joyce8/EMBER2024-capa huggingface dataset:
Function at 0x552ad9
Capabilities:
Hash data using djb2

Disassembly:
push 0x50
mov eax, 0x494d93
call fcn.0047ec24
mov dword [ebp - 0x38], edx
mov esi, ecx
mov dword [ebp - 0x54], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
call fcn.00552c8b
mov edi, eax
test edi, edi
js 0x552c60
mov eax, dword [0x5a523c]
xor ebx, ebx
mov word [ebp - 0x48], bx
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.0055581b
mov edi, eax
test edi, edi
js 0x552c58
mov eax, dword [ebp - 0x40]
xor edi, edi
and dword [ebp - 0x38], 2
inc edi
mov dword [eax], ebx
lea eax, [ebp - 0x34]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x552b4b
mov ebx, 0x80004005
jmp 0x552c7f
mov eax, dword [ebp - 0x14]
mov edx, esi
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
movzx ecx, word [esi]
mov eax, 0x1505
jmp 0x552b6e
imul eax, eax, 0x21
lea edx, [edx + 2]
xor eax, ecx
movzx ecx, word [edx]
test ecx, ecx
jne 0x552b63
push 0x2f
xor edx, edx
pop ecx
div ecx
mov eax, edx
mov dword [ebp - 0x5c], eax
mov esi, dword [eax*4 + 0x5a5180]
test esi, esi
je 0x552bdc
mov eax, dword [esi + 0x68]
and eax, 2
cmp eax, dword [ebp - 0x38]
jne 0x552bdc
mov eax, dword [esi + 0x38]
mov ecx, dword [ebp - 0x4c]
cmp dword [eax + 0x10c8], ecx
jne 0x552bdc
mov ecx, dword [ebp - 0x50]
cmp dword [eax + 0x10cc], ecx
jne 0x552bdc
mov edx, dword [eax + 0x10c4]
test edx, edx
jne 0x552bbc
mov edx, 0x401c80
push ebx
push ecx
push ecx
mov ecx, dword [ebp - 0x54]
push ebx
call fcn.00551328
test eax, eax
jne 0x552bdc
mov eax, dword [ebp - 0x40]
push esi
mov dword [eax], esi
mov eax, dword [esi]
call dword [eax + 4]
jmp 0x552c7f
mov edx, dword [0x5a4f64]
mov ecx, ebx
mov dword [ebp - 0x3c], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x58], eax
test eax, eax
jle 0x552c58
mov eax, dword [edx]
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x68]
test al, 0x10
je 0x552c4f
and eax, 2
cmp eax, dword [ebp - 0x38]
jne 0x552c4f
mov eax, dword [esi + 0x38]
mov ecx, dword [ebp - 0x4c]
cmp dword [eax + 0x10c8], ecx
mov ecx, dword [ebp - 0x3c]
jne 0x552c4f
mov edx, dword [ebp - 0x50]
cmp dword [eax + 0x10cc], edx
mov edx, dword [0x5a4f64]
jne 0x552c4f
mov edx, dword [eax + 0x10c4]
test edx, edx
jne 0x552c36
mov edx, 0x401c80
push ebx
push ecx
push ecx
mov ecx, dword [ebp - 0x54]
push ebx
call fcn.00551328
test eax, eax
je 0x552c6a
mov edx, dword [0x5a4f64]
mov ecx, dword [ebp - 0x3c]
inc ecx
mov dword [ebp - 0x3c], ecx
cmp ecx, dword [ebp - 0x58]
jl 0x552bf1
lea ecx, [ebp - 0x48]
call fcn.00554e99
mov eax, edi
call fcn.0047ebd3
ret 4
mov eax, dword [ebp - 0x40]
push esi
mov dword [eax], esi
mov ecx, dword [esi]
call dword [ecx + 4]
mov eax, dword [ebp - 0x5c]
mov dword [eax*4 + 0x5a5180], esi
lea ecx, [ebp - 0x48]
call fcn.00554e99
mov eax, ebx
jmp 0x552c62
Function at 0x5532dc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494e84
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
mov eax, dword [0x5a1014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x50]
lea ecx, [ebp - 0x14]
xor ebx, ebx
mov dword [esi], 0x42d034
mov dword [esi + 4], 0x42ce64
mov dword [esi + 8], 0x42cea8
mov dword [esi + 0xc], 0x42cff8
mov dword [esi + 0x10], 0x42cf08
mov dword [esi + 0x14], 0x42ce30
mov dword [esi + 0x18], 0x42ce18
mov dword [esi + 0x1c], 0x42d158
mov dword [esi + 0x20], 0x42d17c
mov dword [esi + 0x24], 0x42d1b8
mov dword [esi + 0x28], 0x42d008
mov dword [esi + 0x2c], 0x42d1c8
mov dword [esi + 0x30], 0x42d190
mov dword [esi + 0x34], 0x42d1a0
mov word [ebp - 0x14], bx
mov dword [ebp - 0x10], eax
call fcn.00555837
test eax, eax
js 0x5533a8
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x553394
mov eax, dword [ecx]
push ebx
push ecx
call dword [eax + 0x16c]
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x54], bl
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x5533a8
cmp byte [ebp - 0x13], bl
je 0x5533a8
call fcn.0055627e
mov byte [ebp - 0x13], bl
mov ecx, dword [esi + 0xa0]
test ecx, ecx
je 0x5533be
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0xa0], ebx
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x5533d0
cmp byte [esi + 0x54], bl
je 0x5533d0
push ecx
call fcn.00552a25
mov ecx, esi
call fcn.00553c19
mov ecx, dword [esi + 0xec]
test ecx, ecx
je 0x5533e7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp byte [esi + 0x62], bl
je 0x5533f5
mov eax, dword [esi + 0x64]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [esi + 0x48], ebx
je 0x553406
push 8
push dword [esi + 0x48]
call fcn.0047a41d
pop ecx
pop ecx
mov eax, dword [esi + 0xcc]
test eax, eax
je 0x553418
push eax
call dword [sym.imp.tbbmalloc.dll_scalable_free]
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00554e99
lea ecx, [esi + 0xf0]
call fcn.005532b6
lea ecx, [esi + 0x70]
call fcn.0056e2c1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x554b21
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x5a1014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x554b40
sub esi, ecx
xor eax, eax
sar esi, 1
test edx, edx
sete al
lea eax, [eax*8 + 0x37]
cmp esi, eax
ja 0x554bf0
test edx, edx
je 0x554b8d
mov ecx, edi
call fcn.00554b04
test eax, eax
je 0x554bf0
push 0x42d1fc
lea eax, [ebp - 0x84]
push 0x40
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x554b96
xor eax, eax
mov word [ebp - 0x84], ax
push edi
lea eax, [ebp - 0x84]
push 0x40
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x84]
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
call ebx
mov edi, eax
test edi, edi
je 0x554bf0
push 0x405920
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047d69a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x554bec
push edi
push esi
lea eax, [ebp - 0x84]
push eax
call ebx
mov eax, esi
jmp 0x554bf2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047a40f
leave
ret
Function at 0x554c01
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], esi
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
test byte [ebp + 0x14], 1
mov dword [ebp - 0x10], 4
je 0x554c88
mov edx, dword [ebp + 0x18]
call fcn.00554b21
mov edi, eax
test edi, edi
je 0x554c88
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call esi
push 0x10
and dword [eax], 0
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
mov dword [ebp - 0x18], eax
call esi
cmp dword [eax], 0x22
je 0x554c67
cmp dword [ebp - 0x14], edi
je 0x554c67
xor esi, esi
inc esi
jmp 0x554c69
xor esi, esi
push edi
call dword [sym.imp.tbbmalloc.dll_scalable_free]
pop ecx
test esi, esi
je 0x554c85
mov eax, dword [ebp - 0x18]
and dword [ebx + 4], 0
mov dword [ebx], eax
xor eax, eax
jmp 0x554d72
mov esi, dword [ebp - 8]
test byte [ebp + 0x14], 0xe
je 0x554d62
mov ecx, esi
call fcn.00554dcb
test eax, eax
je 0x554d62
test byte [ebp + 0x14], 2
je 0x554cfd
or dword [ebp + 0x18], 0xffffffff
lea eax, [ebp + 0x18]
push eax
push 0x20019
push 0
push 0x42d210
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x554cfd
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
cdq
mov edi, eax
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or edi, esi
jne 0x554cfa
cmp dword [ebp - 4], 4
je 0x554d56
mov esi, dword [ebp - 8]
test byte [ebp + 0x14], 4
je 0x554d62
or dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x42d210
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x554d62
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc]
cdq
mov edi, eax
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or edi, esi
jne 0x554d62
cmp dword [ebp - 4], 4
jne 0x554d62
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebx], eax
xor eax, eax
jmp 0x554d6f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, 0x80004005
mov dword [ebx + 4], ecx
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x554d79
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, 0x1505
jmp 0x554d94
lea eax, [edx - 0x61]
cmp eax, 0x19
ja 0x554d8c
and edx, 0xffffffdf
imul esi, esi, 0x21
xor esi, edx
add ecx, 2
movzx edx, word [ecx]
test edx, edx
jne 0x554d81
mov eax, esi
pop esi
ret
Function at 0x555e6a
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [0x5a3d64]
test eax, eax
jne 0x555ea5
push 0x5a4f68
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x5a4f7c]
push 2
pop eax
cmp ecx, eax
jb 0x555e90
mov eax, ecx
imul eax, eax, 0x4e20
mov dword [0x5a1110], eax
mov dword [0x5a3d64], 1
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, esi
pop esi
ret

Function at 0x55961c
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
mov eax, 0x1505
add edx, esi
jmp 0x559631
movzx ecx, byte [esi]
imul eax, eax, 0x21
xor eax, ecx
inc esi
cmp esi, edx
jb 0x559628
pop esi
ret

Function at 0x559637
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
jmp 0x559644
imul eax, eax, 0x21
xor eax, edx
inc ecx
movsx edx, byte [ecx]
test edx, edx
jne 0x55963e
ret
Function at 0x58c1ef
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
mov edi, dword [ebx + 4]
cmp edi, 0x40
jb 0x58c26b
mov esi, dword [ebx]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x58c26b
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x58c26b
and dword [esp + 0x10], 0
lea ecx, [esp + 0x10]
push ecx
mov edx, 0xf8
mov byte [esp + 0x18], 0
mov ecx, eax
call fcn.00555e4e
test al, al
mov al, 1
je 0x58c23d
mov al, byte [esp + 0x14]
test al, al
jne 0x58c26b
cmp edi, dword [esp + 0x10]
jb 0x58c26b
mov ecx, dword [esi + 0x3c]
add esi, ecx
cmp dword [esi], 0x4550
jne 0x58c26b
movzx eax, word [esi + 0x18]
mov edx, 0x10b
cmp ax, dx
jne 0x58c274
lea eax, [edx - 0x2b]
cmp word [esi + 0x14], ax
je 0x58c2b6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x20b
cmp ax, dx
jne 0x58c26b
mov eax, 0xf0
cmp word [esi + 0x14], ax
jne 0x58c26b
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
mov edx, 0x108
mov byte [esp + 0x18], 0
call fcn.00555e4e
test al, al
mov al, 1
je 0x58c2ac
mov al, byte [esp + 0x14]
test al, al
jne 0x58c26b
cmp edi, dword [esp + 0x10]
jb 0x58c26b
xor eax, eax
mov dword [ebx + 0xc], esi
inc eax
jmp 0x58c26d

Function at 0x58c39e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [ecx]
mov edi, dword [ecx + 0x3c]
add edi, ecx
movzx eax, word [edi + 0x14]
lea ecx, [edi + 0x18]
add ecx, eax
movzx eax, word [edi + 6]
imul ebx, eax, 0x28
add ebx, ecx
cmp ecx, ebx
jae 0x58c3e1
mov edi, dword [edi + 0x38]
mov edx, edi
neg edx
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
dec eax
add eax, edi
and eax, edx
add eax, esi
cmp dword [ebp + 8], eax
jb 0x58c3ea
add ecx, 0x28
cmp ecx, ebx
jb 0x58c3c8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp dword [ebp + 8], esi
jb 0x58c3e1
mov eax, ecx
jmp 0x58c3e3

Function at 0x58ce0b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
or byte [esi + 0x48], 4
call fcn.0058cf56
cmp dword [0x5a5254], 0
jne 0x58ce4a
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov dword [0x5a5254], ecx
lea eax, [ecx - 1]
not eax
and eax, 0x3fff
add eax, ecx
mov dword [0x5a5258], eax
mov eax, esi
pop esi
leave
ret 4
Function at 0x58dc75
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x58dc82
lea edx, [ebp + 0x10]
cmp dword [ecx + 0x6c], 1
je 0x58dca0
cmp dword [ecx + 0x6c], 6
je 0x58dca0
mov eax, dword [ecx + 0x4c]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
jmp 0x58dccc
push 0
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0x50]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x58dcba
xor eax, eax
jmp 0x58dccc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x58dccc
