joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002594a
Capabilities:
Hash data using sha256

Disassembly:
or dword [ecx + 0x10], 0xffffffff
or dword [ecx + 0x14], 0xffffffff
xor eax, eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
add ecx, 0x28
jmp fcn.10021ec6

Function at 0x10026a80
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, ecx
lea eax, [ebx + 0x1c]
push esi
shr ebx, 2
mov ecx, ebx
add ebp, 0x10
shr ecx, 1
add ecx, 3
xor esi, esi
mov dword [ebp - 0x10], ecx
push edi
test ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebx
jbe 0x10026ac1
mov eax, ebp
mov ecx, ebx
mov esi, ebx
mov edi, dword [edx]
add edx, 4
mov dword [eax], edi
add eax, 4
dec ecx
jne 0x10026ab4
cmp esi, dword [esp + 0x14]
jae 0x10026baf
lea edx, [ebx*4]
lea edi, [esi*4]
mov dword [esp + 0x18], edx
mov eax, esi
xor edx, edx
div ebx
mov ecx, dword [edi + ebp - 4]
mov dword [esp + 0x10], ecx
test edx, edx
jne 0x10026b41
mov eax, ecx
xor ebx, ebx
and eax, 0xff
mov edx, ecx
shr edx, 0x18
mov bh, byte [eax + str.cw]
xor eax, eax
mov bl, byte [edx + str.cw]
mov al, byte [esp + 0x12]
xor edx, edx
mov dl, byte [eax + str.cw]
xor eax, eax
mov al, ch
xor ecx, ecx
shl ebx, 8
mov cl, byte [eax + str.cw]
or ebx, edx
mov eax, esi
xor edx, edx
div dword [esp + 0x20]
xor edx, edx
shl ebx, 8
mov dl, byte [eax + 0x100c7ec4]
xor ecx, edx
or ecx, ebx
jmp 0x10026b8a
cmp ebx, 6
jbe 0x10026b8e
cmp edx, 4
jne 0x10026b8e
xor eax, eax
xor edx, edx
mov al, byte [esp + 0x12]
xor ebx, ebx
mov dl, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
mov dh, byte [eax + str.cw]
xor eax, eax
mov al, ch
and ecx, 0xff
shl edx, 8
mov bl, byte [eax + str.cw]
xor eax, eax
mov al, byte [ecx + str.cw]
or edx, ebx
shl edx, 8
or edx, eax
mov ecx, edx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov eax, edi
sub eax, edx
add edi, 4
mov edx, dword [eax + ebp]
mov eax, dword [esp + 0x14]
xor edx, ecx
inc esi
mov dword [edi + ebp - 4], edx
cmp esi, eax
jb 0x10026add
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x100295b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
or eax, 0xffffffff
push edi
mov dword [esi + 0x468], eax
mov dword [esi + 0x34], 0
mov byte [esi + 0x1f], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x46c], eax
call fcn.10029610
xor edx, edx
add esi, 0x60
mov eax, edx
mov ecx, 8
mov edi, eax
and edi, 1
neg edi
and edi, 0xedb88320
shr eax, 1
xor eax, edi
dec ecx
jne 0x100295e6
mov dword [esi], eax
inc edx
add esi, 4
cmp edx, 0x100
jb 0x100295df
pop edi
pop esi
ret

Function at 0x10030d60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
or dh, 1
mov esi, edx
xor ebx, ebx
and esi, 1
shr edx, 1
neg esi
mov bx, word [ecx + edx*2]
shr esi, 4
shr ebx, 4
and esi, 0x7f
xor ebx, esi
mov esi, dword [edi + ebx*4]
add eax, esi
cmp edx, 2
jae 0x10030d6c
pop edi
pop esi
pop ebx
ret 4

Function at 0x10030da0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x10], edx
xor edi, edi
mov dword [esp + 0x18], eax
mov ebx, edi
mov eax, edi
shr ebx, 1
mov esi, ebx
xor edx, edx
and esi, 1
add edi, 2
shr eax, 2
neg esi
mov dx, word [ecx + eax*2 + 4]
shr esi, 4
shr edx, 4
and esi, 0x7f
xor edx, esi
xor esi, esi
mov si, word [ecx + 2]
neg eax
shr eax, 4
and eax, 0x7f
shr esi, 4
xor eax, esi
mov esi, dword [ebp + edx*4]
mov edx, dword [ebp + eax*4]
mov eax, dword [esp + 0x10]
add esi, edx
add esi, eax
xor eax, eax
mov ax, word [ecx + ebx*2 + 8]
mov edx, eax
xor eax, 0x7f0
shr edx, 4
shr eax, 4
mov ebx, dword [ebp + edx*4]
mov edx, dword [esp + 0x18]
add ebx, esi
mov dword [edx], ebx
mov eax, dword [ebp + eax*4]
add eax, esi
mov dword [edx + 4], eax
add edx, 8
cmp edi, 8
mov dword [esp + 0x18], edx
jb 0x10030db7
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x10030e40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
lea eax, [ecx + 0x11fc]
mov dword [ecx + 0xc4], edi
mov dword [esp + 0x10], eax
mov esi, edi
xor ebx, ebx
mov bx, word [ecx + 0x1e1e]
and esi, 1
mov edx, esi
mov eax, edi
neg edx
shr edx, 4
and edx, 0x7f
xor ebp, ebp
shr ebx, 4
xor edx, ebx
lea ebx, [esi + 2]
shr eax, 1
mov esi, eax
add ebx, ebx
and esi, 1
mov dword [esp + 0x14], ebx
mov bp, word [ebx + ecx + 0x1e1c]
mov ebx, esi
neg ebx
mov edx, dword [ecx + edx*4 + 0x748]
shr ebx, 4
shr ebp, 4
and ebx, 0x7f
xor ebp, ebx
shr eax, 1
mov ebx, dword [ecx + ebp*4 + 0x748]
and eax, 1
add edx, ebx
mov ebx, dword [esp + 0x14]
add esi, ebx
xor ebx, ebx
add esi, esi
mov ebp, eax
neg ebp
mov bx, word [esi + ecx + 0x1e1c]
add esi, eax
shr ebp, 4
xor eax, eax
and ebp, 0x7f
mov ax, word [ecx + esi*2 + 0x1e1c]
shr ebx, 4
xor ebx, ebp
mov esi, eax
shr esi, 4
mov ebp, dword [ecx + ebx*4 + 0x748]
xor eax, 0x7f0
mov ebx, dword [ecx + esi*4 + 0x748]
mov esi, dword [esp + 0x10]
add edx, ebp
add esi, 4
add ebx, edx
mov dword [esp + 0x10], esi
shr eax, 4
mov dword [esi - 0x24], ebx
mov eax, dword [ecx + eax*4 + 0x748]
add eax, edx
inc edi
mov dword [esi - 4], eax
cmp edi, 8
jb 0x10030e59
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100337a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x10], ecx
mov esi, 0x100
or dh, 1
shl edi, 1
mov ecx, esi
mov ebx, edx
and ecx, edi
mov ebp, esi
shr ebx, 8
add ebp, ecx
xor ecx, ecx
add ebx, ebp
mov ebp, dword [esp + 0x10]
mov cx, word [ebp + ebx*2]
mov ebx, edx
shr ebx, 7
and ebx, 1
neg ebx
shr ebx, 4
shr ecx, 4
and ebx, 0x7f
xor ecx, ebx
mov ebx, dword [esp + 0x1c]
shl edx, 1
mov ebp, dword [ebx + ecx*4]
mov ecx, edx
xor ecx, edi
add eax, ebp
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x100337b7
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x10034d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x10034d7b
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x10034dbc
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x10034da1
mov ecx, ebx
call fcn.10034a00
add ebx, 0x28
dec ebp
jne 0x10034d95
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x10034db7
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.100348d0
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.10034e60
mov ebx, eax
cmp ebx, edi
jne 0x10034e1f
lea ecx, [ebp + 0x20]
call fcn.1003afbe
mov ebx, eax
cmp ebx, edi
jne 0x10034e1f
lea ecx, [ebp + 0x1c]
call fcn.1003afbe
mov ebx, eax
cmp ebx, edi
jne 0x10034e1f
push ebp
call fcn.10034eb0
mov ebx, eax
cmp ebx, edi
je 0x10034e34
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.10034e90
cmp ebx, edi
jle 0x10034e2f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x10034e34
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x10034e46
cmp dword [esi + 0x40], edi
jne 0x10034e46
cmp dword [esi + 0x3c], edi
jne 0x10034e46
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x10039090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
mov ecx, eax
imul ecx, edx
mov edx, dword [esi + 0x50]
add edx, ecx
mov dword [esi + 0x50], edx
mov edx, dword [esi + 0x4c]
sub edx, ecx
imul eax, dword [esp + 8]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
lea edx, [eax + ecx]
xor edx, eax
cmp edx, 0x1000000
jb 0x100390d8
cmp ecx, 0x8000
jae 0x10039101
neg eax
and eax, 0x7fff
mov dword [esi + 0x48], eax
mov ecx, dword [esi + 0x54]
call dword [ecx]
mov ecx, dword [esi + 0x4c]
and eax, 0xff
shl ecx, 8
or eax, ecx
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x50]
shl ecx, 8
shl eax, 8
mov dword [esi + 0x48], ecx
mov dword [esi + 0x50], eax
jmp 0x100390b3
pop esi
ret 4

Function at 0x10039530
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0x10039e00
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
xor ebp, ebp
xor edx, edx
mov esi, dword [edi + 0x18]
and esi, 0x3f
mov eax, esi
and eax, 3
shr esi, 2
cmp eax, ebp
je 0x10039e22
mov edx, dword [edi + esi*4 + 0x20]
lea ecx, [eax*8]
mov eax, SysReAllocString
shr eax, cl
or eax, edx
mov dword [edi + esi*4 + 0x20], eax
inc esi
cmp esi, 0xe
je 0x10039e56
and esi, 0xf
jne 0x10039e4c
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.10039560
mov dword [edi + esi*4 + 0x20], ebp
inc esi
cmp esi, 0xe
jne 0x10039e3c
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
mov ecx, 3
call fcn.100b92c0
mov dword [edi + 0x58], edx
lea edx, [edi + 0x20]
push edi
mov ecx, edi
mov dword [edi + 0x5c], eax
call fcn.10039560
mov esi, edi
mov ebp, 5
mov eax, dword [esi]
add esi, 4
mov ecx, eax
mov edx, eax
shr ecx, 0x18
mov byte [ebx], cl
mov ecx, eax
shr edx, 0x10
shr ecx, 8
mov byte [ebx + 1], dl
mov byte [ebx + 2], cl
mov byte [ebx + 3], al
add ebx, 4
dec ebp
jne 0x10039e7e
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.10039530

Function at 0x10039f60
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x18]
and esi, 0xf
mov dword [edi + esi*4 + 0x20], SysStringLen
inc esi
cmp esi, 0xe
je 0x10039f99
and esi, 0xf
jne 0x10039f8b
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.10039560
mov dword [edi + esi*4 + 0x20], 0
inc esi
cmp esi, 0xe
jne 0x10039f7b
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
mov ecx, 5
call fcn.100b92c0
mov dword [edi + 0x58], edx
lea edx, [edi + 0x20]
push ebx
mov ecx, edi
mov dword [edi + 0x5c], eax
call fcn.10039560
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.10039530

Function at 0x10039fd0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 0x20], eax
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x24], eax
ret

Function at 0x1003af89
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 8]
push esi
push eax
xor eax, eax
push eax
mov esi, ecx
push dword [ebp + 8]
push edx
push eax
push eax
call fcn.100b9600
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.1003afb2
pop esi
pop ebp
ret 4
Function at 0x10040b4f
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10040b70
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10040b6b
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10040b55
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10040b5d
cmp edx, ebx
jne 0x10040cab
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10040b2c
add eax, dword [eax + 4]
jmp 0x10040b19
mov dword [ebp + 0xc], ebx
jmp 0x10040b7b
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10040b93
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10040bb1
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10040c0f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10040bf6
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10040bff
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10040c09
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10040beb
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10040b75
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10040c5c
dec eax
je 0x10040c53
sub eax, 3
je 0x10040c4a
mov dword [ebp - 4], 0x40
jmp 0x10040c79
mov dword [ebp - 4], 4
jmp 0x10040c5f
mov dword [ebp - 4], 0x20
jmp 0x10040c5f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10040cab
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10040c2b
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100404bc
or dh, byte [esi + 0x75ff9f02]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x10040cb7
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10046b18
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x10046b74
cmp word [ecx], 0x5a4d
jne 0x10046b74
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x10046b74
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x10046b74
test al, 7
jne 0x10046b74
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10046b74
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x10046b8e
sub ecx, 0x74
je 0x10046b87
dec ecx
dec ecx
je 0x10046b87
dec ecx
dec ecx
je 0x10046b80
sub ecx, 0x3c
je 0x10046b79
sub ecx, 0x8464
je 0x10046b8e
xor eax, eax
ret 4
mov ecx, 0x3030401
jmp 0x10046b93
mov ecx, 0x3030701
jmp 0x10046b93
mov ecx, 0x3030501
jmp 0x10046b93
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x10046b74
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x10046bad
cmp eax, 0x20b
jne 0x10046b74
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x10046b76

Function at 0x1004af0a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x1004af29
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x1004af18
pop edi
cmp esi, 4
jb 0x1004af33
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x1004af44
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x1004af50
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x1004af5a
movzx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x10059e9b
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [ecx + 0x3c]
cmp edx, 2
jge 0x10059eb4
cmp byte [ecx + 0x42], 0
mov eax, dword [esp + 4]
je 0x10059f19
cmp eax, 0x3f
jb 0x10059f19
jmp 0x10059f08
mov eax, dword [esp + 4]
cmp eax, 0x2c
jb 0x10059f19
cmp edx, 3
jl 0x10059ecc
cmp eax, 0x2c
jne 0x10059ecb
push 0x48
jmp 0x10059f18
dec eax
cmp edx, 4
jl 0x10059edb
cmp eax, 0x2c
jne 0x10059eda
push 0x49
jmp 0x10059f18
dec eax
cmp eax, 0x3a
jb 0x10059f19
cmp byte [ecx + 0x14], 0
je 0x10059efa
cmp eax, 0x3a
jne 0x10059eef
push 0x44
jmp 0x10059f18
cmp eax, 0x3b
jne 0x10059ef8
push 0x45
jmp 0x10059f18
dec eax
dec eax
cmp eax, 0x3f
jb 0x10059f11
cmp byte [ecx + 0x42], 0
je 0x10059f11
cmp eax, 0x3f
jne 0x10059f0e
push 0x46
jmp 0x10059f18
dec eax
jmp 0x10059f19
cmp eax, 0x44
jne 0x10059f19
push 0x47
pop eax
ret 4

Function at 0x1005b4ac
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100bf94f
call fcn.100b86e4
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi + 0x24], 0xffffffff
lea ecx, [esi + 0x30]
mov byte [esi], 1
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ebx
call fcn.1000292b
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.100030c9
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1005b70a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100bf9ff
call fcn.100b86e4
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000292b
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.100030c9
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.1005b7ab
lea eax, [esi + 0xb8]
mov dword [eax], edi
mov dword [eax + 4], edi
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 6
call fcn.1000292b
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 7
call fcn.1000292b
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea eax, [esi + 0xfc]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10063d98
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100c048f
call fcn.100b86e4
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10002987
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10063e1b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1006c6dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
mov al, byte [edi + 2]
mov word [esi], bx
cmp byte [edi + 1], bl
mov byte [ebp + 0xf], al
je 0x1006c76e
lea eax, [edi + 0x20]
lea ecx, [esi + 0x24]
push eax
call fcn.10002a44
lea eax, [edi + 0x2c]
lea ecx, [esi + 0x60]
push eax
call fcn.10057713
cmp byte [edi + 4], bl
je 0x1006c72a
or byte [esi + 1], 8
jmp 0x1006c72f
and word [esi], 0xf7ff
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x80], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x84], eax
mov al, byte [edi + 3]
mov byte [esi + 0x88], al
cmp byte [ebp + 0xf], bl
mov byte [esi + 0x41], bl
mov byte [esi + 0x40], 0x3f
mov byte [esi + 5], bl
mov word [esi + 0x42], bx
jne 0x1006c78e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], bl
je 0x1006c78e
or byte [esi], 1
jmp 0x1006c793
and word [esi], 0xfffe
cmp byte [ebp + 8], bl
je 0x1006c79d
or byte [esi], 8
jmp 0x1006c7a2
and word [esi], 0xfff7
cmp byte [ebp + 0xf], bl
je 0x1006c7be
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov byte [esi + 4], 0x14
mov word [esi + 2], bx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebx
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.10069232
mov byte [edi + 0xe], bl
lea edi, [esi + 0x50]
mov ecx, edi
call fcn.10069232
cmp byte [ebp + 0xf], bl
mov byte [edi + 0xe], bl
je 0x1006c7f6
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov byte [esi + 4], 0x14
mov word [esi + 2], bx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebx
jmp 0x1006c822
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], bl
je 0x1006c822
cmp byte [eax + 0x58], bl
je 0x1006c822
cmp dword [eax + 0x64], ebx
jne 0x1006c80d
push 8
pop ecx
jmp 0x1006c813
mov ecx, dword [eax + 0x60]
movzx ecx, byte [ecx]
mov dl, byte [eax + 0x59]
movzx cx, cl
push ecx
mov ecx, esi
call fcn.1006c829
pop edi
pop esi
pop ebx
leave
ret 8