joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a5370
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100a5501
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x100a5501
mov eax, dword [0x101935b8]
cmp dword [eax + 0x174], 0xffffffff
je 0x100a5501
mov eax, dword [0x101938a0]
add eax, 0xffffff92
xor eax, 0x18cdb80e
cmp dword [eax + ebx], 0
mov eax, dword [0x10193868]
setle cl
add eax, 0xffffffa0
xor eax, 0x18cdb800
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x1019385c]
add eax, 0xffffffa3
xor eax, 0x18cdb7fd
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x10193860]
add eax, 0xffffffa2
xor eax, 0x18cdb7fe
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x10193864]
lea eax, [ecx - 0x5f]
xor eax, 0x18cdb7ff
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x100a545e
lea eax, [ecx - 0x5f]
xor eax, 0x18cdb7ff
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x100a5456
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100a544a
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x100a5447
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x10193864]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x100a5413
lea eax, [ecx - 0x5f]
xor eax, 0x18cdb7ff
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x101935cc]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x100a54f2
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x100a54b6
xor edx, edx
test ecx, ecx
je 0x100a54dc
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100a54c3
cmp edi, 0x79705c5e
je 0x100a54e7
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x100a54f2
mov ecx, dword [ebp - 4]
jmp 0x100a54a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x100a54f4
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x101936c8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100ab230
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
mov edx, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x10
movzx eax, al
sar edx, 0x18
xor ecx, eax
movzx eax, dl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 0x20d4]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100b4590
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x100ab2a1
mov ecx, dword [edi + 0x20d8]
cmp ecx, dword [edi + 0x20d8]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
je 0x100ab2d5
add ecx, 0xc
push 1
push ecx
mov ecx, esi
call fcn.10028190
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push 0x100c70d6
mov ecx, esi
call fcn.10028190
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b43a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c3555
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100dc380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100b4590
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100b442a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100b4572
cmp dword [ebx + 8], 0xfffffff
jne 0x100b443e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100b770c
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d1580]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100d1580]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100b4525
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100b9500
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100b4507
cmp eax, 0x200
jae 0x100b4505
shl eax, 3
cmp eax, ecx
jae 0x100b4507
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10071d80
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100b4590
mov edx, dword [eax]
jmp 0x100b4528
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100b4553
mov dword [ecx + eax*8], esi
jmp 0x100b4565
cmp ebx, edx
jne 0x100b455c
mov dword [ecx + eax*8], esi
jmp 0x100b4569
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100b4569
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b5390
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100dc380]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x100b550c
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100b54f9
cmp dword [ebp - 0x28], 0x10
jb 0x100b54dd
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.100b81d5
cmp dword [ebp - 0x1c], eax
jne 0x100b54dd
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.100b81d5
cmp dword [ebp - 0x20], eax
je 0x100b54dd
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100b5464
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x101034f4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.100b81d5
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100b5462
jmp 0x100b54f9
jmp 0x100b54bd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x100b54bd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x101034f4]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.100b81d5
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100b54a7
jmp 0x100b54f9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x28], 0x1c
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100b53e3
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100b81d5
push edx
mov ecx, ebp
push eax
lea edx, [0x100b5538]
call fcn.100b8181
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b76f0
add esp, 0x30
cmp ebp, esp
call fcn.100b81d5
mov esp, ebp
pop ebp
ret
Function at 0x100b5550
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100b5390
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100b561b
mov dword [ebp - 4], 0
jmp 0x100b55ac
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x100b561b
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100b81d5
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100b5619
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100b81d5
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100b51b0
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100b81d5
jmp 0x100b55a3
pop esi
add esp, 8
cmp ebp, esp
call fcn.100b81d5
mov esp, ebp
pop ebp
ret

Function at 0x100b5630
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100b56db
mov dword [ebp - 4], 0
jmp 0x100b5663
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100b56be
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100b81d5
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100b56bc
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100b81d5
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100b81d5
jmp 0x100b565a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x101034f4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100b81d5
pop esi
add esp, 8
cmp ebp, esp
call fcn.100b81d5
mov esp, ebp
pop ebp
ret
Function at 0x100b56f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x101965b0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100b5753
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100b81d5
test eax, eax
jne 0x100b577e
mov eax, 0xa
jmp 0x100b5880
cmp dword [ebp + 0xc], 0
je 0x100b57ca
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x100b57c8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x100b5806
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100b57f1
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x100b5806
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100b81d5
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100b81d5
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100b81d5
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x100b58a4]
call fcn.100b8181
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100b81d5
mov esp, ebp
pop ebp
ret
Function at 0x100b5f70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x101965a8]
mov dword [ebp - 4], eax
jmp 0x100b5f97
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100b5fb0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100b5fae
mov eax, dword [ebp - 4]
jmp 0x100b6034
jmp 0x100b5f8f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100b81d5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100b6031
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100b5ff3
mov edx, dword [ebp - 4]
mov eax, dword [0x101965a8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x101965a8], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100b81d5
mov esp, ebp
pop ebp
ret

Function at 0x100b6520
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100b6570
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100b6570
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100b6570
xor eax, eax
jmp 0x100b65b1
mov dword [ebp - 4], 1
jmp 0x100b6582
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100b65ac
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100b65aa
xor eax, eax
jmp 0x100b65b1
jmp 0x100b6579
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10001020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1009b200]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0xdbce9f8b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
sub eax, 0xdbce9f8b
je 0x10001072
jmp 0x1000105a
mov eax, dword [ebp - 0x1c]
sub eax, 0xf0178d63
je 0x100010a9
jmp 0x1000106d
jmp 0x100010b9
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push eax
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [edx], eax
xor ecx, ecx
xor edi, edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [edx]
not byte [edi]
xor eax, eax
xor eax, 0x55
sub byte [edi], 0x84
add byte [edi], 0x67
nop
nop
imul byte [edi]
inc edi
loop 0x10001089
mov dword [ebp - 0x10], 0xf0178d63
jmp 0x100010b9
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10010c40
lea esp, [ebp - 4]
pop edi
pop ebp
ret
jmp 0x10001044
Function at 0x10014545
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10014584
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10014584
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10014584
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10014584
cmp dword [ecx + 0x74], 0xe
jbe 0x10014584
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001729a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10017337
push ebx
push esi
call fcn.10017263
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100171f7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100172e4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10017336
push edi
push eax
call fcn.10018255
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10017304
call fcn.10015dc1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10017335
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100171f7
add esp, 0x20
test eax, eax
jne 0x10017323
push edi
call fcn.10015dc1
jmp 0x1001732b
push ebx
call fcn.10015dc1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100175a4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f348
push 0x1001f340
push str.FlsAlloc
push 0x1f
call fcn.100174c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100175d8
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d150]
call esi
jmp 0x100175de
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10017622
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f358
push 0x1001f350
push str.FlsGetValue
push 0x21
call fcn.100174c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017659
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10017661
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f360
push 0x1001f358
push str.FlsSetValue
push 0x22
call fcn.100174c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001769b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001d150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001cbc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001cbed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001cbed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x43b655
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov eax, dword [esp]
add esp, 4
sub edx, edi
add edx, edx
push edi
pop edx
call fcn.0043b693
add edi, 0x7bf1cbb
xor dword [ebx], eax
add edx, 0x49eb1d31
inc ebx
add edx, 0x56bc7997
or edx, edi
or edx, edi
cmp ebx, esi
jne fcn.0043b655
add edx, 0x97b1f38a
push edx
pop edi
ret