joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404100
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18c8
call fcn.00411920
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x498688]
push ebx
push esi
mov dword [ebp - 8], ecx
mov ecx, dword [0x49868c]
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], ecx
call fcn.004040f0
mov ebx, dword [ebp - 0xc]
mov edx, dword [0x498690]
mov eax, dword [0x498694]
mov edi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
add ebx, 0x23f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x20
jmp 0x404170
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x49fe24]
shl esi, 4
add esi, dword [ebp - 0x20]
cmp eax, 0xfa9
jne 0x40419c
mov dword [0x49fe20], 0xedeb2e40
jmp 0x4041b7
cmp eax, 0x3eb
jne 0x4041b7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [0x49f8b0], 0
mov ecx, dword [ebp - 8]
add ecx, ebx
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x24]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x49fe24], 0x9e6
mov dword [0x49fe1c], 0xf4ea3dee
jne 0x4041ef
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x49fe24], 0x213
jne 0x40428b
push 0
lea eax, [ebp - 0xcc8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
lea ecx, [ebp - 0x4c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x10c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call edi
push 0
push 0
lea ecx, [ebp - 0x18c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
call edi
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 4]
cmp dword [0x49fe24], 0xc
mov dword [ebp - 0x10], esi
jne 0x4042a5
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov edx, esi
shr edx, 5
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x18]
lea ecx, [ebx + esi]
xor eax, ecx
xor eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
sub dword [ebp - 0x14], 1
jne 0x404170
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4028d5
Capabilities:
Terminate process

Disassembly:
call fcn.00552000
push 0x18
push 0x4029f8
call fcn.004032a6
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.MSVCR120_CLR0400.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x4150e8
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x404373
xor esi, esi
inc esi
cmp dword [0x4150ec], esi
je 0x404385
cmp dword [0x4150ec], 0
jne 0x402a1e
mov dword [0x4150ec], esi
push 0x4029f4
push 0x4029e4
call sub.MSVCR120_CLR0400.dll__initterm_e
pop ecx
pop ecx
test eax, eax
jne 0x404392
cmp dword [0x4150ec], esi
jne 0x402973
push 0x4029e0
push 0x4029cc
call sub.MSVCR120_CLR0400.dll__initterm
pop ecx
pop ecx
mov dword [0x4150ec], 2
test edi, edi
jne 0x402980
xor eax, eax
mov ecx, 0x4150e8
xchg dword [ecx], eax
cmp dword [0x4150f8], 0
jne 0x4043a3
mov eax, dword [sym.imp.MSVCR120_CLR0400.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x24]
nop
nop
nop
nop
nop
nop
mov cl, byte [esi]
cmp cl, 0x20
jbe 0x402a14
cmp cl, 0x22
je 0x4043d1
movzx eax, cl
push eax
call dword [sym.imp.MSVCR120_CLR0400.dll__ismbblead]
pop ecx
test eax, eax
jne 0x4043e2
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4029a0
test cl, cl
je 0x402a29
test edi, edi
je 0x402a29
jmp 0x4029a7
mov dword [0x415244], esi
jmp 0x402950
mov al, byte [esi]
test al, al
je 0x402a39
cmp al, 0x20
ja 0x402a39
inc esi
mov dword [ebp - 0x20], esi
jmp 0x402a29
push ebx
push esi
push 0
push 0x400000
call fcn.00403044
mov dword [0x415060], eax
cmp dword [0x415064], 0
jne 0x40441a
push eax
call dword [sym.imp.MSVCR120_CLR0400.dll_exit]
test ecx, ecx
je 0x402a82
push ecx
call fcn.0040117d
jmp 0x402a82
mov eax, esi
pop esi
pop ebp
ret 4
cmp eax, edx
jne 0x402905
xor esi, esi
inc esi
mov edi, esi
jmp 0x402918
push 0x1f
call sub.MSVCR120_CLR0400.dll__amsg_exit
pop ecx
jmp 0x402950
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x404435
push 0x4150f8
call fcn.0040fdd0
pop ecx
test eax, eax
je 0x40298d
push 0
push 2
push 0
mov esi, dword [0x4150f8]
mov ecx, esi
call dword [0x416268]
call esi
jmp 0x40298d
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x24], edi
jmp 0x4029b0
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4029c3
cmp dword [0x415244], 0
jne 0x40442e
call dword [sym.imp.MSVCR120_CLR0400.dll__cexit]
mov eax, dword [0x415060]
mov dword [ebp - 4], 0xfffffffe
call fcn.004032ee
ret
Function at 0x404350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor esi, esi
push eax
push 0x20019
push esi
push 0x407458
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov edi, 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4043a1
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push 0x4074b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404423
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push esi
push esi
push esi
push 0x407508
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
je 0x4043c4
test eax, eax
jne 0x40441a
mov eax, dword [ebp - 4]
inc eax
push eax
mov dword [ebp - 4], eax
call fcn.00405940
mov esi, eax
pop ecx
test esi, esi
je 0x40441a
push dword [ebp - 4]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push 0x407508
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404413
push esi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbslwr]
pop ecx
push esi
mov ecx, ebx
call fcn.0040401a
mov edi, eax
push esi
call fcn.004053e3
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4044cd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push 0x407558
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404539
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push 0x407594
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404530
cmp dword [ebp - 8], 4
jne 0x404530
inc eax
cmp dword [ebp - 0xc], eax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x40453e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0x20019
xor edi, edi
xor esi, esi
push edi
push 0x407528
push reloc.OLEAUT32.dll_SysReAllocString
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4045a4
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push edi
push 0x407554
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40459b
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00404698
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004048b8
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x404735
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push 0x230
mov eax, 0x406928
call fcn.0040545b
xor eax, eax
mov byte [ebp - 0x231], al
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x4048ac
push 0x407634
mov byte [ebp - 0x231], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x238], esi
pop ecx
cmp dword [ebp - 0x23c], eax
jle 0x4048a5
cmp dword [ebx + edi*4], 0
je 0x404898
push esi
push 0x407634
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404898
mov eax, dword [ebx + edi*4]
xor ecx, ecx
mov byte [ebp - 0x231], cl
lea esi, [eax + esi*2]
cmp word [esi], cx
je 0x404892
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 0x104
jae 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x404892
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00404698
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x220], eax
je 0x404883
mov ecx, 0x104
cmp dword [ebp - 0x220], ecx
jae 0x404883
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x404883
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x404883
lea eax, [ebp - 0x218]
mov ecx, section..data
push eax
call fcn.00404a3b
mov byte [ebp - 0x231], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00401780
mov esi, dword [ebp - 0x238]
inc edi
cmp edi, dword [ebp - 0x23c]
jl 0x40479b
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0x231]
call fcn.00405416
ret

Function at 0x404ace
Capabilities:
Accept command line arguments

Disassembly:
push esi
push 1
call fcn.00404972
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call fcn.00404735
test al, al
jne 0x404afd
xor eax, eax
inc eax
jmp 0x404b0c
push esi
call fcn.00404935
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
ret 0x10
Function at 0x10002a30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x10042040]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
lea eax, [esp + 0xc]
mov esi, ecx
push eax
push 0
push 0
mov dword [esp + 0x18], esi
mov dword [esp + 0x18], esi
push 0x10035240
mov dword [esp + 0x1c], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xorps xmm0, xmm0
test eax, eax
js 0x10002aef
mov edx, dword [esp + 0xc]
mov ecx, edx
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002a91
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.100081e0
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [esp + 0x20]
movq qword [esi + 0x10], xmm0
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10014737
mov esp, ebp
pop ebp
ret
push 0
movups xmmword [esi], xmm0
push 0x1003cf64
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.100081e0
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.10014737
mov esp, ebp
pop ebp
ret
Function at 0x10002d70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x10042040]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
push 0
mov edi, ecx
push 2
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10002de5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, 0x1003d038
mov ecx, 0x10043430
call fcn.100079f0
add esp, 4
mov ecx, eax
call fcn.10005370
push eax
call fcn.10007c90
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.10014737
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x10002e45
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, 0x1003d07c
mov ecx, 0x10043430
call fcn.100079f0
add esp, 4
mov ecx, eax
call fcn.10005370
push eax
call fcn.10007c90
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.10014737
mov esp, ebp
pop ebp
ret
mov esi, dword [edi]
mov edi, dword [edi + 4]
cmp esi, edi
je 0x10002e73
nop
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x10002e5a
mov eax, dword [esi]
lea ecx, [esp + 0x34]
push ecx
push eax
call fcn.1001cbd8
add esp, 8
test eax, eax
je 0x10002e89
add esi, 0x18
cmp esi, edi
jne 0x10002e50
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x10002e27
mov edi, dword [esp + 0xc]
jmp 0x10002e45
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x244]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10014737
mov esp, ebp
pop ebp
ret
Function at 0x10004660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10004687
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10004630
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x100066e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10033f9d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10042040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1001474a
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10011a47
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.100075b0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp + 8], esi
cmp dword [esi + 0x14], 0xf
jbe 0x100067b1
mov eax, dword [esi]
mov dword [ebp + 8], eax
mov esi, dword [esi + 0x10]
xor eax, eax
cmp esi, 0x7fffffff
ja 0x10006855
test esi, esi
je 0x10006839
cmp esi, 0x1000
jb 0x100067f1
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x1000685a
push eax
call fcn.1001474a
add esp, 4
test eax, eax
je 0x1000685f
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x100067fc
push esi
call fcn.1001474a
add esp, 4
mov ebx, eax
push esi
push dword [ebp + 8]
push ebx
call fcn.10016030
mov eax, dword [edi + 0xc]
lea ecx, [ebx + esi]
mov dword [edi + 0x38], ecx
add esp, 0xc
mov dword [eax], ebx
mov eax, dword [edi + 0x1c]
mov dword [eax], ebx
mov eax, dword [edi + 0x2c]
mov dword [eax], esi
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x38]
sub ecx, ebx
mov dword [eax], ebx
mov eax, dword [edi + 0x20]
mov dword [eax], ebx
mov eax, dword [edi + 0x30]
mov dword [eax], ecx
mov eax, 1
jmp 0x1000683c
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1001183e
call fcn.10001390
call fcn.1001ee96
int3
Function at 0x10007120
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10033bc0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10042040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1001474a
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10011a47
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.100075b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100105f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x10010610
pop edi
pop esi
mov dword [ecx], 0x270
mov eax, ecx
pop ebp
ret 4
Function at 0x10010eb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x10010f0d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10010ed0
mov eax, dword [esi]
jmp 0x10010feb
cmp eax, 0x4e0
jb 0x10010feb
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10010f26
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10010f71
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret