaa4
mov esi, dword [esp + 0x18]
test esi, esi
je 0x1002a7e7
push dword [esi - 4]
push esi
push 0x10
push dword [esp + 0x20]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
xor edi, edi
test ebp, ebp
jle 0x1002a7bf
mov al, byte [esi + edi]
cmp al, 1
je 0x1002a7bf
cmp al, 3
je 0x1002a7bf
inc edi
cmp edi, ebp
jl 0x1002a7af
mov ebx, edi
cmp edi, ebp
jge 0x1002a7d7
mov al, byte [esi + ebx]
cmp al, 1
je 0x1002a7d0
cmp al, 3
jne 0x1002a7d5
inc ebx
cmp ebx, ebp
jl 0x1002a7c5
cmp edi, ebp
jne 0x1002a7dd
mov ebx, edi
xor edi, edi
add esi, 0xfffffff8
push esi
call fcn.101dad34
pop ecx
pop esi
pop ebp
mov eax, dword [esp + 0x14]
mov dword [eax + 4], edi
pop edi
mov dword [eax + 8], ebx
pop ebx
ret 0xc

Function at 0x1002a7f8
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov eax, 0x10214aac
call fcn.10210210
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x20]
xor ebx, ebx
push esi
push edi
push ebx
push ebx
mov eax, ecx
push ebp
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov edi, eax
test edi, edi
jle 0x1002a886
mov esi, edi
mov dword [esp + 0x28], ebx
shr esi, 1
lea ecx, [esi + 1]
push ecx
lea ecx, [esp + 0x2c]
call fcn.1001064d
push esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], ebx
call fcn.1001064d
mov esi, dword [esp + 0x28]
push edi
push esi
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
push ecx
push ecx
mov eax, esp
test esi, esi
je 0x1002a862
mov ebx, dword [esi - 4]
mov edi, dword [esp + 0x34]
mov dword [eax], esi
mov dword [eax + 4], ebx
lea ecx, [edi + 0x10]
call fcn.10002785
mov dword [edi + 0xc], ebp
mov bl, 1
test esi, esi
je 0x1002a886
add esi, 0xfffffff8
push esi
call fcn.101dad34
pop ecx
mov ecx, dword [esp + 0x14]
mov al, bl
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x1002c6d3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x10214cbc
call fcn.10210210
push ecx
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], eax
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], eax
mov eax, ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10036bfd
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x10215ca2
call fcn.10210210
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.100044a7
and dword [ebp - 4], 0
lea ecx, [edi + 0x30]
mov dword [edi], vtable.html::event_mouse.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
and dword [ecx], 0
push dword [esi + 0x30]
call fcn.1000fdf5
mov eax, dword [esi + 0x34]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x34], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003cf2d
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x102164f8
call fcn.10210210
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x2c]
mov ebp, ecx
xor ebx, ebx
lea ecx, [esp + 0xc]
push edi
mov dword [esp + 0x10], ebx
call fcn.1000fdf5
push dword [esp + 0x30]
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], ebx
call fcn.1000fdf5
mov byte [esp + 0x20], 1
cmp dword [esp + 0x30], edi
je 0x1003cfdc
test edi, edi
je 0x1003cfdc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x494]
cmp eax, ebp
jne 0x1003cfdc
mov ebx, dword [esp + 0x34]
mov ecx, edi
push esi
push ebx
push dword [esp + 0x38]
push ebp
call fcn.1006d713
push eax
mov ecx, ebp
call fcn.1003cf2d
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call dword [eax + 0x464]
mov esi, dword [ebx + 0x18]
mov ecx, edi
mov edx, dword [ebx + 0x14]
push ebx
sub esi, dword [eax + 4]
sub edx, dword [eax]
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], esi
mov eax, dword [edi]
push ebp
call dword [eax + 0xa0]
pop esi
test al, al
je 0x1003cfd7
or dword [ebx + 4], 0x10000
mov bl, byte [ebx + 6]
jmp 0x1003cfe3
mov eax, dword [esp + 0x34]
mov bl, byte [eax + 6]
mov byte [esp + 0x20], 0
and bl, 1
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x1003cff8
mov eax, dword [ecx]
call dword [eax + 4]
or dword [esp + 0x20], 0xffffffff
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x1003d00a
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
mov al, bl
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x1003fdab
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x10216698
call fcn.10210210
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x2c]
mov ebp, ecx
xor ebx, ebx
lea ecx, [esp + 0xc]
push edi
mov dword [esp + 0x10], ebx
call fcn.1000fdf5
push dword [esp + 0x30]
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], ebx
call fcn.1000fdf5
mov byte [esp + 0x20], 1
cmp dword [esp + 0x30], edi
je 0x1003fe5a
test edi, edi
je 0x1003fe5a
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x494]
cmp eax, ebp
jne 0x1003fe5a
mov ebx, dword [esp + 0x34]
mov ecx, edi
push esi
push ebx
push dword [esp + 0x38]
push ebp
call fcn.1006d713
push eax
mov ecx, ebp
call fcn.1003fdab
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call dword [eax + 0x464]
mov esi, dword [ebx + 0x18]
mov ecx, edi
mov edx, dword [ebx + 0x14]
push ebx
sub esi, dword [eax + 4]
sub edx, dword [eax]
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], esi
mov eax, dword [edi]
push ebp
call dword [eax + 0x9c]
pop esi
test al, al
je 0x1003fe55
or dword [ebx + 4], 0x10000
mov bl, byte [ebx + 6]
jmp 0x1003fe61
mov eax, dword [esp + 0x34]
mov bl, byte [eax + 6]
mov byte [esp + 0x20], 0
and bl, 1
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x1003fe76
mov eax, dword [ecx]
call dword [eax + 4]
or dword [esp + 0x20], 0xffffffff
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x1003fe88
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
mov al, bl
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x10040d9f
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebp, ebp
push edi
mov edi, ecx
lea eax, [edi + 0x10]
mov dword [edi], vtable.tool::thread_pool.0
mov dword [edi + 4], ebp
push eax
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
call esi
lea eax, [edi + 0x28]
push eax
call esi
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x40], eax
xor eax, eax
mov dword [edi + 0x44], ebp
lea ebp, [edi + 0x48]
push 5
mov dword [ebp], eax
pop esi
push eax
push eax
push edi
push 0x10040fc8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0x10], eax
lea ecx, [edi + 4]
lea eax, [esp + 0x10]
push eax
call fcn.10042b32
xor eax, eax
inc eax
lock xadd dword [ebp], eax
push 0
pop eax
dec esi
jne 0x10040de4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x1004105e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x102167b4
call fcn.10210210
push ecx
push ebx
push ebp
mov ebp, ecx
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], ebp
mov dword [ebp + 4], eax
mov dword [esp + 0x1c], eax
lea edi, [ebp + 0xc]
mov ebx, dword [esp + 0x28]
mov dword [ebp], vtable.html::pump::task.0
mov dword [ebp + 8], ebx
mov dword [edi], eax
mov dword [ebp + 0x10], eax
lea esi, [ebx + 0xc]
push esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esp + 0x2c]
mov ecx, edi
mov byte [esp + 0x20], 3
call fcn.1000fec2
mov ecx, dword [edi]
push dword [ebx + 0x24]
add ecx, 0x30
call fcn.10132f35
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x14]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x100418b1
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10132bd5
push eax
lea eax, [ebp - 4]
push str.htmlayout_3.3___s__www.terrainformatica.com__
push eax
call fcn.10133776
add esp, 0xc
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x102b744c], eax
test eax, eax
je 0x100418f8
push 4
push 0x102ae688
push 2
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionA]
lea ecx, [ebp - 4]
call fcn.10002371
mov esp, ebp
pop ebp
ret
Function at 0x1004621c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x10216c1f
call fcn.10210210
push ecx
mov eax, dword [0x102b9164]
push ebx
push ebp
mov ebp, ecx
push esi
mov esi, edx
test al, 1
jne 0x10046255
or eax, 1
mov dword [0x102b9164], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x10226e29
mov dword [0x102b915c], eax
call fcn.101db097
pop ecx
push dword [0x102b915c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x10], ebx
call fcn.1000fdf5
mov dword [esp + 0x18], ebx
sub esi, ebx
je 0x100462bc
dec esi
je 0x1004629e
dec esi
je 0x10046292
dec esi
je 0x100462e6
dec esi
mov esi, dword [esp + 0xc]
jne 0x10046302
cmp esi, dword [esp + 0x24]
sete bl
jmp 0x10046302
mov esi, dword [esp + 0xc]
cmp esi, dword [esp + 0x24]
jne 0x10046302
jmp 0x100462ee
mov esi, dword [esp + 0x24]
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
push esi
push dword [0x102b915c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [esp + 0xc]
jmp 0x10046302
mov esi, dword [esp + 0xc]
test esi, esi
je 0x10046302
mov eax, dword [ebp]
mov ecx, ebp
push esi
call dword [eax + 0x22c]
push dword [0x102b915c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
lea ecx, [esp + 0x10]
call fcn.1000fdf5
mov esi, dword [esp + 0xc]
test esi, esi
je 0x10046302
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push ebx
push dword [0x102b915c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
or dword [esp + 0x18], 0xffffffff
test esi, esi
je 0x10046312
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
mov al, bl
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret