joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023c82
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10023d1f
push ebx
push esi
call fcn.10023c4b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10023b94
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10023ccc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10023d1e
push edi
push eax
call fcn.1002274a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10023cec
call fcn.10022826
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10023d1d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10023b94
add esp, 0x20
test eax, eax
jne 0x10023d0b
push edi
call fcn.10022826
jmp 0x10023d13
push ebx
call fcn.10022826
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10023f8a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002c348
push 0x1002c340
push str.FlsAlloc
push 0x1e
call fcn.10023ea8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10023fbe
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002a238]
call esi
jmp 0x10023fc4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10024008
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002c358
push 0x1002c350
push str.FlsGetValue
push 0x20
call fcn.10023ea8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002403f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002a238]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10028b00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10028b2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10028b2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001190
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ecx + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
movzx edi, word [ecx + 6]
xor esi, esi
lea eax, [eax + ecx + 0x18]
test edi, edi
je 0x100011dc
jmp 0x100011b0
test ebx, ebx
je 0x100011b9
cmp dword [eax + 0x14], ebx
ja 0x100011dc
mov edx, dword [eax + 0x10]
mov ecx, ebx
sub ecx, dword [eax + 0x14]
cmp edx, ecx
ja 0x100011dc
mov ecx, dword [eax + 0xc]
cmp dword [ebp + 8], ecx
jb 0x100011d4
add ecx, edx
cmp dword [ebp + 8], ecx
jb 0x100011de
inc esi
add eax, 0x28
cmp esi, edi
jb 0x100011b0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100036e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007366f
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1008d200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 4
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xd
call fcn.10044760
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xe
call fcn.10044760
mov cl, 1
mov byte [esi + 0x5c], cl
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov byte [eax + 0x41], cl
mov dword [eax + 0x4c], eax
mov edx, 8
mov dword [eax + 0x48], edx
lea eax, [esi + 0xc8]
push 0x40
mov dword [eax + 0x48], edx
mov byte [eax + 0x41], cl
mov dword [eax + 0x4c], eax
mov eax, dword [esi + 0x114]
push edi
push eax
call fcn.100601b0
mov dword [esi + 0x60], vtable.CryptoPP::Whirlpool.0
add esp, 0xc
mov dword [esi], 0x10078ef0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005c755
mov esp, ebp
pop ebp
ret

Function at 0x1000ef20
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071fb0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1008d200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x58], 0x10
lea ecx, [eax + 0x10]
mov dword [ecx + 0x4c], ecx
mov dl, 1
mov byte [ecx + 0x41], dl
mov dword [eax + 0xa8], 0x10
mov byte [eax + 0xa1], dl
lea ecx, [eax + 0x60]
mov dword [ecx + 0x4c], ecx
mov ecx, dword [eax + 0xac]
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [eax], vtable.CryptoPP::SHA1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005c755
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f480
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
push edi
test esi, esi
jne 0x1000f510
mov byte [ebx + 0x29], 1
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push edx
call fcn.100010f0
mov ecx, eax
add esp, 4
mov dword [ebp - 8], ecx
mov dword [ebx + 0x10], ecx
test ecx, ecx
je 0x1000f4cc
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov eax, esi
call fcn.10001240
mov dword [ebp - 0x10], eax
mov dword [ebx + 0x14], eax
test eax, eax
jne 0x1000f606
mov edi, 0x8013141d
cmp byte [ebx + 0x29], 0
jne 0x1000f500
mov eax, dword [ebx + 8]
test eax, eax
je 0x1000f4e5
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x1000f4f6
push eax
call esi
mov ebx, dword [ebx]
cmp ebx, 0xffffffff
je 0x1000f500
push ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebx + 0x28]
xor ecx, ecx
test al, al
sete cl
xor edx, edx
push 0
push 0
push 3
push 0
mov dword [ebx + 4], 0xffffffff
inc ecx
test al, al
setne dl
push ecx
mov dword [ebx + 8], 0
dec edx
and edx, 0x40000000
or edx, 0x80000000
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x1000f564
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1000f58d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000f57a
mov eax, 0x80004005
mov edi, eax
jmp 0x1000f4d1
jle 0x1000f586
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1000f4d1
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0xc], eax
cmp eax, 0xffffffff
jne 0x1000f5a4
call fcn.1000dfa0
mov edi, eax
jmp 0x1000f4d1
mov eax, dword [ebx]
xor edx, edx
cmp byte [ebx + 0x28], dl
push 0
sete dl
push 0
push 0
lea edx, [edx + edx + 2]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x1000f5d5
call fcn.1000dfa0
mov edi, eax
jmp 0x1000f4d1
xor ecx, ecx
cmp byte [ebx + 0x28], cl
push 0
setne cl
push 0
push 0
lea ecx, [ecx + ecx + 2]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 8], eax
test eax, eax
jne 0x1000f496
call fcn.1000dfa0
mov edi, eax
jmp 0x1000f4d1
mov ecx, dword [ebp - 8]
mov edx, esi
mov esi, dword [eax + 0x20]
call fcn.100011f0
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x1c], ecx
mov ecx, ebx
call fcn.1000f050
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f6b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007011b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x1008d200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x120], ecx
cmp eax, dword [ebx + 8]
je 0x1000f6fd
mov edx, dword [ebx + 8]
mov esi, dword [ecx]
sub eax, edx
push eax
mov eax, dword [esi + 0xc]
push edx
call eax
mov esi, dword [ebx + 0x10]
movzx eax, word [esi + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x1000f749
xor eax, eax
mov ecx, 0x3e
lea edi, [ebp - 0x11c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x120]
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0xc4], eax
push 0xf8
lea eax, [ebp - 0x11c]
push eax
mov ecx, edi
call edx
jmp 0x1000f791
mov ecx, 0x20b
cmp ax, cx
jne 0x1000f8ad
xor eax, eax
mov ecx, 0x42
lea edi, [ebp - 0x11c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0xc4], eax
push 0x108
lea eax, [ebp - 0x11c]
push eax
call edx
mov edi, dword [ebp - 0x120]
mov eax, dword [ebx + 0x10]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi]
lea esi, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
mov eax, dword [edx + 0xc]
push esi
mov ecx, edi
call eax
mov ecx, dword [ebx + 0x10]
xor edx, edx
mov dword [ebp - 0x134], 0
cmp dx, word [ecx + 6]
jae 0x1000f8a9
lea ecx, [esi + 0x10]
mov dword [ebp - 0x124], ecx
jmp 0x1000f7e6
mov ecx, dword [ebp - 0x124]
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
add eax, dword [ebx + 8]
xor ecx, ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 4], ecx
mov edi, dword [ebx + 0x18]
mov dword [ebp - 0x130], eax
mov eax, dword [ebx + 0x1c]
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x12c], edx
call fcn.10005cd0
mov ecx, dword [ebx + 0x24]
mov edi, dword [ebx + 0x20]
push ecx
lea eax, [ebp - 0x130]
call fcn.10005cd0
add esp, 8
lea esi, [ebp - 0x130]
mov edi, edi
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov ecx, dword [ebp - 0x120]
mov edi, dword [ecx]
push eax
push edx
mov edx, dword [edi + 0xc]
call edx
mov esi, dword [esi + 8]
test esi, esi
jne 0x1000f840
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x128]
test esi, esi
je 0x1000f886
mov ecx, esi
call fcn.1000dfc0
push esi
call fcn.1005ce05
add esp, 4
mov dword [ebp - 0x128], 0
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebp - 0x134]
movzx edx, word [ecx + 6]
add dword [ebp - 0x124], 0x28
inc eax
mov dword [ebp - 0x134], eax
cmp eax, edx
jb 0x1000f7e0
mov al, 1
jmp 0x1000f8ba
push 0x8013141d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005c755
mov esp, ebp
pop ebp
ret
Function at 0x1000fea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007355f
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1008d200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 4
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xd
call fcn.10044760
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xe
call fcn.10044760
mov byte [esi + 0x5c], 1
lea eax, [esi + 0x60]
push eax
mov dword [ebp - 4], 0xf
call fcn.1000ef20
mov dword [esi], vtable.CryptoPP::PK_MessageAccumulatorImpl_class_CryptoPP::SHA1_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005c755
mov esp, ebp
pop ebp
ret

Function at 0x10014570
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push esi
lea esi, [eax + edx]
push edi
mov dword [ebp - 4], esi
cmp edx, 0x10
jl 0x10014619
lea edx, [ecx + 0x24234428]
lea esi, [ecx - 0x7a143589]
mov edi, ecx
add ecx, 0x61c8864f
push ebx
mov ebx, dword [eax]
imul ebx, ebx, 0x7a143589
sub edx, ebx
mov ebx, dword [eax + 4]
imul ebx, ebx, 0x7a143589
sub esi, ebx
mov ebx, dword [eax + 8]
imul ebx, ebx, 0x7a143589
sub edi, ebx
mov ebx, dword [eax + 0xc]
imul ebx, ebx, 0x7a143589
rol edx, 0xd
imul edx, edx, 0x9e3779b1
rol esi, 0xd
imul esi, esi, 0x9e3779b1
sub ecx, ebx
mov ebx, dword [ebp - 4]
rol edi, 0xd
imul edi, edi, 0x9e3779b1
rol ecx, 0xd
add eax, 0x10
imul ecx, ecx, 0x9e3779b1
add ebx, 0xfffffff0
cmp eax, ebx
jbe 0x100145a3
rol ecx, 0x12
rol edi, 0xc
add ecx, edi
rol esi, 7
add ecx, esi
mov esi, dword [ebp - 4]
rol edx, 1
add ecx, edx
mov edx, dword [ebp + 0xc]
pop ebx
jmp 0x1001461f
add ecx, 0x165667b1
add ecx, edx
lea edx, [esi - 4]
cmp eax, edx
ja 0x1001464a
jmp 0x10014630
mov edi, dword [eax]
imul edi, edi, 0x3d4d51c3
sub ecx, edi
rol ecx, 0x11
add eax, 4
imul ecx, ecx, 0x27d4eb2f
cmp eax, edx
jbe 0x10014630
cmp eax, esi
jae 0x10014669
mov edi, edi
movzx edx, byte [eax]
imul edx, edx, 0x165667b1
add ecx, edx
rol ecx, 0xb
inc eax
imul ecx, ecx, 0x9e3779b1
cmp eax, esi
jb 0x10014650
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul eax, eax, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
pop edi
xor eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017830
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070628
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1008d200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov byte [esi + 0x30], 0
mov dword [esi + 0x34], eax
xor ebx, ebx
push 0x18
mov dword [esi + 0x40], ebx
call fcn.1005ce85
add esp, 4
cmp eax, ebx
je 0x100178f2
mov dword [esi + 0x3c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x3c]
mov al, 1
mov byte [ecx + 0x14], al
mov edx, dword [esi + 0x3c]
mov byte [edx + 0x15], al
lea edi, [esi + 0x48]
mov dword [ebp - 4], ebx
mov dword [edi + 0x10], ebx
mov byte [ebp - 4], al
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
call ebx
lea eax, [esi + 0x18]
push eax
call ebx
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x100178d0
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
cmp ecx, edi
setne al
movzx eax, al
push eax
call edx
mov dword [edi + 0x10], 0
mov dword [edi], 0x1007be34
mov dword [edi + 4], esi
mov dword [edi + 0x10], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp + 0xc], ebx
call fcn.1005c7fd
push 0x1008692c
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], vtable.std::bad_alloc.0
call fcn.1005dc27
int3
Function at 0x1002d5d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006f5e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1008d200]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
call edx
mov edi, eax
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
mov dword [esp + 0x20], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
push edx
push edi
mov ecx, esi
call eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
push eax
push ecx
mov ecx, edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push edi
mov ecx, esi
call edx
mov dword [esp + 0x1c], 0xffffffff
mov bl, al
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10

Function at 0x1002dff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ecx, edi
shr ecx, 2
xor ebx, ebx
test ecx, ecx
je 0x1002e020
mov eax, edx
sub esi, edx
mov ebx, ecx
push ebp
jmp 0x1002e010
mov ebp, dword [esi + eax]
xor dword [eax], ebp
add eax, 4
dec ecx
jne 0x1002e010
mov esi, dword [esp + 0x14]
pop ebp
lea eax, [ebx*4]
sub edi, eax
je 0x1002e049
add edx, eax
add esi, eax
test edi, edi
je 0x1002e049
mov ecx, esi
mov eax, edx
sub ecx, edx
mov esi, edi
jmp 0x1002e040
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x1002e040
pop edi
pop esi
pop ebx
ret

Function at 0x1002e050
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x1002e094
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [esp + 0xc], ecx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebp
jne 0x1002e078
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x1002e0bd
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
je 0x1002e0bd
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec edi
mov byte [eax + esi - 1], dl
jne 0x1002e0b0
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1002e440
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10073d58
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push edi
mov eax, dword [0x1008d200]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
xor edi, edi
push ecx
mov dword [esp + 0x14], edi
call fcn.10044850
push eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x30], edi
call fcn.10046b60
push eax
push esi
call fcn.10044850
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov edx, ecx
add edx, edx
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x1002e4b0
call fcn.1005d890
jmp 0x1002e4b5
call fcn.1005cffc
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x24
ret 8

Function at 0x1002f7f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10072d08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x1008d200]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0xc], eax
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push 0x100957a8
push edx
call eax
lea ecx, [esp + 0x24]
push ecx
push esi
call fcn.10044850
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, ecx
add edx, edx
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x1002f85f
call fcn.1005d890
jmp 0x1002f864
call fcn.1005cffc
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x10
ret 0x18

Function at 0x10030850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100726e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x1008d200]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.10030820
push 2
push eax
mov dword [esp + 0x30], 0
call fcn.10030790
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x100308ab
push eax
call fcn.1005ce05
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x100308c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100726e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x1008d200]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.10030850
push 0x348
push eax
mov dword [esp + 0x30], 0
call fcn.10030790
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x1003091e
push eax
call fcn.1005ce05
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x100499c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x100499d0
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x10097f70], edx
mov dword [esi*8 + 0x10097f74], eax
inc esi
cmp esi, 0x100
jl 0x100499d0
mov dword [0x10098778], edi
mov dword [0x1009877c], edi
mov dword [0x10098770], edi
mov dword [0x10098774], edi
pop edi
pop esi
mov byte [0x100987a0], 1
pop ebx
ret

Function at 0x10049a50
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x10079600]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x10097770], edx
mov dword [eax*8 + 0x10097774], ebp
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x10049a60
pop edi
pop esi
pop ebp
mov byte [0x100987a1], 1
pop ebx
add esp, 0x10
ret