movzx eax, ax
or eax, 0x80070000
pop ebp
ret 0xc
Function at 0x10002a50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10002a9c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10002a7f
cmp edi, 2
jb 0x10002a7f
cmp byte [esi], cl
jne 0x10002a7f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1003e7f8]
test edi, edi
jne 0x10002a65
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10002acb
cmp cl, 0x23
jne 0x10002ab2
cmp byte [esi], cl
jne 0x10002ab2
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1003e7f8]
test cl, cl
jne 0x10002aa3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10002c20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10002c32
mov dword [edi], 0
mov edx, 0x1003e668
call fcn.10002ae0
mov esi, eax
test esi, esi
jne 0x10002c46
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002d03
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10002d03
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002d03
mov eax, dword [0x10109708]
test eax, eax
je 0x10002c93
inc dword [eax + 0x370]
push dword [0x10109700]
push ebx
call fcn.10002500
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x10002d03
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10002cec
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10109708]
add esp, 4
test eax, eax
je 0x10002cd4
dec dword [eax + 0x370]
push dword [0x10109700]
push dword [ebp + 8]
call fcn.10002520
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10002cfb
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10007a70
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10007aaf
cmp bl, 0x23
jne 0x10007a91
cmp byte [esi], bl
jne 0x10007a91
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x1003e7f8]
test bl, bl
jne 0x10007a82
mov ebx, dword [0x10109708]
not eax
mov esi, dword [ebx + 0x198c]
mov edi, dword [ebx + 0x1994]
mov ecx, edi
test esi, esi
je 0x10007af4
nop dword [eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10007ae8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10007aea
mov esi, edx
test esi, esi
jne 0x10007ad0
mov ecx, dword [ebx + 0x1994]
mov edx, dword [ebx + 0x198c]
lea ecx, [ecx + edx*8]
cmp edi, ecx
je 0x10007b0c
cmp dword [edi], eax
jne 0x10007b0c
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x100106d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [0x10109708]
push esi
mov esi, ebx
mov dword [ebp - 4], ecx
push edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov ecx, dword [esi + 0x2d00]
mov eax, dword [esi + 0x2d04]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 8], 0
cmp ecx, eax
jne 0x100107de
lea edi, [ecx + 1]
test eax, eax
je 0x1001073c
cdq
sub eax, edx
mov edx, dword [esi + 0x2d04]
sar eax, 1
add eax, edx
jmp 0x10010747
mov edx, dword [esi + 0x2d04]
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, edx
jle 0x100107de
push dword [0x10109700]
inc dword [esi + 0x370]
lea eax, [edi*8]
sub eax, edi
shl eax, 2
push eax
call fcn.10002500
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2d08]
test eax, eax
je 0x100107c6
mov ecx, dword [esi + 0x2d00]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x2d08]
add esp, 0xc
test ecx, ecx
je 0x100107b7
mov eax, dword [0x10109708]
test eax, eax
je 0x100107b7
dec dword [eax + 0x370]
push dword [0x10109700]
push ecx
call fcn.10002520
add esp, 8
mov ecx, dword [esi + 0x2d00]
mov dword [esi + 0x2d08], ebx
mov ebx, dword [0x10109708]
mov dword [esi + 0x2d04], edi
movups xmm0, xmmword [ebp - 0x20]
mov eax, dword [ebp - 8]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [esi + 0x2d08]
movups xmmword [ecx + edx*4], xmm0
movq xmm0, qword [ebp - 0x10]
movq qword [ecx + edx*4 + 0x10], xmm0
mov dword [ecx + edx*4 + 0x18], eax
inc dword [esi + 0x2d00]
mov eax, dword [esi + 0x2d00]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x2d08]
mov esi, dword [ebp - 4]
lea edi, [eax + ecx*4]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10010830
sub esi, ecx
test ebx, ebx
je 0x10010843
inc dword [ebx + 0x370]
push dword [0x10109700]
inc esi
push esi
call fcn.10002500
mov ebx, dword [ebp - 4]
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov dword [edi - 0x1c], eax
lea esi, [ebx + 1]
mov al, byte [ebx]
add esp, 0x14
or edx, 0xffffffff
test al, al
je 0x10010897
or ebx, 0xffffffff
cmp al, 0x23
jne 0x1001087e
cmp byte [esi], al
jne 0x1001087e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x1003e7f8]
test al, al
jne 0x10010870
not edx
lea eax, [edi - 0x1c]
mov dword [edi - 0x18], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x10109708]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [esi + 0x2ce4], 0
test eax, eax
je 0x10010bba
push edi
lea edi, [esi + 0x2ce8]
mov dword [esi + 0x2ce4], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10010b14
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100118e0
xor ecx, ecx
mov dword [edi], 0
cmp dword [edi + 4], ecx
jne 0x10010b2c
push 8
mov ecx, edi
call fcn.100118e0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2cf4], 0
mov ebx, dword [edi]
jle 0x10010b77
xor ebx, ebx
nop word [eax + eax]
mov eax, dword [esi + 0x2cfc]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2cf4]
jl 0x10010b50
mov ebx, dword [edi]
mov ecx, dword [ebp - 8]
lea eax, [ebx - 1]
neg ebx
mov edi, 0x10109704
mov edx, 0x1003e66c
sbb ebx, ebx
and ebx, eax
mov eax, dword [esi + 0x2cf0]
test eax, eax
cmovne edi, eax
call fcn.10002ae0
mov esi, eax
test esi, esi
je 0x10010bb8
push esi
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002d8d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x1004700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.ntdll
mov dword [ebp - 0x2dc], edx
mov dword [ebp - 0x2e0], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
push esi
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add esp, 8
mov dword [ebp - 0x2d8], 8
call ebx
movzx edi, al
call ebx
movzx ebx, al
or ebx, edi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [ebp - 0x2d8]
movzx eax, al
or eax, ebx
mov ebx, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
shl eax, cl
add ecx, 8
or esi, eax
mov dword [ebp - 0x2d8], ecx
cmp ecx, 0x20
jl 0x1002d920
cmp esi, 0x7fffffff
jbe 0x1002d97b
lea eax, [esi - 0x80000000]
shr eax, 0xc
inc eax
nop word [eax + eax]
sub esi, 0x1000
sub eax, 1
jne 0x1002d970
push 0
push 0x40
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.RtlCreateUserThread
push str.ntdll
mov dword [ebp - 0x2d4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp - 0x2dc]
mov ebx, eax
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
lea ecx, [ebp - 0x2d4]
push ecx
push edi
push esi
push 0
push 0
push 0
push 1
push 0
push eax
call ebx
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], 0x10003
push eax
push dword [ebp - 0x2d4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x2d0]
push eax
push dword [ebp - 0x2d4]
mov dword [ebp - 0x2d0], 0x10003
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x2d4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038e20
mov esp, ebp
pop ebp
ret
Function at 0x1002da40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1002da7e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002da82
cmp edx, esi
jne 0x1002da67
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1002daa2
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002daa6
cmp edx, esi
jne 0x1002da8b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1002dac6
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002daca
cmp edx, esi
jne 0x1002daaf
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret