joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100711d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1008b018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
push 0x24
mov dword [ebp - 0x14], edi
mov eax, dword [ebx]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1004a7bc
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push ecx
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
call fcn.1003f0b0
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 4], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 8], ecx
mov ecx, dword [edi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0xc], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x10], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x1c], 8
mov dword [edi + 0x1c], eax
add edi, 0x20
mov dword [ebp - 4], 2
mov eax, dword [ebx + 0x20]
push 0x30
mov dword [ebp + 8], edi
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1004a7bc
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push ecx
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 4
call fcn.1003f0b0
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 0x24]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x24], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov dword [ebx + 0x28], ecx
mov ecx, dword [edi + 0xc]
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x30], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x3c], 8
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10040340
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov al, byte [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push esi
push edi
mov dword [ebx + 8], 0
lea edx, [ecx*8]
mov dword [ebx], edx
mov byte [ebx + 0x10], al
mov dword [ebx + 4], edx
test al, al
je 0x1004045e
test ecx, ecx
je 0x1004044c
cmp ecx, 0x100
jae 0x10040391
mov dword [ebx + 4], 0x800
lea eax, [ebx + 0x11]
jmp 0x10040431
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp + 0x10], ecx
cmp ecx, edx
je 0x10040404
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10040404
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x6d786ed4
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x100403fd
nop word [eax + eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x100403e0
cmp esi, 0xf2630820
je 0x10040408
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x100403c5
mov eax, dword [eax]
jmp 0x100403a0
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
push dword [ebp + 0xc]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ebx, dword [ebp - 8]
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
push dword [ebp + 8]
mov dword [ebx + 0xc], eax
push eax
call fcn.1004c220
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebx + 0xc], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
pop edi
mov dword [ebx + 0xc], eax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10040470
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100712e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1008b018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x18], eax
cmp byte [eax + 0x10], 0
je 0x1004054e
cmp dword [eax + 4], 0x800
jle 0x1004054e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x14], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x10], ecx
cmp ecx, edx
je 0x10040524
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10040524
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x1d18ec86
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x1004051d
nop word [eax + eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x10040500
cmp esi, 0x4268f384
je 0x10040528
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x100404e5
mov eax, dword [eax]
jmp 0x100404c0
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + edx]
add eax, edx
push dword [ecx + 0xc]
call eax
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10040720
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
push ebx
push esi
push edi
test edx, edx
jle 0x1004086d
mov eax, dword [ecx + 8]
add eax, edx
cmp eax, dword [ecx]
jg 0x1004086d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 8], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 4], ecx
cmp ecx, edx
je 0x100407b4
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x100407b4
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0xd7279b60
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x100407ad
nop word [eax + eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x10040790
cmp esi, 0xc73e4087
je 0x100407b8
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x10040775
mov eax, dword [eax]
jmp 0x10040750
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
mov edi, dword [ebp + 0xc]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
mov esi, dword [ebp + 8]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
lea eax, [edi + 7]
sar eax, 3
add ecx, edx
push eax
push 0
push esi
call ecx
mov ebx, dword [ebp - 0xc]
mov eax, 8
add esp, 0xc
mov edx, dword [ebx + 8]
mov ecx, edx
and ecx, 7
sub eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0xc]
sar edx, 3
mov dl, byte [edx + eax]
shl dl, cl
or dl, byte [esi]
mov byte [esi], dl
mov al, dl
test ecx, ecx
je 0x10040830
cmp edi, dword [ebp + 8]
jle 0x10040830
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
sar ecx, 3
mov al, byte [ecx + eax + 1]
mov cl, byte [ebp + 8]
shr al, cl
or al, dl
mov byte [esi], al
mov edx, edi
lea ecx, [edx - 8]
mov dword [ebp + 0xc], ecx
test ecx, ecx
jns 0x10040850
cmp byte [ebp + 0x10], 0
je 0x1004084b
neg cl
shr al, cl
mov ecx, dword [ebp + 0xc]
mov byte [esi], al
add dword [ebx + 8], edx
jmp 0x10040854
add dword [ebx + 8], 8
mov edx, dword [ebx + 8]
inc esi
mov edi, dword [ebp + 0xc]
test ecx, ecx
mov ecx, dword [ebp - 0xc]
jg 0x10040800
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10040d50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x1012b068], 0
push ebx
push esi
push edi
jne 0x10040e01
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [esp + 0x14], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [esp + 0x10], ecx
cmp ecx, esi
je 0x10040dd9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10040dd9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x1859a67
mov cl, byte [edx]
inc edx
test cl, cl
je 0x10040dd2
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x10040db5
cmp esi, 0x5d66bd39
je 0x10040ddd
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x10040da0
mov eax, dword [eax]
jmp 0x10040d75
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push str.ws2_32.dll
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1012a3d4]
mov byte [0x1012b068], 1
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1012b080]
cmp eax, dword [ecx + 4]
jle 0x10040ef5
push 0x1012b080
call fcn.1004af39
add esp, 4
cmp dword [0x1012b080], 0xffffffff
jne 0x10040ef5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov edx, dword [eax + 0x18]
mov dword [esp + 0x10], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [esp + 0x14], ecx
cmp ecx, edx
je 0x10040eb4
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10040eb4
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x2af843c4
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x10040ead
nop dword [eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x10040e90
cmp esi, 0x24a08ccf
je 0x10040eb8
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x10040e77
mov eax, dword [eax]
jmp 0x10040e50
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x3039
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
cmp eax, 0x3039
push 0x1012b080
sete byte [0x1012b084]
call fcn.1004aee8
add esp, 4
mov al, byte [0x1012b084]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100423f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071441
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1008b018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1012a3d4]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1012b098]
cmp eax, dword [edx + 4]
jle 0x10042526
push 0x1012b098
call fcn.1004af39
add esp, 4
cmp dword [0x1012b098], 0xffffffff
jne 0x10042526
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x14], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x10], ecx
cmp ecx, edx
je 0x100424d4
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x100424d4
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0xc2b9b057
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x100424cd
nop word [eax + eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x100424b0
cmp esi, 0xeede40c2
je 0x100424d8
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x10042495
mov eax, dword [eax]
jmp 0x10042470
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
push str.samp.dll
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
push 0x1012b098
mov dword [0x1012b09c], eax
call fcn.1004aee8
mov eax, dword [0x1012b09c]
add esp, 4
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1012b09c]
add eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042770
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1008b018]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], 0x40
push ebx
push esi
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [esp + 0x10], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [esp + 0xc], ecx
cmp ecx, esi
je 0x10042809
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10042809
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x19815e33
mov cl, byte [edx]
inc edx
test cl, cl
je 0x10042802
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x100427e5
cmp esi, 0xac7795dd
je 0x1004280d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x100427d0
mov eax, dword [eax]
jmp 0x100427a2
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [esp + 0x18]
push ecx
push 0x40
push 4
add eax, edx
push ebx
call eax
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax + eax]
mov edx, dword [eax + 0x18]
mov dword [esp + 0xc], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [esp + 0x10], ecx
cmp ecx, edx
je 0x100428b4
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x100428b4
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x2a85f624
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x100428ad
nop dword [eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x10042890
cmp esi, 0xbc0d3196
je 0x100428b8
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x10042877
mov eax, dword [eax]
jmp 0x10042850
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [esp + 0x18]
push ecx
push dword [esp + 0x1c]
add eax, edx
push 4
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004a7ae
mov esp, ebp
pop ebp
ret 8
Function at 0x10049a10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov edx, dword [0x1012a3d4]
push ebx
push esi
mov ebx, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x1012b094]
push edi
mov dword [ebp - 0xc], ebx
cmp eax, dword [edx + 4]
jle 0x10049b10
push 0x1012b094
call fcn.1004af39
add esp, 4
cmp dword [0x1012b094], 0xffffffff
jne 0x10049b10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 8], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 4], ecx
cmp ecx, edx
je 0x10049ac9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10049ac9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0xa9439ddc
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x10049ac2
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x10049aa5
cmp esi, 0xe45f89a5
je 0x10049acd
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x10049a90
mov eax, dword [eax]
jmp 0x10049a64
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
push str.samp.dll
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
push 0x1012b094
mov dword [0x1012b090], eax
call fcn.1004aee8
mov eax, dword [0x1012b090]
add esp, 4
add eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1012b090]
pop edi
pop esi
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10050162
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1004b8f0
mov eax, dword [0x1008b018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1005e760
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100501a4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10050300
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1006c520
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1012a820]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1005e96f
mov ecx, dword [esi*4 + 0x1012a820]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x100502f9
cmp eax, dword [ecx + edi + 0x24]
jne 0x100502f9
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100502f9
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1005e96f
add esp, 0x14
test edx, edx
jl 0x100502f9
jg 0x1005026f
test eax, eax
jb 0x100502f9
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100502f9
jl 0x10050289
cmp dword [ebp - 0x1008], eax
ja 0x100502f9
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100502a7
test ebx, ebx
je 0x100502e0
cmp ecx, edi
jae 0x100502e0
mov al, byte [ecx]
cmp al, 0xd
jne 0x100502c1
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100502cd
cmp byte [ecx + 1], 0xa
jne 0x100502cd
inc ecx
jmp 0x100502cd
movzx eax, al
movsx eax, byte [eax + 0x1008b278]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100502a7
cmp edx, ebx
jne 0x100502a7
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100502fe
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1004a7ae
leave
ret

Function at 0x1005accc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1005ad0b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1005ad0b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005ad0b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1005ad0b
cmp dword [ecx + 0x74], 0xe
jbe 0x1005ad0b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1005bd49
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100759b0
push 0x100759a8
push str.FlsAlloc
push 0x1f
call fcn.1005bc11
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005bd7d
push dword [ebp + 8]
mov ecx, esi
call dword [0x100721d8]
call esi
jmp 0x1005bd83
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1005bdc7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100759c0
push 0x100759b8
push str.FlsGetValue
push 0x21
call fcn.1005bc11
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005bdfe
push dword [ebp + 8]
mov ecx, esi
call dword [0x100721d8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1005be06
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100759c8
push 0x100759c0
push str.FlsSetValue
push 0x22
call fcn.1005bc11
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005be40
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100721d8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]