joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d657
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8ec
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x59cfc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], eax
call fcn.004ae035
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d6b1
push 0x80004005
call fcn.0048b9e7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], 0
call fcn.004ae035
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d6e4
push 0x80004005
call fcn.0048b9e7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x13c], edi
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.0048d597
mov eax, dword [ebp - 0x134]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
jne 0x48d782
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d736
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d756
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x134]
call fcn.0048ca17
add esp, 8
push 5
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x134]
call fcn.0048c5e7
mov eax, dword [eax]
push 0x54ef60
Function at 0x4a2d32
Capabilities:
Encode data using xor

Disassembly:
fisubr word [ebx - 0x6b26a32b]
xchg esp, eax
xor al, 0xe4
popfd
in al, 0x36
popfd
add bh, byte [edi + esi*2]
ja 0x4a2d48
or eax, 0xde051f4f
mov edx, esi
aad 0xf9
dec edi
pop ds
add eax, 0xd5d68bde
stc
aam 0x1c
add ecx, ebx
xchg edx, eax
push 0x95ed2669
mov ebp, edi
movsb byte es:[edi], byte [esi]
enter 0xc11, 0xffffffffffffffa7
mov dh, 8
daa
aam 0xe1
and eax, dword [edi]
mov cl, 0xf5
push cs
pushal
inc edx
xchg esi, eax
jnp 0x4a2d2d
loopne 0x4a2d34
in al, dx
jp 0x4a2d8c
jbe 0x4a2d39
mov dword [0xbd912ef9], eax
jbe 0x4a2db6
lodsd eax, dword [esi]
popfd
nop
nop
nop
nop
push ebp
mov ebp, esp
push ecx
mov edx, dword [0x45eaa0]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov ecx, dword [ebx + 8]
mov esi, ecx
sub esi, dword [ebx]
mov edi, dword [ebx + 0xc]
mov eax, esi
sub edi, dword [ebx + 4]
sub eax, edx
mov dword [ebp - 4], eax
mov eax, edi
sub eax, dword [0x45eaa4]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
dec eax
cmp eax, 7
ja 0x4a301d
jmp dword [eax*4 + 0x430f34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a3ed7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call 0x4c52f5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f22
push 0x80004005
call fcn.004a2ca7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call 0x4c52f5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f52
push 0x80004005
call fcn.004a2ca7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call 0x4c52f5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f7f
push 0x80004005
call fcn.004a2ca7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004a36d7
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004a36d7
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4adc1a
Capabilities:
Encode data using xor

Disassembly:
inc ebx
lea edi, [ebx]
sub byte [ecx], bh
adc dword [edx], edx
jnp 0x4adc53
pop ds
add al, 0x25
adc cx, 0x5b4a
dec edx
pop ebx
and edx, dword [edi]
in al, 0x37
jmp 0x4adc7a
invalid
push edx
cdq
popal
dec edi
xor eax, 0x7d79d471
jno 0x4adc29
jns 0x4adcd4
and eax, 0x4e33e916
in al, 0x70
movsd dword es:[edi], dword [esi]
js 0x4adc4d
dec ecx
or byte [0x49bd5435], ch
dec edi
push esi
insd dword es:[edi], dx
outsb dx, byte [esi]
jns 0x4adc95
invalid
mov word [ebx - 0x354444a2], gs
jo 0x4adc4e
pop esi
mov ebx, 0xcc70cabb
idiv al
add dword [esi + 0x8445abb], esi
movsd dword es:[edi], dword [esi]
sahf
cmpsd dword [esi], dword es:[edi]
jnp 0x4adc8f
mov ebx, 0x84835b8f
enter 0xffffffffffffd9aa, 0xffffffffffffff96
inc ebp
jp 0x4adc26
stosb byte es:[edi], al
fst dword [esi - 0x787485bb]
cmp dword [edi - 0x65cf4581], 0xfffffff9
mov esi, 0x57385751
xchg dword [ebx + 0x30ba7fbf], eax
lcall 0x5738, 0x5751bef9
mov bh, byte [ecx - 0x37]
aam 0xa1
mov dh, 0xb1
cdq
stc
mov edx, 0x8a1a5e30
xchg esi, eax
lodsd eax, dword [esi]
lds ebx, [ebx - 0x5e5dae72]
clc
pop ds
sbb byte [edi + 0x4e], bl
jno 0x4adc7c
invalid
xor eax, 0xaff707a
jo 0x4adcd5
dec dword [edx]
or bl, byte [edx - 0x329e9cee]
jo 0x4adcd2
lcall 0xf470, 0xcd616312
nop
cwde
dec ebp
adc dl, byte [eax + 0x4e]
shr ch, cl
pop edi
pop ebx
dec ebp
adc dl, byte [eax - 0x4c]
nop
out 0x59, al
or al, byte [esi + ebx*8 - 0x7a]
adc al, 0x73
retf

