joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c4b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44daa0]
jne 0x425c55
repz ret
jmp fcn.0042b2ac

Function at 0x43447c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00429b6b
and dword [ebp - 4], 0
cmp dword [0x4507f0], 0
mov ebx, eax
jne 0x43452d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4345de
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4345de
push eax
call fcn.00429af9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4507f0], eax
call esi
push eax
call fcn.00429af9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4507f4], eax
call esi
push eax
call fcn.00429af9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4507f8], eax
call esi
push eax
call fcn.00429af9
pop ecx
mov dword [0x450800], eax
test eax, eax
je 0x43452d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00429af9
pop ecx
mov dword [0x4507fc], eax
mov eax, dword [0x4507fc]
cmp eax, ebx
je 0x434585
cmp dword [0x450800], ebx
je 0x434585
push eax
call fcn.00429b74
push dword [0x450800]
mov esi, eax
call fcn.00429b74
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x434585
test edi, edi
je 0x434585
call esi
test eax, eax
je 0x43457c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43457c
test byte [ebp - 0xc], 1
jne 0x434585
or dword [ebp + 0x10], 0x200000
jmp 0x4345be
mov eax, dword [0x4507f4]
cmp eax, ebx
je 0x4345be
push eax
call fcn.00429b74
pop ecx
test eax, eax
je 0x4345be
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4345be
mov eax, dword [0x4507f8]
cmp eax, ebx
je 0x4345be
push eax
call fcn.00429b74
pop ecx
test eax, eax
je 0x4345be
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4507f0]
call fcn.00429b74
pop ecx
test eax, eax
je 0x4345de
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4345e0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000864f
pop dword [ebp - 0x4c]
mov eax, 0x72afae6c
add eax, 0x9d50d7e3
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xf657c6a2
sub dword [ebp - 0x5c], 0xa8058157
mov dword [ebp - 0x58], 0x4980198f
add dword [ebp - 0x58], 0xe8b332b6
mov dword [ebp - 0x54], 0x15775b0f
add dword [ebp - 0x54], 0x36d4e91f
mov dword [ebp - 0x50], 0x23387bb6
add dword [ebp - 0x50], 0xdcc7844a
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xbfa91b2d
add eax, 0x50582523
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9316ea5
add dword [ebp - 0x5c], 0x6b40fab1
mov dword [ebp - 0x58], 0x7ab28ff7
add dword [ebp - 0x58], 0xc6b9d17e
mov dword [ebp - 0x54], 0x99574d14
sub dword [ebp - 0x54], 0x35e7e0a8
mov dword [ebp - 0x50], 0xca290b8d
add dword [ebp - 0x50], 0x35d6f473
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x462f0f4e
add eax, 0xc9d23106
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x378b1
push 0
call eax
mov ecx, 0x966c4ae3
add ecx, 0x6993f350
xor edx, edx
add edx, eax
mov ebx, 0xf3be8d3b
sub ebx, 0xe3bcab3b
add ebx, dword [ebp - 0x4c]
mov esi, 0x27b544c6
xor dword [ebp - 0x10], 0xc50fb0d9
mov edi, dword [ebx]
add dword [ebp - 0x30], 0x332a9ab
xor edi, esi
mov dword [ebp - 0x10], 0x469831a2
mov dword [edx], edi
xor dword [ebp - 0x34], 0xa1dab029
add edx, 4
add ebx, 0xc00742a
add ebx, 0xf3ff8bda
loop 0x1000876d
add eax, 0x5c4b7d13
sub eax, 0x5c4a9174
xor ebx, ebx
add ebx, eax
add eax, 0x2193e8b5
add eax, 0xde6c1750
mov ecx, 0xa92a47f5
sub ecx, 0x992a47f5
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40359e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4035ad
pop dword [ebp - 0x4c]
mov eax, 0x9cda8c3
sub eax, 0x98d7316
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x4aafd99
sub dword [ebp - 0x5c], 0xb658b84e
mov dword [ebp - 0x58], 0xdd63164b
add dword [ebp - 0x58], 0x54d035fa
mov dword [ebp - 0x54], 0xbc232de0
add dword [ebp - 0x54], 0x9029164e
mov dword [ebp - 0x50], 0xc79ca3b2
sub dword [ebp - 0x50], 0xc79ca3b2
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xf828bcc9
add dword [ebp - 0x5c], 0x7c49ac8d
mov dword [ebp - 0x58], 0x83c8f500
add dword [ebp - 0x58], 0xbda36c75
mov dword [ebp - 0x54], 0x351d77a4
sub dword [ebp - 0x54], 0xd1ae0b38
mov dword [ebp - 0x50], 0x9fec2e83
sub dword [ebp - 0x50], 0x9fec2e83
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38b36
push 0
call eax
mov ecx, 0x4bea
mov ebx, eax
mov edx, 0x2d7cedef
add edx, 0xd2c3da11
add edx, dword [ebp - 0x4c]
mov edi, 0x3c64f688
sub edi, 0x2692156
mov dword [ebp - 0x48], 0x7da78da3
mov esi, dword [edx]
mov dword [ebp - 0x28], 0x33e5a818
sub esi, edi
mov dword [ebp - 0x38], 0x479affe4
mov dword [ebx], esi
xor dword [ebp - 0x48], 0x4ab64819
add ebx, 4
add edx, 0xc014a8ab
sub edx, 0xc014a8a7
loop 0x4036bf
add eax, 0xad4340c5
sub eax, 0xad421e4a
mov ebx, eax
add eax, 0x238ddb86
sub eax, 0x238ddb81
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4045f7
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x406af3
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404616
mov al, 1
jmp 0x4046e2
test esi, esi
je 0x4046e0
xor ebx, ebx
cmp word [esi], bx
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x4046e0
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040359e
pop ecx
pop ecx
mov esi, dword [0x40a010]
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4046d1
lea eax, [ebp - 0x28]
push eax
call fcn.0040359e
pop ecx
test al, al
jne 0x4046d1
cmp dword [ebp - 0x18], esi
jbe 0x4046d1
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4046d1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x4046d1
push 0x4075c8
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
movzx ebx, bl
pop ecx
pop ecx
cmovne ebx, edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.0040359e
mov al, bl
jmp 0x4046e2
xor al, al
call fcn.004054b6
ret
Function at 0x60a9c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x60a9c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x60a9c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x60a9c06a
add dl, dl
jne 0x60a9c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x60a9c0dc
xor eax, eax
add dl, dl
jne 0x60a9c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x60a9c17d
add dl, dl
jne 0x60a9c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x60a9c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x60a9c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x60a9c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x60a9c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x60a9c075
mov eax, 1
add dl, dl
jne 0x60a9c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x60a9c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x60a9c0e1
sub eax, ebx
mov ebx, 1
jne 0x60a9c128
mov ecx, 1
add dl, dl
jne 0x60a9c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x60a9c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x60a9c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x60a9c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x60a9c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x60a9c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x60a9c136
cmp eax, 0x7d00
jae 0x60a9c16d
cmp eax, 0x500
jb 0x60a9c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x60a9c075
cmp eax, 0x7f
ja 0x60a9c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x60a9c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x60a9c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x60a9c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10020c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a66b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.1009b4b4
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10022580
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10020cc4
jmp dword [ecx*4 + 0x10020e2c]
mov al, byte [esi]
test al, al
je 0x10020cf2
cmp al, 0x20
je 0x10020cde
cmp al, 0xa1
jne 0x10020cf2
cmp byte [esi + 1], al
jne 0x10020cf2
test al, 0x80
je 0x10020cea
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10020cf2
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10020cd1
test ecx, ecx
je case.default.0x10020cc4
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10020cc4
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x10020d38
cmp dl, 0xa1
jne 0x10020d2c
cmp byte [eax + 1], 0xa1
jne 0x10020d2c
test ecx, ecx
jne 0x10020d24
mov edi, eax
mov ecx, 1
inc eax
jmp 0x10020d4c
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x10020d66
jmp 0x10020d4c
cmp dl, 0x20
jne 0x10020d4a
test ecx, ecx
jne 0x10020d43
mov edi, eax
mov ecx, 1
jmp 0x10020d4c
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x10020d0c
cmp ecx, 1
jne case.default.0x10020cc4
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10020cc4
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10020cc4
mov al, byte [esi]
test al, al
je 0x10020dbe
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10020da4
mov cl, byte [esi + 1]
test cl, cl
je 0x10020dbe
cmp al, 0xa1
jne 0x10020d94
cmp cl, al
je 0x10020da1
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10022850
inc esi
jmp 0x10020db6
cmp al, 0x20
je 0x10020db6
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10022890
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10020d7d
push 0
lea ecx, [esp + 0x14]
call fcn.10022890
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10036180
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x10020df1
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x100f32d8
call fcn.10022780
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1009b446
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x100321a0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100a7948
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.1009c9f7
xor ebp, ebp
mov dword [esi], 0x100f57e4
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
lea edi, [esi + 0x44]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x18]
mov dword [edi], 0x100f4b04
call fcn.10022580
lea ecx, [edi + 0x30]
mov byte [esp + 0x38], 1
call fcn.1009a528
lea ebx, [edi + 0x44]
mov ecx, ebx
call fcn.10022580
mov dword [ebx], 0x100f53b4
mov dword [edi], 0x100f56fc
mov dword [esi + 0xa0], ebp
mov dword [esi + 0x9c], 0x100f4c90
lea ecx, [esi + 0xb0]
call fcn.10022580
lea edi, [esi + 0xc8]
mov dword [edi + 4], ebp
mov dword [edi], 0x100f57d8
mov byte [esp + 0x38], 5
mov dword [esi], 0x100f5704
mov dword [esi + 0xac], ebp
call fcn.100a50b0
mov eax, dword [eax + 0xc]
push 0x40e
push eax
call dword [0x100ac504]
push eax
mov ecx, edi
call fcn.100a20a7
mov ecx, dword [esi + 0xcc]
lea eax, [esp + 0x18]
push eax
push 0x18
push ecx
call dword [0x100ac0a8]
mov ecx, dword [esp + 0x1c]
mov eax, 0x55555556
imul ecx
mov ecx, dword [esp + 0x20]
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 0xd4], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xd0], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x10032350
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100a79d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x100f5704
mov dword [esp + 0x18], 0
lea ecx, [esi + 0xc8]
mov dword [esp + 0xc], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x18], 4
call fcn.100a20fe
lea ecx, [esi + 0xb0]
mov byte [esp + 0x18], 2
mov dword [ecx], 0x100f4af8
call fcn.10022780
lea ecx, [esi + 0x9c]
mov dword [esp + 0xc], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x18], 5
call fcn.100a20fe
lea edi, [esi + 0x44]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 7
mov dword [ecx], 0x100f4af8
call fcn.10022780
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 6
call fcn.1009a55b
lea ecx, [edi + 0x18]
mov byte [esp + 0x18], 0
mov dword [ecx], 0x100f4af8
call fcn.10022780
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.100a34fa
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100438c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x10129fb8]
xor edx, edx
cmp eax, edx
jne 0x100438e6
xor eax, eax
mov byte [eax + 0x10129eb8], al
inc eax
cmp eax, 0x100
jl 0x100438ce
mov dword [0x10129fb8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x10129eb8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x10043977
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x1004394a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x10043918
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x100439f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x10043a43
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x10043a2a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004aa70
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x1004ac08
cmp ebp, ebx
jle 0x1004ac08
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x1004aace
dec eax
or eax, 0xfffffff8
inc eax
je 0x1004aad5
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x1004aae4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x1004aaeb
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.1009b187
add esp, 4
cmp eax, ebx
je 0x1004ab0c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.1009b187
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x1004abfe
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x1004abe5
mov al, byte [edx]
cmp al, 0xc0
jbe 0x1004abd1
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x1004abc6
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x1004abd4
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x1004abd4
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x1004ab70
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x1004ab61
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x1004df60
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a8f88
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x1004df99
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.100a2b4e
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.100a2b9a
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.1004e020
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.100a2bd7
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
Function at 0x10052680
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100a97b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x74]
push edi
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.10053200
lea edx, [esp + 0x18]
push eax
push edx
call dword [0x100ac500]
mov eax, dword [esp + 0x18]
xor edi, edi
xor ecx, ecx
cmp eax, edi
setl cl
dec ecx
xor edx, edx
and ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x18], ecx
setl dl
dec edx
and edx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], edx
call dword [0x100ac438]
test eax, eax
je 0x10052729
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, eax
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.10052310
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call dword [0x100ac604]
push edi
lea ecx, [esp + 0x4c]
call fcn.100a1dff
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], edi
call fcn.100691c0
mov edx, dword [esp + 0x5c]
add esp, 0xc
lea ecx, [esp + 0x18]
push 2
push ecx
push edx
call dword [0x100ac0f0]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [0x100ac40c]
lea edx, [esp + 0x38]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [0x100ac5f8]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0x64], 0xffffffff
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x48]
call fcn.100a1e71
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14