joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004b097
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100e8ccd
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f00e8
mov dword [esi + 4], 0x100f00bc
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.100025df
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov dword [esi], 0x100f6c00
mov dword [esi + 4], 0x100f6bf0
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1004b12d
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x100e8cee
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [esi + 0x30]
mov dword [ebp - 4], 1
call fcn.100035f8
pop ecx
lea ecx, [esi + 0x24]
call fcn.1003f7dd
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.1004b20a
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.1004b1c4
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1004d80b
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
mov ecx, dword [esp + 8]
lea esi, [edx + ecx]
cmp edx, esi
je 0x1004d839
push edi
movzx edi, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, edi
mov edi, dword [esp + 0x10]
shr eax, 8
mov ecx, dword [edi + ecx*4]
xor eax, ecx
inc edx
cmp edx, esi
jne 0x1004d81a
pop edi
pop esi
ret 8
Function at 0x100521b3
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100e9379
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov byte [esi], al
mov byte [esi + 1], al
mov byte [esi + 2], al
mov byte [esi + 3], al
mov byte [esi + 4], al
mov byte [esi + 5], al
mov byte [esi + 6], al
mov byte [esi + 7], al
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10051f85
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10052c4a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e9492
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10001db8
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10001db8
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10001db8
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10001db8
or dword [esi + 0x7c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x64], bl
mov byte [esi + 0x65], bl
mov byte [esi + 0x66], bl
mov byte [esi + 0x67], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10054207
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e9636
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10001e14
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10001e14
mov eax, dword [esi + 0x18]
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.10001e14
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
mov byte [ebp - 4], 2
call fcn.10001e14
mov al, byte [esi + 0x64]
push 5
mov byte [ebx + 0x64], al
mov al, byte [esi + 0x65]
mov byte [ebx + 0x65], al
mov al, byte [esi + 0x66]
mov byte [ebx + 0x66], al
mov al, byte [esi + 0x67]
mov byte [ebx + 0x67], al
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x7c], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10059463
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e9bfb
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.100025df
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10062460
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x10062518
cmp word [ecx], 0x5a4d
jne 0x10062518
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x10062518
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x10062518
test al, 7
jne 0x10062518
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10062518
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x100624ee
sub ecx, 0x74
je 0x100624e7
dec ecx
dec ecx
je 0x100624e7
dec ecx
dec ecx
je 0x100624e0
sub ecx, 0x3c
je 0x100624d9
sub ecx, 0x8464
je 0x100624ee
sub ecx, 0x2400
jne 0x10062518
push 0xa
pop ecx
jmp 0x100624f3
mov ecx, 0x3030401
jmp 0x100624f3
mov ecx, 0x3030701
jmp 0x100624f3
mov ecx, 0x3030501
jmp 0x100624f3
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x10062518
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x1006250d
cmp eax, 0x20b
jne 0x10062518
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x1006251a
xor eax, eax
ret 4

Function at 0x10066c5e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ea6ac
call fcn.100e0f70
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10061b77
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.100a220c
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.100a220c
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.100a220c
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.100a220c
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.100a220c
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.100a220c
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.100a220c
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.100a220c
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10066e5a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ea70b
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10067048
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.100670fd
mov al, byte [edi + 0x18]
add edi, 0x34
mov byte [esi + 0x18], al
mov al, byte [edi - 0x1b]
mov byte [esi + 0x19], al
mov eax, dword [edi - 0x18]
mov dword [esi + 0x1c], eax
mov al, byte [edi - 0x14]
mov byte [esi + 0x20], al
mov al, byte [edi - 0x13]
mov byte [esi + 0x21], al
mov eax, dword [edi - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x2c], eax
mov al, byte [edi - 4]
mov byte [esi + 0x30], al
mov al, byte [edi - 3]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x31], al
call fcn.10002692
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x100677be
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x100677dd
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x100677cc
pop edi
cmp esi, 4
jb 0x100677e7
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x100677f8
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x10067804
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x1006780e
movzx ecx, byte [ecx]
xor eax, ecx
ret

Function at 0x10073d04
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [ecx + 0x3c]
cmp edx, 2
jge 0x10073d1d
cmp byte [ecx + 0x42], 0
mov eax, dword [esp + 4]
je 0x10073d82
cmp eax, 0x3f
jb 0x10073d82
jmp 0x10073d71
mov eax, dword [esp + 4]
cmp eax, 0x2c
jb 0x10073d82
cmp edx, 3
jl 0x10073d35
cmp eax, 0x2c
jne 0x10073d34
push 0x48
jmp 0x10073d81
dec eax
cmp edx, 4
jl 0x10073d44
cmp eax, 0x2c
jne 0x10073d43
push 0x49
jmp 0x10073d81
dec eax
cmp eax, 0x3a
jb 0x10073d82
cmp byte [ecx + 0x14], 0
je 0x10073d63
cmp eax, 0x3a
jne 0x10073d58
push 0x44
jmp 0x10073d81
cmp eax, 0x3b
jne 0x10073d61
push 0x45
jmp 0x10073d81
dec eax
dec eax
cmp eax, 0x3f
jb 0x10073d7a
cmp byte [ecx + 0x42], 0
je 0x10073d7a
cmp eax, 0x3f
jne 0x10073d77
push 0x46
jmp 0x10073d81
dec eax
jmp 0x10073d82
cmp eax, 0x44
jne 0x10073d82
push 0x47
pop eax
ret 4
Function at 0x1007546b
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100eb24f
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi + 0x24], 0xffffffff
lea ecx, [esi + 0x30]
mov byte [esi], bl
mov byte [esi + 1], 1
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ebx
call fcn.10001db8
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.100025df
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100755cb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100eb2e3
call fcn.100e0f70
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10001db8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.100025df
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.1007566c
lea eax, [esi + 0xb8]
mov dword [eax], edi
mov dword [eax + 4], edi
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 6
call fcn.10001db8
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 7
call fcn.10001db8
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea eax, [esi + 0xfc]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10079006
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100eb73f
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x38]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ax, word [edi + 0x30]
mov word [esi + 0x30], ax
mov al, byte [edi + 0x32]
mov byte [esi + 0x32], al
mov al, byte [edi + 0x33]
mov byte [esi + 0x33], al
mov al, byte [edi + 0x34]
mov byte [esi + 0x34], al
mov al, byte [edi + 0x35]
mov byte [esi + 0x35], al
mov al, byte [edi + 0x36]
mov byte [esi + 0x36], al
lea eax, [edi + 0x38]
push eax
call fcn.10001e14
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
push eax
lea ecx, [esi + 0x44]
call fcn.10002692
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov ax, word [edi + 0x64]
mov word [esi + 0x64], ax
mov ax, word [edi + 0x66]
mov word [esi + 0x66], ax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1007d82b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100ebb12
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f00e8
mov dword [esi + 4], 0x100f00cc
mov dword [esi + 8], 0x100f7db4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
call fcn.100025df
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 5
call fcn.10057010
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100f91e4
mov dword [esi + 4], 0x100f91c8
mov dword [esi + 8], 0x100f91b8
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1007dc8e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ebbc3
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov al, byte [edi + 8]
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.10001e14
mov eax, dword [edi + 0x1c]
and dword [ebp - 4], 0
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
lea eax, [edi + 0x34]
push eax
lea ecx, [esi + 0x34]
call fcn.1001449e
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100801a5
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100ebe44
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0x30]
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov al, byte [esi + 0x18]
mov byte [ebx + 0x18], al
mov al, byte [esi + 0x19]
mov byte [ebx + 0x19], al
mov al, byte [esi + 0x1a]
mov byte [ebx + 0x1a], al
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
lea eax, [esi + 0x30]
push eax
call fcn.10001e14
and dword [ebp - 4], 0
lea eax, [esi + 0x3c]
push eax
lea ecx, [ebx + 0x3c]
call fcn.10001e14
lea eax, [esi + 0x48]
lea ecx, [ebx + 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.10001e14
lea eax, [esi + 0x54]
lea ecx, [ebx + 0x54]
push eax
mov byte [ebp - 4], 2
call fcn.10001e14
mov eax, dword [esi + 0x60]
push 0xc
mov dword [ebx + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [ebx + 0x64], eax
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
add eax, 0x98
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x98]
mov byte [ebp - 4], 3
call fcn.1008028b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100861d0
Capabilities:
Encode data using xor

Disassembly:
add edx, ecx
xor eax, eax
push esi
cmp ecx, edx
mov esi, ecx
je 0x100861fe
push ebx
push edi
movzx edi, byte [esi]
xor ecx, ecx
xor ebx, ebx
mov cl, ah
mov bh, al
xor ecx, edi
movzx eax, bx
movzx ecx, word [ecx*2 + 0x1010fd58]
xor eax, ecx
inc esi
cmp esi, edx
jne 0x100861dd
pop edi
pop ebx
pop esi
ret

Function at 0x1008f927
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100ec987
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi], 0xffffffff
or dword [esi + 4], 0xffffffff
mov dword [esi + 8], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x38]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
call fcn.100025df
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.100025df
or dword [esi + 0x54], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], ebx
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1008f933
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100ec987
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi], 0xffffffff
or dword [esi + 4], 0xffffffff
mov dword [esi + 8], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x38]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
call fcn.100025df
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.100025df
or dword [esi + 0x54], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], ebx
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret