joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438bec
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x438c22
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x438c15
cmp esi, ecx
jae 0x438d05
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x438c9b
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
movzx eax, al
shr ecx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x45a278]
xor ecx, eax
or ecx, edx
jmp 0x438ceb
cmp edi, 6
jbe 0x438ceb
cmp edx, 4
jne 0x438ceb
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x438c34
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x439b1e
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
mov edi, ecx
push ecx
lea esi, [edi + 4]
mov ecx, esi
call fcn.0040846d
test al, al
je 0x439b36
pop edi
xor al, al
pop esi
ret
push 0xc
call fcn.0043b1a7
pop ecx
push edi
push 0x439acf
mov ecx, eax
call fcn.00415a70
push eax
mov ecx, esi
call fcn.004084a6
mov ecx, esi
call fcn.00408402
pop edi
mov ecx, eax
pop esi
jmp fcn.00415c10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4231f8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x423237
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x423237
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x423237
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x423237
cmp dword [ecx + 0x74], 0xe
jbe 0x423237
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428ff4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43581c
push 0x435814
push str.FlsAlloc
push 0x1f
call fcn.00428ecf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x429028
push dword [ebp + 8]
mov ecx, esi
call dword [0x4321a4]
call esi
jmp 0x42902e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x429072
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43582c
push 0x435824
push str.FlsGetValue
push 0x21
call fcn.00428ecf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4290a9
push dword [ebp + 8]
mov ecx, esi
call dword [0x4321a4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4290b1
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x435834
push 0x43582c
push str.FlsSetValue
push 0x22
call fcn.00428ecf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4290eb
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4321a4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x42b15a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42b1f7
push ebx
push esi
call fcn.0042b123
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042b0b7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42b1a4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42b1f6
push edi
push eax
call fcn.00428c79
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42b1c4
call fcn.00428c3f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42b1f5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042b0b7
add esp, 0x20
test eax, eax
jne 0x42b1e3
push edi
call fcn.00428c3f
jmp 0x42b1eb
push ebx
call fcn.00428c3f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42f470
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42f49d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42f49d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x483b60
Capabilities:
Encode data using xor

Disassembly:
cmp esp, dword [ebp + 5]
and eax, 0x65a4f8d8
push ebx
std
movsb byte es:[edi], byte [esi]
loope 0x483b39
xor byte [eax - 0x51eb7ff3], ah
inc esp
sub al, 0xb9
sbb bl, ah
add eax, 0x7af7b83d
add dword [ebp + 0x19], ecx
lea eax, [esi + 0x671c1ae4]
xchg ebx, eax
adc al, 0x14
jb 0x483b95
nop
inc ebx
adc al, 0x10
sbb byte [edi - 0x2b8d8de4], al
sbb byte [eax + 0x54], dl
test byte [eax + ecx*8 + 0x21], cl
adc al, 0x54
lodsd eax, dword [esi]
xchg ebx, eax
pop edx
leave
adc al, 0xcc
jge 0x483baf
loopne 0x483b65
cmpsd dword [esi], dword es:[edi]
mov esi, 0x658106f5
loopne 0x483c17
push 0x4a
push es
add byte [edi - 0x80], al
shl dl, 1
in al, 0xd9
mov byte [ecx*8 + 0x9d45971], dh
pop ecx
aam 9
or dword [0x58507c20], esi
mov dword [ecx - 0x47445db3], edi
lodsd eax, dword [esi]
dec esp
out 0x32, al
and al, 0x87
adc al, 0x8a
or ah, ah
or esi, edi
sub dword [ebp - 0x3d2fb8be], ecx
mov eax, dword [ebx]
jle 0x483bd5
invalid
jge 0x483c79
mov ah, 0xe
ror dword [esp + eax + 0x2e], 0x83
shl bl, 0xb4
xchg ebx, eax
lodsb al, byte [esi]
mov dword [0xb30f474a], eax
lodsb al, byte [esi]
add dl, ch
test esp, ebp
jge 0x483c76
mov al, 0x55
rol byte [ecx - 0x22], 1
sub esi, eax
push 0x3e13e8b
cmp cl, 0x34
push edx
je 0x483c44
pop cx
pop ecx
inc ebx
mov esi, 0x6f589356
mov byte [0x950b45f1], al
and bh, byte [edx]
nop
mov edx, 0xa9dc1244
invalid
nop
pushfd
mov bh, 0xbf
xchg edi, eax
out 0xba, al
push esi
mov edi, 0x26bae697
push esi
mov edx, 0xf1bb5626
aam 0x46
cdq
mov ebx, 0x9946d4f1
and eax, ecx
and al, dl
jge 0x483cbe
int 0xc0
inc eax
cmp byte cs:[ebx], dl
mov edx, 0x2572506
test al, 0x70
in al, 0x90
inc ebx
je 0x483cd1
ror byte [edi + 0x34426409], 1
pop es
movsd dword es:[edi], dword [esi]
mov dl, 0xab
mov edx, ebp
jmp 0x483cd9
cmp byte [ecx + 0x6118c0c8], dh
fild qword [ebp + 0x15]
lodsd eax, dword [esi]
lcall 0x64f1, 0x8201ab1f
jl 0x483c51
jns 0x483cdb
mov al, 0xc3
add dh, byte [eax]
jbe 0x483c7c
pop edi
invalid
sbb eax, dword [ebx + 0x1a]
movsb byte es:[edi], byte [esi]
dec ebp
inc dword [edx + eax*2 + 0x4a1e907a]
invalid
Function at 0x4b6b50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x73000]
mov dword [edi + 0xa4e88], 0x3875b07f
push edi
or ebp, 0xffffffff
jmp 0x4b6b7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b6b81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b6b70
mov eax, 1
add ebx, ebx
jne 0x4b6b93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b6ba4
jne 0x4b6bc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b6bc3
dec eax
add ebx, ebx
jne 0x4b6bb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b6b88
add ebx, ebx
jne 0x4b6bbf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b6c15
xor ecx, ecx
sub eax, 3
jb 0x4b6bdb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b6c4a
sar eax, 1
mov ebp, eax
jmp 0x4b6be6
add ebx, ebx
jne 0x4b6be6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b6bb4
inc ecx
add ebx, ebx
jne 0x4b6bf4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b6bb4
add ebx, ebx
jne 0x4b6c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b6bf6
jne 0x4b6c12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b6bf6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b6c34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b6c26
jmp 0x4b6b76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b6c34
add edi, ecx
jmp 0x4b6b76
pop esi
mov edi, esi
mov ecx, 0x3ca8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b6c52
cmp byte [edi], 0x12
jne 0x4b6c52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b6c57
lea edi, [esi + 0xb0000]
mov eax, dword [edi]
or eax, eax
je 0x4b6ccf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb64f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb65b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b6c84
mov ecx, edi
jns 0x4b6cb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb65bc]
or eax, eax
je 0x4b6cc9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b6ca1
call dword [esi + 0xb65cc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4b6d00
cmp al, 0xef
ja 0x4b6cf3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4b6cd5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4b6ce2
mov ebp, dword [esi + 0xb65c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x257]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b6d34
sub esp, 0xffffff80
jmp 0x4190b0
Function at 0x1001aee9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100d0db4
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100dbeac
mov dword [esi + 8], 0x100d97c0
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push fcn.1000b96d
push 0x1001b0f6
push 6
lea eax, [esi + 0x160]
push 8
push eax
mov byte [ebp - 4], 7
call fcn.10086f39
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dbe78
mov dword [esi + 4], 0x100dbe5c
mov dword [esi + 8], 0x100dbe4c
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100248ea
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
mov ecx, dword [esp + 8]
lea esi, [edx + ecx]
cmp edx, esi
je 0x10024919
push edi
movzx edi, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, edi
shr eax, 8
movzx ecx, word [ecx*2 + 0x100f75d0]
xor eax, ecx
inc edx
cmp edx, esi
jne 0x100248f9
pop edi
pop esi
ret 4

Function at 0x10029218
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d1c35
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100d9c7c
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dd620
mov dword [esi + 4], 0x100dd610
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1007f713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100d7204
call fcn.100cece0
sub esp, 0x64
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0x2c]
mov byte [esi + 0x69], al
cmp dword [ebx], 0x10900
mov edx, ebx
sete al
mov byte [esi + 0x68], al
call fcn.1007f8eb
xor edi, edi
cmp eax, edi
jne 0x1007f8da
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x80]
or ecx, dword [eax + 4]
jne 0x1007f76b
push 1
pop eax
jmp 0x1007f76d
xor eax, eax
test al, al
lea ecx, [ebp - 0x70]
mov dword [ebp + 0xc], edi
sete byte [ebp + 0x17]
call fcn.100786d5
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], edi
cmp eax, edi
mov dword [ebp - 0x14], edi
jbe 0x1007f8bf
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x20]
add eax, dword [ebp - 0x10]
cmp word [ebx + 0x20], 1
mov dword [ebp - 0x1c], eax
jne 0x1007f892
cmp word [eax + 0x20], 1
jne 0x1007f892
cmp byte [esi + 0x68], 0
mov eax, dword [esi + 0x60]
sete cl
movzx edi, cl
lea ecx, [esi + 0x5c]
add edi, eax
call fcn.10080f40
mov ecx, eax
mov edx, edi
mov dword [ebp - 0x18], ecx
call fcn.10086f39
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x70]
push dword [ebp - 0x18]
push esi
push ebx
push edi
push dword [ebp + 8]
call fcn.1007e9a8
test eax, eax
jne 0x1007f8aa
add edi, 0x2c
push 0x14
lea eax, [ebp - 0x30]
push edi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1007f826
cmp byte [ebx + 0x2c], 0
je 0x1007f8c5
xor eax, eax
cmp byte [edi + eax], 0
jne 0x1007f8c5
inc eax
cmp eax, 0x14
jb 0x1007f816
mov edi, dword [ebp - 0x18]
and dword [edi + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x1007f83e
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.10080ecb
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.10086f39
test eax, eax
jne 0x1007f8aa
cmp byte [ebp + 0x17], al
je 0x1007f892
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x78]
cmp ecx, dword [eax + 8]
jne 0x1007f8a6
mov ecx, dword [ebx + 0x7c]
cmp ecx, dword [eax + 0xc]
jne 0x1007f8a6
and byte [ebp + 0x17], 0
mov cl, 1
cmp byte [ebx + 0x2d], 0
je 0x1007f892
cmp dword [eax + 0x24], 1
jne 0x1007f892
inc dword [ebp + 0xc]
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp + 0xc]
sete al
test cl, cl
je 0x1007f88a
test al, al
je 0x1007f8c5
test al, al
je 0x1007f892
test cl, cl
je 0x1007f8ae
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x40
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x24]
jae 0x1007f8bf
jmp 0x1007f792
xor cl, cl
jmp 0x1007f86a
mov esi, eax
jmp 0x1007f8cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
push 1
pop eax
jmp 0x1007f8da
cmp byte [ebp + 0x17], 0
je 0x1007f8ca
push 1
pop esi
jmp 0x1007f8cc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1008095a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100d729c
call fcn.100cece0
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10080ade
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10080ade
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
call fcn.10086f39
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.10086f39
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov byte [esi + 2], al
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.10086f39
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10086f39
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.10086f39
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.10086f39
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.10086f39
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.10086f39
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.100034b3
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10080f88
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d731b
call fcn.100cece0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100851fe
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100d78af
call fcn.100cece0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001da4
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10085281
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10086f39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10086f48
pop dword [ebp - 0x40]
mov eax, 0x86ca068
sub eax, 0xf8643120
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x4762b
push 0
mov eax, 0x1fc1dc49
sub eax, 0xfb44c21
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xb947e4ef
sub ecx, 0xb9478f35
xor edx, edx
add edx, eax
mov ebx, 0xac018f6d
add ebx, 0x64108e93
add ebx, dword [ebp - 0x40]
mov edi, 0x3e6fa8b3
sub edi, 0x33fd296
xor dword [ebp - 0x14], 0x4977bc72
mov esi, dword [ebx]
add dword [ebp - 0x3c], eax
sub esi, edi
mov dword [ebp - 0x28], 0xa5ac5103
mov dword [edx], esi
add dword [ebp - 0x1c], 0xd37add2b
add edx, 0x848547e9
sub edx, 0x848547e5
add ebx, 4
loop 0x10086fa9
add eax, 0x243e8b44
add eax, 0xdbc2be77
mov ebx, eax
add eax, 5
mov ecx, 0x1f4d96ce
sub ecx, 0xf4d96ce
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100c1f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x100c1fcb
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x100c200c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x100c1ff1
mov ecx, ebx
call fcn.100c1c50
add ebx, 0x28
dec ebp
jne 0x100c1fe5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x100c2007
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.100c1b20
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.100c20b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x20]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x1c]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
push ebp
call fcn.10086f39
mov ebx, eax
cmp ebx, edi
je 0x100c2084
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.100c20e0
cmp ebx, edi
jle 0x100c207f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x100c2084
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x100c2096
cmp dword [esi + 0x40], edi
jne 0x100c2096
cmp dword [esi + 0x3c], edi
jne 0x100c2096
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret