joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19de090
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, edx
mov dword [ebp - 4], ecx
push esi
mov dword [ecx + 0xb4], ebx
push edi
cmp dword [ebx], 0
jne 0x19de17c
lea eax, [ecx + 0xc0]
mov esi, dword [eax + 4]
mov dword [ebp - 8], esi
cmp eax, esi
je 0x19de158
cmp dword [ecx + 0x4c], 0
lea edi, [esi - 8]
je 0x19de0e2
mov eax, dword [ecx + 0x50]
xor dword [edi], eax
mov al, byte [edi + 2]
xor al, byte [edi + 1]
xor al, byte [edi]
cmp byte [edi + 3], al
jne 0x1a3dba8
movzx edx, word [edi]
mov eax, ebx
cmp edx, dword [ebx + 4]
mov dword [ebp - 0x10], eax
jb 0x19de177
mov esi, dword [eax]
test esi, esi
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 8]
jne 0x19de1b3
mov eax, dword [eax + 4]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebx], 0
jne 0x19de15f
movzx eax, word [edi]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
push eax
push dword [ebp - 0xc]
push esi
push 1
call fcn.019de8ff
cmp dword [0x1ac84ac], 1
jge 0x1a3dbb8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x19de14a
mov al, byte [edi + 2]
xor al, byte [edi + 1]
xor al, byte [edi]
mov byte [edi + 3], al
mov eax, dword [ecx + 0x50]
xor dword [edi], eax
mov esi, dword [esi + 4]
lea eax, [ecx + 0xc0]
jmp 0x19de0b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 4]
cmp edx, eax
dec eax
jae 0x19de169
mov eax, edx
push edx
push eax
push esi
push 1
mov edx, ebx
call fcn.019e0895
jmp 0x19de10f
mov dword [ebp - 0xc], edx
jmp 0x19de10a
mov ecx, dword [ebx + 4]
sub ecx, dword [ebx + 0x14]
dec ecx
cmp dword [ebx + 8], 0
jne 0x19de1be
mov eax, dword [ebx + 0x20]
and dword [eax + ecx*4], 0
mov esi, dword [ebx + 4]
sub esi, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x1c]
dec esi
mov edx, esi
and esi, 0x1f
shr edx, 5
mov eax, dword [ecx + edx*4]
btr eax, esi
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp - 4]
jmp 0x19de0af
mov eax, dword [ebp - 0xc]
cmp edx, dword [eax + 4]
jmp 0x19de0ea
add ecx, ecx
jmp 0x19de189
push ecx
mov edx, edi
call fcn.01a915a8
mov ecx, dword [ebp - 4]
jmp 0x19de0e2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x1c]
mov esi, ecx
xor eax, eax
shr esi, 5
and ecx, 0x1f
inc eax
shl eax, cl
test dword [edx + esi*4], eax
jne 0x1a3dc1d
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a3dbff
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a3dc09
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push 0x19ced80
call fcn.019dafb0
pop ecx
xor ecx, ecx
inc ecx
call fcn.01a36019
mov esi, dword [ebp - 8]
jmp 0x19de131
Function at 0x19df090
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ecx
cmp dword [0x1ac84ac], 1
push esi
push edi
mov esi, edx
mov edi, ecx
jge 0x19df0ec
mov edx, dword [edi + 0xb8]
test edx, edx
jne 0x19df0c7
lea ecx, [edi + 0x8c]
mov eax, dword [ecx]
cmp ecx, eax
jne 0x19df0be
mov eax, ecx
pop edi
pop esi
pop ecx
ret
cmp dword [eax + 0x14], esi
jae 0x19df0ba
mov eax, dword [eax]
jmp 0x19df0b4
mov eax, esi
shr eax, 0xc
cmp eax, dword [edx + 4]
jb 0x19df0df
mov ecx, dword [edx]
test ecx, ecx
jne 0x1a3e5b5
mov eax, dword [edx + 4]
dec eax
push esi
push eax
push 0
mov ecx, edi
call fcn.019df9e0
jmp 0x19df0ba
lea eax, [esi + 0xfff]
and eax, 0xfffff000
cmp eax, esi
je 0x19df0a2
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x19df13b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
pop ecx
push 0x19b4dc4
call fcn.019dafb0
pop ecx
xor ecx, ecx
inc ecx
call fcn.01a36019
jmp 0x19df0a2
push 0x19b4dbc
call fcn.019dafb0
jmp 0x19df122
mov edx, ecx
jmp 0x19df0cc
Function at 0x19e03e0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1acd344]
xor eax, esp
mov dword [esp + 0x30], eax
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, 0xe0000000
jne 0x19e0414
mov edx, 0x11000000
mov eax, ecx
and eax, edx
cmp eax, edx
jne 0x19e042d
mov eax, 0xc00000f1
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0xc]
test edi, 0xff000000
jne 0x1a3783f
test ecx, 0x4000000
jne 0x19e04bf
mov eax, dword fs:[0x30]
xor edx, edx
or dword [esi + 4], 0xffffffff
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
cmp dword [eax + 0x64], 1
jbe 0x1a37849
test ecx, 0x2000000
jne 0x19e04c6
test edi, edi
je 0x19e04c6
and edi, 0xffffff
mov dword [esi + 0x14], edi
mov eax, ecx
and eax, 0x9000000
or dword [esi + 0x14], eax
test ecx, 0x10000000
jne 0x19e04cf
cmp byte [0x1ac67c0], dl
jne 0x19e04cf
or dword [esi], 0xffffffff
test dl, dl
jne 0x19e04d3
mov eax, dword fs:[0x30]
mov edi, 0x7ffe0382
mov ebx, 0x228
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x1a3785d
mov eax, edi
cmp byte [eax], 0
jne 0x1a37876
xor eax, eax
jmp 0x19e0419
mov dword [esi + 0x14], 0x20007d0
jmp 0x19e0478
mov dl, 1
jmp 0x19e0492
mov ecx, esi
call fcn.019e04e4
cmp dword [esi], 0xffffffff
jne 0x19e0499
jmp 0x1a37851
mov eax, 0xc00000f0
jmp 0x19e0419
mov dword [esi + 0x14], edx
jmp 0x19e0478
or dword [esi + 0x14], 0x1000000
jmp 0x19e0499
cmp dword [eax], 0
je 0x19e04b4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, ebx
jmp 0x19e04b6
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 2
je 0x19e04bf
mov eax, 0x1723
mov dword [esp + 0x34], esi
mov word [esp + 0x16], ax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x30], eax
call fcn.019f1a00
test eax, eax
je 0x1a378b2
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, ebx
lea eax, [esp + 0x10]
push eax
movzx eax, byte [edi]
push 8
push 0x10402
push eax
call fcn.01a22f40
jmp 0x19e04bf

Function at 0x19e09f7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, edx
xor edx, edx
push 0xc
lea eax, [esi + 4]
mov dword [esi], edx
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [esi + 0x48]
mov dword [esi + 0xc], ecx
pop ecx
mov dword [eax - 4], edx
mov dword [eax], 6
lea eax, [eax + 0x20]
sub ecx, 1
jne 0x19e0a14
lea ecx, [esi + 0x1bf]
mov ax, word [edx*2 + 0x19bb330]
shr ax, 3
inc ax
mov byte [ecx - 1], dl
mov word [ecx - 3], ax
mov al, byte [0x1ac6688]
add al, al
xor al, byte [ecx]
and al, 6
xor byte [ecx], al
inc edx
lea ecx, [ecx + 4]
cmp edx, 0x81
jb 0x19e0a2b
test byte [ebp + 8], 1
jne 0x19e0a7d
mov eax, dword [0x1ac6100]
test eax, eax
je 0x19e0a78
lea ecx, [esi + 0x7dc]
mov dword [ecx], esi
lea ecx, [ecx + 0x18]
sub eax, 1
jne 0x19e0a6e
pop esi
pop ebp
ret 4
xor eax, eax
inc eax
jmp 0x19e0a68
Function at 0x19e0b70
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
push edi
mov edi, dword fs:[0x30]
mov eax, dword [edi + 0xa4]
mov dword [esi + 4], eax
mov eax, dword [edi + 0xa8]
mov dword [esi + 8], eax
movzx eax, word [edi + 0xac]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0xb0]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x1f4]
test eax, eax
je 0x19e0bbe
cmp word [eax], cx
jne 0x1a3f0da
xor eax, eax
mov word [esi + 0x14], ax
cmp dword [esi], 0x11c
mov ebx, 0x124
jne 0x19e0c42
movzx eax, byte [edi + 0xaf]
mov ecx, 0xff
mov word [esi + 0x114], ax
mov ax, word [edi + 0xae]
and ax, cx
mov word [esi + 0x116], ax
call fcn.019e1270
mov word [esi + 0x118], ax
cmp dword [esi], ebx
je 0x19e0c48
lea eax, [ebp - 4]
mov byte [esi + 0x11a], 0
push eax
call fcn.019e1230
test al, al
je 0x19e0c37
mov eax, dword [ebp - 4]
mov byte [esi + 0x11a], al
cmp eax, 1
jne 0x19e0c37
mov eax, 0xffef
and word [esi + 0x118], ax
cmp dword [esi], ebx
je 0x19e0c5a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi], ebx
jne 0x19e0c37
jmp 0x19e0bd1
call fcn.019e1270
and eax, 0x1ffff
mov dword [esi + 0x11c], eax
jmp 0x19e0c05
and dword [esi + 0x11c], 0x1ffef
jmp 0x19e0c37
push eax
mov edx, 0x100
lea ecx, [esi + 0x14]
call fcn.019e5c4e
test eax, eax
jns 0x19e0bc4
jmp 0x19e0bbe
Function at 0x19e10a4
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
mov ecx, dword fs:[0x30]
mov ebx, dword [0x1ac84a8]
mov dword [ebp - 8], ecx
push edi
mov eax, dword [ecx + 0xa4]
mov edi, edx
mov dword [esi + 4], eax
mov eax, dword [ecx + 0xa8]
mov dword [esi + 8], eax
movzx eax, word [ecx + 0xac]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0xb0]
mov dword [esi + 0x10], eax
test ebx, ebx
je 0x19e11fb
cmp ebx, 0x19e0690
jne 0x19e11d2
call fcn.019e1290
mov edi, eax
sub edi, 1
je 0x19e11e1
sub edi, 1
je 0x1a3f211
mov edi, dword [ebp - 8]
mov eax, dword [edi + 0x1f4]
test eax, eax
je 0x19e1139
xor ecx, ecx
cmp word [eax], cx
jne 0x1a3f224
xor eax, eax
mov word [esi + 0x14], ax
cmp dword [esi], 0x11c
mov ebx, 0x124
jne 0x1a3f23f
movzx eax, byte [edi + 0xaf]
mov ecx, 0xff
mov word [esi + 0x114], ax
mov ax, word [edi + 0xae]
and ax, cx
mov word [esi + 0x116], ax
call fcn.019e1270
mov word [esi + 0x118], ax
cmp dword [esi], ebx
je 0x1a3f24c
xor eax, eax
mov byte [esi + 0x11a], al
lea eax, [ebp - 0xc]
push eax
call fcn.019e1230
test al, al
je 0x19e11bf
mov eax, dword [ebp - 0xc]
mov byte [esi + 0x11a], al
cmp eax, 1
jne 0x19e11bf
mov eax, 0xffef
and word [esi + 0x118], ax
cmp dword [esi], ebx
je 0x1a3f261
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call dword [0x1ac91d0]
call ebx
jmp 0x19e110d
mov dword [esi + 8], 2
mov dword [esi + 0xc], 0x23f0
mov dword [esi + 4], 6
jmp 0x19e1121
push edx
push 0x19b1204
push edx
push 0xabababab
call fcn.01a099e0
mov ebx, eax
mov dword [0x1ac84a8], ebx
test ebx, ebx
jne 0x19e10fc
jmp 0x19e110f
mov dword [esi + 8], 3
mov dword [esi + 0xc], 0x2580
jmp 0x19e11ef
push eax
mov edx, 0x100
lea ecx, [esi + 0x14]
call fcn.019e5c4e
test eax, eax
jns 0x19e113f
jmp 0x19e1139
cmp dword [esi], ebx
jne 0x19e11bf
jmp 0x19e1150
call fcn.019e1270
and eax, 0x1ffff
mov dword [esi + 0x11c], eax
jmp 0x19e1188
and dword [esi + 0x11c], 0x1ffef
jmp 0x19e11bf

Function at 0x19e1620
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x19e1678
cmp dword [ebp + 0xc], 0
jl 0x19e1678
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19e1678
push 4
lea eax, [ebp + 0xc]
push eax
push 5
push dword [esi + 0x24]
call fcn.01a24280
call fcn.019f1a00
test eax, eax
jne 0x1a3f335
mov eax, 0x7ffe0386
cmp byte [eax], 0
jne 0x1a3f348
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.01aa5c15
jmp 0x19e1671
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22c
jmp 0x19e1668
mov edx, dword [ebp + 0xc]
mov ecx, esi
call fcn.01aa5f30
jmp 0x19e1671
Function at 0x19e1690
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x19e16cf
cmp dword [ebp + 0x10], 0
jl 0x19e16ab
jg 0x19e16cf
cmp dword [ebp + 0xc], 0
jae 0x19e16cf
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19e16cf
push 8
lea eax, [ebp + 0xc]
push eax
push 2
push dword [ecx + 0x24]
call fcn.01a24280
pop ecx
pop ebp
ret 0xc
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x19e16ca

Function at 0x19e16e0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x19e170c
cmp dword [ebp + 0xc], 0
jne 0x19e170c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19e170c
xor edx, edx
call fcn.019e1718
pop ebp
ret 8
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x19e1708
Function at 0x19e2090
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x2c], esi
cmp dword [esi + 8], 0xddeeddee
je 0x1a3fa3f
test dword [esi + 0x44], 0x1000000
jne 0x1a3fa4d
cmp dword [esi + 0x60], 0xeeffeeff
jne 0x1a3fa63
test byte [esi + 0x40], 1
jne 0x19e210c
mov edi, dword [esi + 0xc8]
mov eax, 0xffff
add word [esi + 0xd8], ax
sub dword [edi + 8], 1
jne 0x19e210c
and dword [edi + 0xc], 0
lea edx, [edi + 4]
push 0xfffffffffffffffe
or ecx, 0xffffffff
pop eax
lock cmpxchg dword [edx], ecx
mov ebx, eax
cmp ebx, 0xfffffffe
jne 0x1a3fae0
mov eax, dword fs:[0x30]
mov edi, 0x7ffe0380
mov ebx, 0x226
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x1a3fb1e
mov eax, edi
cmp byte [eax], 0
jne 0x1a3fb37
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 4
xor edx, edx
mov ecx, esi
call fcn.01a944e6
jmp 0x19e210c
push esi
mov esi, dword [0x1ac530c]
mov ecx, esi
call dword [0x1ac91d0]
call esi
jmp 0x19e2134
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a3fa8c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a3fa96
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push esi
push 0x19b75e0
call fcn.019dafb0
push 0x19b75d0
push 0x19b7608
call fcn.019dafb0
push 0x19b7618
call fcn.019dafb0
mov eax, dword fs:[0x30]
add esp, 0x14
cmp byte [eax + 2], 0
je 0x1a3fad9
mov byte [0x1ac6255], 1
int3
xor al, al
jmp 0x19e2134
test byte [edx], 1
je 0x1a3faeb
push edi
call fcn.01a73e80
lea esi, [edi + 4]
mov edx, ebx
mov eax, ebx
and edx, 2
or edx, 1
lea ecx, [edx + ebx]
lock cmpxchg dword [esi], ecx
cmp eax, ebx
je 0x1a3fb07
mov ebx, eax
jmp 0x1a3faee
mov esi, dword [ebp - 0x2c]
test dl, 2
je 0x19e210c
push edi
call fcn.019dc520
jmp 0x19e210c
cmp dword [eax], 0
je 0x19e2127
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, ebx
jmp 0x19e2129
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 1
je 0x19e2132
mov eax, 0x102c
mov dword [ebp - 8], esi
mov word [ebp - 0x22], ax
call fcn.019f1a00
test eax, eax
je 0x1a3fb6a
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, ebx
lea ecx, [ebp - 0x28]
push ecx
movzx ecx, byte [edi]
push 4
push 0x402
push ecx
call fcn.01a22f40
jmp 0x19e2132
Function at 0x19e2150
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 8], 0xddeeddee
je 0x1a3fb83
test dword [esi + 0x44], 0x1000000
jne 0x1a3fb8f
cmp dword [esi + 0x60], 0xeeffeeff
jne 0x1a3fba5
test byte [esi + 0x40], 1
jne 0x19e21c0
mov ecx, dword [esi + 0xc8]
mov edx, dword fs:[0x18]
lea eax, [ecx + 4]
lock btr dword [eax], 0
jae 0x19e21fb
mov eax, dword [edx + 0x24]
mov dword [ecx + 0xc], eax
mov dword [ecx + 8], 1
inc word [esi + 0xd8]
mov eax, dword fs:[0x30]
mov edi, 0x7ffe0380
mov ebx, 0x226
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x1a3fc22
mov eax, edi
cmp byte [eax], 0
jne 0x1a3fc3b
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ecx + 0xc]
cmp eax, dword [edx + 0x24]
je 0x19e220a
call fcn.019fbea0
jmp 0x19e21b9
inc dword [ecx + 8]
jmp 0x19e21b9
mov ecx, esi
call fcn.01a9446e
jmp 0x19e21c0
push esi
mov esi, dword [0x1ac5308]
mov ecx, esi
call dword [0x1ac91d0]
call esi
jmp 0x19e21e8
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a3fbce
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a3fbd8
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push esi
push 0x19b75e0
call fcn.019dafb0
push 0x19b75c4
push 0x19b7608
call fcn.019dafb0
push 0x19b7618
call fcn.019dafb0
mov eax, dword fs:[0x30]
add esp, 0x14
cmp byte [eax + 2], 0
je 0x1a3fc1b
mov byte [0x1ac6255], 1
int3
xor al, al
jmp 0x19e21e8
cmp dword [eax], 0
je 0x19e21db
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, ebx
jmp 0x19e21dd
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 1
je 0x19e21e6
mov eax, 0x102b
mov dword [ebp - 8], esi
mov word [ebp - 0x22], ax
call fcn.019f1a00
test eax, eax
je 0x1a3fc6e
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, ebx
lea ecx, [ebp - 0x28]
push ecx
movzx ecx, byte [edi]
push 4
push 0x402
push ecx
call fcn.01a22f40
jmp 0x19e21e6
Function at 0x19e642d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1a41c3d
cmp dword [edi + 0x24], 0
jne 0x1a41c3d
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x1a41c2b
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
test eax, eax
je 0x1a41c42
cmp dword [0x1ac86dc], eax
je 0x1a41c33
or ecx, 0xffffffff
lock xadd dword [eax + 0xf8], ecx
dec ecx
mov dword [ebp - 0x18], ecx
xor ecx, ecx
inc ecx
lock xadd dword [eax + 0xfc], ecx
inc ecx
add eax, 8
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov edx, eax
mov esi, ecx
lea eax, [ecx + 1]
mov dword [ebp - 0xc], edx
xor eax, ecx
movzx ebx, ax
mov eax, esi
xor ebx, ecx
mov ecx, dword [ebp - 4]
lock cmpxchg8b qword [edi]
mov ecx, eax
mov eax, edx
mov dword [ebp - 4], eax
cmp ecx, esi
jne 0x19e64a6
cmp eax, dword [ebp - 0xc]
jne 0x19e64a6
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
or dword [edi + 0x50], 0x10
mov ecx, dword [edi + 0x4c]
mov dword [edi + 0x24], eax
test ecx, ecx
je 0x19e64e9
call fcn.019e65d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x48]
jmp 0x19e6460
mov eax, 0xc00000bb
jmp 0x19e6503
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x19e6503
Function at 0x19e8b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0x14
push 0x1aaf4e0
call fcn.01a3611c
mov dword [ebp - 0x1c], 0xc0000001
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], bl
jne 0x19e8c9a
cmp dword [ebp + 8], ebx
je 0x1a42941
test esi, esi
je 0x1a4294b
mov dword [ebp - 4], ebx
xor edx, edx
lea ecx, [ebp - 0x20]
call fcn.019e8f34
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
js 0x19e8ca3
mov eax, dword [esi + 0x1c]
add eax, 4
push eax
call fcn.019f6460
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp dword [ecx + 4], esi
jne 0x19e8c9e
cmp dword [eax], esi
jne 0x19e8c9e
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov dword [ebp - 4], ebx
call fcn.019e8c84
lea eax, [esi + 0x18]
mov dword [ebp - 0x24], eax
lock or dword [eax], edi
push ebx
push ebx
push ebx
push dword [esi + 0x20]
call fcn.019fc5e0
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
jne 0x19e8c7b
push edi
push dword [esi + 0x20]
call fcn.019fc3c0
push dword [esi + 0x20]
call fcn.01a025d0
mov edi, eax
push dword [esi + 0x20]
call fcn.019fc2c0
push 0xfffffffffffffffe
pop ecx
mov esi, dword [ebp - 0x24]
mov eax, dword [esi]
mov edx, eax
and edx, ecx
lock cmpxchg dword [esi], edx
jne 0x19e8c3f
test al, 2
mov esi, dword [ebp + 0xc]
je 0x19e8c5c
mov ecx, esi
call fcn.019e8b24
mov edi, ebx
push 0xfffffffffffffffe
pop ecx
neg edi
sbb edi, edi
and edi, 0x103
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ecx
call fcn.019e8c91
mov eax, edi
call fcn.01a36161
ret 0xc
test eax, eax
je 0x19e8c25
mov dword [esi + 0x24], eax
jmp 0x19e8c25
xor eax, eax
jmp 0x19e8c73
push 3
pop ecx
int 0x29
push 0xfffffffffffffffe
pop ecx
jmp 0x19e8c69
mov eax, 0xc00000ef
jmp 0x19e8c73
mov eax, 0xc00000f0
jmp 0x19e8c73
Function at 0x19ece10
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x1a37aa6
mov eax, 0x7ffe0030
ret
cmp dword [eax], 0
je 0x19ece21
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x1e
ret

Function at 0x19edfaf
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
lea eax, [esp + 4]
push ebx
push esi
push edi
push eax
lea eax, [esp + 0x18]
mov ebx, edx
push eax
mov esi, ecx
call fcn.01a15877
xor edx, edx
mov ecx, esi
inc edx
call fcn.019df147
push eax
push 0x1000
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
call fcn.01a22ac0
mov edi, eax
test edi, edi
js 0x19ee0dc
call fcn.019f1a00
mov edi, 0x7ffe0380
test eax, eax
jne 0x1a37db5
mov eax, edi
cmp byte [eax], 0
jne 0x19ee074
mov eax, dword [esp + 0x10]
dec dword [esi + 0x230]
sub dword [esi + 0x234], eax
call fcn.019f1a00
test eax, eax
jne 0x1a37dc8
mov eax, edi
cmp byte [eax], 0
jne 0x19ee096
call fcn.019f1a00
mov edi, 0x7ffe038a
test eax, eax
jne 0x19ee12c
mov eax, edi
cmp byte [eax], 0
jne 0x19ee13f
inc dword [esi + 0x20c]
test byte [ebx + 2], 4
jne 0x19ee176
and byte [ebx + 2], 0x17
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 1
je 0x19ee016
mov edx, dword [esp + 0x14]
mov ecx, esi
push 8
push dword [esp + 0x14]
call fcn.01a92d69
jmp 0x19ee016
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 1
je 0x19ee03a
call fcn.019f1a00
test eax, eax
je 0x19ee0bd
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, 0x226
movzx eax, byte [edi]
mov ecx, esi
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x74]
shl eax, 3
push eax
push dword [esp + 0x18]
call fcn.01a92f61
jmp 0x19ee03a
mov eax, dword fs:[0x30]
inc dword [esi + 0x218]
cmp dword [eax + 0xc], 0
je 0x19ee18d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
pop ecx
push dword [esp + 0x10]
push dword [esp + 0x18]
push esi
push edi
push 0x19b4e40
call fcn.019dafb0
add esp, 0x14
xor al, al
jmp 0x19ee06d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x230
jmp 0x19ee04e
call fcn.019f1a00
test eax, eax
je 0x19ee157
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, 0x230
movzx eax, byte [edi]
mov ecx, esi
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x74]
shl eax, 3
push eax
push dword [esp + 0x18]
call fcn.01a92f61
jmp 0x19ee057
push 0xfeeefeee
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.01a36650
jmp 0x19ee067
push 0x19b4dbc
call fcn.019dafb0
jmp 0x19ee10d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x226
jmp 0x19ee011
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x226
jmp 0x19ee035