Function at 0x4aed5d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cdq
sub ch, byte [ecx]
jle 0x4aedae
mov dl, 0x3b
and al, 0x17
lodsd eax, dword [esi]
or al, 0x1d
mov byte [edi + 0x338a9ee6], al
push edx
or al, 0x23
scasb al, byte es:[edi]
xchg ebp, eax
cld
cmp eax, 0xa3665519
dec ecx
lds esp, [ebp + 0x71]
push cs
test dword [eax], esp
movsd dword es:[edi], dword [esi]
add byte [ebp - 0x52], 0x29
dec esi
or dword [edi + 0x2e79858f], esp
jno 0x4aed48
test dword [ecx + 0x66], eax
add eax, 0xaf4e25c2
stosb byte es:[edi], al
xchg ebp, eax
mov al, byte [0x8b68bdc5]
xchg ecx, eax
sub byte [ecx], al
cmp dh, ch
imul esi, dword [0x2fc12268], 0xecbffe1b
add eax, 0xdba55bfb
xlatb
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
fisubr word [esi - 0x1b]
scasb al, byte es:[edi]
fld xword [eax - 0x4c]
test al, 0x14
mov dl, byte [edi + 0x4581f199]
cmp al, 0xd5
sub dword [ecx + 0x2e], ebx
int1
add dword [ebp + 0x3c], 0x2e5929d5
push ebx
dec ebp
and edx, edi
test esp, edi
or ecx, dword [ebx - 0x53e71085]
adc esp, dword [edi - 0x11634206]
xor eax, 0x54838f86
jl 0x4aed8f
invalid

Function at 0x4b25a2
Capabilities:
Encode data using xor

Disassembly:
cmp byte [esi], ah
cmpsd dword [esi], dword es:[edi]
and al, 0x80
mov dh, 0x8e
or dword [esp + eax*4 + 0x1db57ea3], edi
imul ebx, dword [edi], 0x74d89216
xor dword [edx], ebx
push ss
xchg edx, eax
fdiv dword [ecx + esi + 0x1a]
lcall 0x2060, 0x6d5ba46c
inc ecx
dec ebx
jle 0x4b2573
int3
aam 0xe4
dec ebp
xlatb
pop ecx
jnp 0x4b2584
or ch, byte [esp + esi*8 + 0x11]
cdq
dec esi
hlt
Function at 0x4b81b0
Capabilities:
Encode data using xor

Disassembly:
dec ebx
mov eax, dword [0xa25b6144]
inc esp
pushfd
add byte [esi - 0x4fdfe662], bh
movsb byte es:[edi], byte [esi]
shl byte [eax], 0xee
and dh, ch
sub ecx, dword [edi + 0x2e]
shl byte [ebx + 0x6ae2efa7], 0x77
loope 0x4b821c
and edx, edi
scasd eax, dword es:[edi]
xor eax, 0xb72405b2
rol byte [edx + esi], cl
inc esp
in eax, dx
jp 0x4b818f
invalid
mov eax, fs
push eax
or ebp, esp
test eax, 0x8df707b0
leave
sar byte [ebx - 0x4e], cl
in eax, dx
and esp, dword [esi + 0x34]
in eax, 0xa9
mov al, 7
test dword [ebp - 0x4d842d37], 0x346623ed
salc
push eax
xor byte [ebp + 0x45], bl
xchg esp, eax
push ebp
pop ebx
jae 0x4b8209
jo 0x4b817f
movsb byte es:[edi], byte [esi]
mov al, 0xa
pushfd
je 0x4b823b
jmp 0x4b81b4
test eax, 0xa1f1ccad
imul byte [edi]
xchg ecx, eax
jmp 0xc5ee9053
pop ss
jmp 0x4b8208
xor ecx, ebx
in al, dx
and dword [ecx + 0x67b85d89], ebx
adc dword [edi - 0x4fae5ccf], esp
push ecx
jecxz 0x4b825e
and dh, byte [edi + eax*4 - 0x1dce90cc]
adc dword [esp + edx*8 - 0x21], eax
push ecx
or al, 0x51
push 0x11
and dh, byte [ecx]
cmc
xor edx, esi
cmc
mov eax, dword [0xb2c96fc9]
push ebx
insd dword es:[edi], dx
push eax
test eax, 0x1ac5d825
mov ah, 0xf8

Function at 0x566701
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 4], esi
pop esi
mov dword [esp], ecx
or al, 0x24
mov dword [esp], edi
mov dword [esp], edx
adc al, 0x24
sub esp, 4
mov dword [esp], ecx
mov edx, dword [esp]
adc al, 0x24
push edi
mov dword [esp], ebx

Function at 0x566707
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 4], esi
pop esi
mov dword [esp], ecx
or al, 0x24
mov dword [esp], edi
mov dword [esp], edx
adc al, 0x24
sub esp, 4
mov dword [esp], ecx
mov edx, dword [esp]
adc al, 0x24
push edi
mov dword [esp], ebx

Function at 0x56670d
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 4], esi
pop esi
mov dword [esp], ecx
or al, 0x24
mov dword [esp], edi
mov dword [esp], edx
adc al, 0x24
sub esp, 4
mov dword [esp], ecx
mov edx, dword [esp]
adc al, 0x24
push edi
mov dword [esp], ebx

Function at 0x566713
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 4], esi
pop esi
mov dword [esp], ecx
or al, 0x24
mov dword [esp], edi
mov dword [esp], edx
adc al, 0x24
sub esp, 4
mov dword [esp], ecx
mov edx, dword [esp]
adc al, 0x24
push edi
mov dword [esp], ebx

Function at 0x566719
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 4], esi
pop esi
mov dword [esp], ecx
or al, 0x24
mov dword [esp], edi
mov dword [esp], edx
adc al, 0x24
sub esp, 4
mov dword [esp], ecx
mov edx, dword [esp]
adc al, 0x24
push edi
mov dword [esp], ebx

Function at 0x56671f
Capabilities:
Parse pe header

Disassembly:
mov ebx, esp
add ebx, 4
add byte [eax], al
add ebx, 4
xchg dword [esp], ebx
pop esp

Function at 0x56672b
Capabilities:
Parse pe header

Disassembly:
mov ebx, esp
add ebx, 4
add byte [eax], al
add ebx, 4
xchg dword [esp], ebx
pop esp
Function at 0x566731
Capabilities:
Parse pe header

Disassembly:
mov eax, esi
pop esi
pop ebp
ret
je 0x418386
jmp 0x54e427
add esi, 0x1000
jmp 0x554b4b
cmp esi, 0x7d000000
jmp 0x554b56
jb 0x5678ab
jmp loc.0041836f
sub esp, 4
mov dword [esp], edi
push 0x2b729c3f
pop edi
sub eax, edi
mov edi, dword [esp]
add esp, 4
add eax, esi
add eax, 0x2b729c3f
sub esp, 4
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
mov dword [esp], ebx
push ecx
mov ebx, dword [esp]
push esi
mov esi, esp
add esi, 4
push eax
mov eax, 4
add esi, eax
pop eax
push esi
push dword [esp + 4]
pop esi
pop dword [esp]
pop esp
mov ebx, dword [esp]
push 0x7e1a52c9
mov dword [esp], edx
mov edx, esp
add edx, 4
push ebp
push 0x7f2a62de
pop ebp
add ebp, 0x80d59d26
add edx, ebp
pop ebp
xchg dword [esp], edx
pop esp
jmp 0x5d4329
push eax
push esi
mov esi, 0x16c5031e
push dword [esp]
pop edx
push ebx
mov ebx, esp
jecxz 0x566790
mov edi, 0x79fd24b9
inc edi
push ebp
mov ebp, 0x79fd24be
xor edi, ebp
pop ebp
add ebx, edi
pop edi
add ebx, 4
xchg dword [esp], ebx
pop esp
push dword [0x4bcbdc]
mov eax, dword [esp]
push eax
mov eax, esp
push esi
mov esi, 4
add eax, esi
pop esi
push ebx
mov ebx, 0x17fe7421
xor ebx, 0x17fe7425
add eax, ebx
pop ebx
xchg dword [esp], eax
pop esp
jmp 0x56cfa0
push ecx
mov ecx, esp
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], ebx
mov dword [esp], esi
jmp 0x5d871c
push dword [eax + 0x3c]
push dword [esp]
pop eax
push edi
mov edi, esp
add edi, 4
push edx
mov edx, 0x76ff23eb
shr edx, 4
not edx
sub edx, 0xf8900dbd
add edi, edx
pop edx
xchg dword [esp], edi
pop esp
jmp 0x559911
je 0x54e427
jmp 0x5df89e
jne 0x54e427
jmp 0x5666fa
mov dword [0x4bce78], eax
jmp 0x5d4333
cmp word [eax], 0x4550
jmp 0x54e41c
push edx
mov dword [esp], eax
push esi
push 0x6c52e5fd
pop esi
mov dword [esp + 4], esi
pop esi
mov dword [esp], edx
push ecx
mov edx, dword [esp]
sub esp, 4
mov dword [esp], edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
push dword [esp]
pop edx
push edi
push esp
pop edi
add edi, 4
add edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
push ebx
push ebp
mov dword [esp], esp
add dword [esp], 4
pop ebx
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], esi
pop dword [0x4bcbdc]
jmp 0x5df894
add esp, 4
jmp 0x60f667
call fcn.00417f80
jmp 0x5df2e2
cmp word [esi], 0x5a4d
jmp 0x57284f
test eax, eax
jmp 0x572844

Function at 0x566737
Capabilities:
Parse pe header

Disassembly:
jecxz 0x566790
add byte [eax], al
xchg dword [esp], ebx
pop esp
mov dword [esp], edx
mov edx, 0x8627936
mov dword [esp + 4], edx
pop edx
mov dword [esp], eax
sub esp, 4
mov dword [esp], ebx
mov eax, dword [esp]
push ecx
Function at 0x10012e8e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10026510]
jne 0x10012e98
repz ret
jmp fcn.1001697c

Function at 0x10015380
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
cmp eax, 1
push edi
jne 0x100154aa
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0x94
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x100153b7
xor eax, eax
jmp 0x10015552
push esi
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
or eax, eax
push 0
jne 0x100153d2
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100153b0
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 4]
and edi, 0x7fff
mov dword [ebp + 0x10], eax
mov eax, dword [esi + 8]
mov dword [ebp - 4], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
cmp eax, 2
je 0x10015404
or edi, 0x8000
mov ecx, dword [ebp - 4]
mov dword [0x10027b4c], eax
mov eax, dword [ebp + 0x10]
push 1
mov edx, eax
shl edx, 8
add edx, ecx
mov dword [0x10027b54], edx
mov dword [0x10027b58], eax
mov dword [0x10027b5c], ecx
mov dword [0x10027b50], edi
call fcn.1001816f
pop ecx
test eax, eax
je 0x100153b0
call fcn.10016712
test eax, eax
jne 0x10015450
call fcn.100181c9
jmp 0x100153b0
call fcn.100198ff
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100283f8], eax
call fcn.100197ca
mov dword [0x100277ec], eax
call fcn.10019212
or eax, eax
jge 0x1001547a
call fcn.100163fc
jmp 0x10015446
call fcn.10019711
or eax, eax
jl 0x100154a3
call fcn.1001949e
or eax, eax
jl 0x100154a3
push 0
call fcn.10017cff
pop ecx
test eax, eax
jne 0x100154a3
inc dword [0x100277e8]
jmp 0x1001554f
call fcn.10019452
jmp 0x10015473
xor edi, edi
cmp eax, edi
jne 0x100154e5
cmp dword [0x100277e8], edi
jle 0x100153b0
dec dword [0x100277e8]
cmp dword [0x10027b88], edi
jne 0x100154cf
call fcn.10017e70
cmp dword [ebp + 0x10], edi
jne 0x1001554f
call fcn.10019452
call fcn.100163fc
call fcn.100181c9
jmp 0x1001554f
cmp eax, 2
jne 0x10015543
call fcn.100163d2
push 0x214
push 1
call fcn.10017aad
pop esi
pop ecx
mov ebx, eax
cmp ebx, edi
je 0x100153b0
push ebx
push dword [0x10026564]
push dword [0x10027804]
call fcn.10016366
pop ecx
call eax
or eax, eax
je 0x10015537
push edi
push ebx
call fcn.10016439
pop edi
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [ebx + 4], 0xffffffff
mov dword [ebx], eax
jmp 0x1001554f
push ebx
call fcn.10013945
pop ecx
jmp 0x100153b0
cmp eax, 3
jne 0x1001554f
push edi
call fcn.100166a9
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10016712
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x1001672d
call fcn.100163fc
pop esi
xor eax, eax
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlsAlloc
push esi
call edi
push str.FlsGetValue
push esi
mov dword [0x100277fc], eax
call edi
push str.FlsSetValue
push esi
mov dword [0x10027800], eax
call edi
push str.FlsFree
push esi
mov dword [0x10027804], eax
call edi
cmp dword [0x100277fc], 0
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x10027808], eax
je 0x1001678d
cmp dword [0x10027800], 0
je 0x1001678d
cmp dword [0x10027804], 0
je 0x1001678d
or eax, eax
jne 0x100167b1
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x10027800], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x100277fc], 0x100163c9
mov dword [0x10027804], edi
mov dword [0x10027808], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x10026568], eax
je 0x10016891
push dword [0x10027800]
push eax
call edi
test eax, eax
je 0x10016891
call fcn.10017e7f
push dword [0x100277fc]
call fcn.100162fa
push dword [0x10027800]
mov dword [0x100277fc], eax
call fcn.100162fa
push dword [0x10027804]
mov dword [0x10027800], eax
call fcn.100162fa
push dword [0x10027808]
mov dword [0x10027804], eax
call fcn.100162fa
add esp, 0x10
mov dword [0x10027808], eax
call fcn.1001823d
or eax, eax
je 0x1001688c
push fcn.10016588
push dword [0x100277fc]
call fcn.10016366
pop ecx
call eax
cmp eax, 0xffffffff
mov dword [0x10026564], eax
je 0x1001688c
push 0x214
push 1
call fcn.10017aad
mov esi, eax
pop ecx
pop ecx
or esi, esi
je 0x1001688c
push esi
push dword [0x10026564]
push dword [0x10027804]
call fcn.10016366
pop ecx
call eax
test eax, eax
je 0x1001688c
push 0
push esi
call fcn.10016439
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x10016893
call fcn.100163fc
xor eax, eax
pop edi
pop esi
ret
Function at 0x1001697c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcd8
mov dword [0x10027918], eax
mov dword [0x10027914], ecx
mov dword [0x10027910], edx
mov dword [0x1002790c], ebx
mov dword [0x10027908], esi
mov dword [0x10027904], edi
mov word [0x10027930], ss
mov word [0x10027924], cs
mov word [0x10027900], ds
mov word [0x100278fc], es
mov word [0x100278f8], fs
mov word [0x100278f4], gs
pushfd
pop dword [0x10027928]
mov eax, dword [ebp]
mov dword [0x1002791c], eax
mov eax, dword [ebp + 4]
mov dword [0x10027920], eax
lea eax, [ebp + 8]
mov dword [0x1002792c], eax
mov esi, dword [ebp - 0x320]
mov dword [0x10027868], 0x10001
mov eax, dword [0x10027920]
mov dword [0x1002781c], eax
mov dword [0x10027810], 0xc0000409
mov dword [0x10027814], 1
mov eax, dword [0x10026510]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10026514]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x10027860], eax
push 1
call fcn.1001a81f
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x10022eac
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x10027860], 0
jne 0x10016a6c
push 1
call fcn.1001a81f
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x10018f19
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
add esp, 0xfffffcd8
mov eax, dword [0x10026510]
xor eax, ebp
mov dword [ebp + 0x2a4], eax
push esi
mov dword [ebp + 0x88], eax
mov dword [ebp + 0x84], ecx
mov dword [ebp + 0x80], edx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x78], esi
mov dword [ebp + 0x74], edi
mov word [ebp + 0xa0], ss
mov word [ebp + 0x94], cs
mov word [ebp + 0x70], ds
mov word [ebp + 0x6c], es
mov word [ebp + 0x68], fs
mov word [ebp + 0x64], gs
pushfd
pop dword [ebp + 0x98]
mov esi, dword [ebp + 0x2ac]
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
mov dword [ebp - 0x28], 0x10001
mov dword [ebp + 0x90], esi
mov eax, dword [eax - 4]
push 0x50
mov dword [ebp + 0x8c], eax
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.10013430
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
sub esp, 0xfffffff4
mov dword [ebp - 0x80], 0xc000000d
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
or eax, eax
jne 0x10018fed
or esi, esi
jne 0x10018fed
push 2
call fcn.1001a81f
pop ecx
push 0xc000000d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
pop esi
xor ecx, ebp
call fcn.10012e8e
sub ebp, 0xfffffd58
leave
ret

Function at 0x10019015
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [0x10027cf4]
call fcn.10016366
pop ebp
or eax, eax
je 0x1001902b
pop ebx
jmp eax
push 2
call fcn.1001a81f
pop ecx
pop ebp
jmp fcn.10018f19
Function at 0x10019039
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
push edi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10026840]
je 0x10019054
inc edi
cmp edi, 0x17
jl 0x10019045
cmp edi, 0x17
jae 0x100191d4
push ebp
push 3
call fcn.1001b911
pop ecx
cmp eax, 1
je 0x100191a0
push 3
call fcn.1001b911
test eax, eax
pop ecx
jne 0x10019088
cmp dword [0x100277f8], 1
je 0x100191a0
cmp ebx, 0xfc
je 0x100191d3
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10027cf8
push ebp
call fcn.1001ab5f
add esp, 0xc
test eax, eax
je 0x100190be
push esi
push esi
push esi
push esi
push esi
call fcn.10018f19
sub esp, 0xffffffec
push 0x104
mov esi, 0x10027d11
push esi
push 0
mov byte [0x10027e15], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or eax, eax
jne 0x10019102
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1001ab5f
sub esp, 0xfffffff4
test eax, eax
je 0x10019102
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10018f19
sub esp, 0xffffffec
push esi
call fcn.100133a0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10019147
push esi
call fcn.100133a0
add esi, 0xffffffc5
add eax, esi
push 3
mov ecx, 0x1002800c
push 0x10023494
sub ecx, eax
push ecx
push eax
call fcn.1001b85e
sub esp, 0xffffffec
test eax, eax
je 0x10019147
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10018f19
sub esp, 0xffffffec
jmp 0x10019149
xor esi, esi
push 0x10023490
push ebx
push ebp
call fcn.1001b7ed
sub esp, 0xfffffff4
or eax, eax
je 0x10019169
push esi
push esi
push esi
push esi
push esi
call fcn.10018f19
add esp, 0x14
push dword [edi*8 + 0x10026844]
push ebx
push ebp
call fcn.1001b7ed
add esp, 0xc
or eax, eax
je 0x1001918b
push esi
push esi
push esi
push esi
push esi
call fcn.10018f19
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1001b64f
add esp, 0xc
jmp 0x100191d3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
cmp ebx, esi
je 0x100191d3
cmp ebx, 0xffffffff
je 0x100191d3
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10026844]
push dword [esi]
call fcn.100133a0
pop ecx
push eax
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret