joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100108d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1001092d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x100108f0
mov eax, dword [esi]
jmp 0x10010a0b
cmp eax, 0x4e0
jb 0x10010a0b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10010946
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10010991
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100140c0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
movzx esi, cx
mov eax, 0x5e6ea9af
shr ecx, 0x10
mul dword [ebp + 8]
mov dword [ebp - 0x10], ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, dword [ebp + 8]
mov ebx, edx
sub ebx, eax
mov dword [ebp - 4], ebx
test edi, edi
jne 0x100140fd
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x10014213
xor edx, edx
mov dword [ebp - 8], edx
cmp ebx, 7
jbe 0x10014174
mov eax, 7
sub eax, edi
mov dword [ebp - 0x10], eax
nop dword [eax]
movzx eax, byte [edi]
add edx, 8
add esi, eax
movzx eax, byte [edi + 1]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 2]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 3]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 4]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 5]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 6]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 7]
add ecx, esi
add edi, 8
add esi, eax
mov eax, dword [ebp - 0x10]
add eax, edi
add ecx, esi
cmp eax, ebx
jb 0x10014120
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 8], eax
jae 0x100141d5
sub eax, dword [ebp - 8]
cmp eax, 2
jb 0x100141c8
mov eax, dword [ebp - 8]
mov ecx, ebx
mov edx, dword [ebp - 4]
sub edx, eax
sub edx, 2
shr edx, 1
inc edx
lea eax, [eax + edx*2]
mov dword [ebp - 8], eax
nop
movzx eax, byte [edi]
add esi, eax
movzx eax, byte [edi + 1]
add ebx, esi
add edi, 2
add esi, eax
add ecx, esi
sub edx, 1
jne 0x100141a0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jae 0x100141d0
movzx eax, byte [edi]
add esi, eax
add ecx, esi
inc edi
lea eax, [edx + ebx]
add ecx, eax
mov eax, 0x80078071
mov ebx, 0x15b0
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], ebx
jne 0x10014105
shl ecx, 0x10
pop edi
lea eax, [esi + ecx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014220
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x1001428b
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10090c58]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10090c58]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10090c58]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10090c58]
sub edi, 1
jne 0x10014234
pop edi
test esi, esi
je 0x100142aa
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10090c58]
sub esi, 1
jne 0x10014290
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x1001a3a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x100a9080]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov esi, edx
cmp edi, 0xffffffff
je 0x1001a4b7
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jne 0x1001a3e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001a4b7
mov ebx, 1
nop dword [eax]
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x1001a3fa
mov eax, dword [esi]
push 0x1001a380
push dword [esp + 0x18]
push dword [esi + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
jne 0x1001a4cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov edi, eax
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push eax
push 0x400
push edi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp edi, 0xe8
je 0x1001a4a1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1001a492
push eax
push edi
push ebx
push str.WriteFileEx_failed_on_attempt__i_with_error__u:__s
call fcn.10031cd0
add esp, 0x10
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x1001a46c
mov eax, dword [esi]
push dword [esp + 0x14]
mov edi, dword [esp + 0x14]
push dword [esi + 0x10]
push eax
push edi
push str.Parameters___i____s____i____i_
call fcn.10031cd0
add esp, 0x14
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1001a4a5
push edi
push ebx
push str.WriteFileEx_failed_on_attempt__i_with_error__u
call fcn.10031cd0
add esp, 0xc
mov edi, dword [esp + 0x10]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jle 0x1001a3f0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10055fba
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10055fba
mov esp, ebp
pop ebp
ret
Function at 0x1001b150
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a9080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, dword [ebx]
cmp byte [eax + 4], 0
jne 0x1001b258
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add eax, 8
cmp dword [eax + 0x14], 0xf
jbe 0x1001b182
mov eax, dword [eax]
push 0
push 0
push 0x8000
push 0x8000
push 0xff
push 0
push 0x40000002
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xffffffff
je 0x1001b24a
push 0
push 0
xorps xmm0, xmm0
push 1
push 0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1001b1ff
mov ecx, dword [ebx]
add ecx, 0x20
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x1001b1f3
mov dword [eax], esi
add dword [ecx + 4], 4
jmp 0x1001b245
lea edx, [ebp - 0x1c]
push edx
push eax
call fcn.1001f010
jmp 0x1001b245
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1001b22e
push 0x1f4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1001b1de
push esi
cmp eax, 0x102
jne 0x1001b243
call dword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x1001b242
push 0
push str.Pipe_error
push str.Unhandled_error_in_named_pipe
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call edi
push dword [ebp - 8]
call edi
mov eax, dword [ebx]
cmp byte [eax + 4], 0
je 0x1001b177
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10055fba
mov esp, ebp
pop ebp
ret
Function at 0x10021090
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100815d5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100a9080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.100213d0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10021102
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1002124b
cmp dword [ebx + 8], 0xfffffff
je 0x10021261
lea eax, [ebx + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x28], 0
call fcn.10055fcd
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
mov cx, word [ecx]
mov word [esi + 8], cx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10098050]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10098050]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100211fe
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.10079e60
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1007b900
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100211e0
cmp eax, 0x200
jae 0x100211de
shl eax, 3
cmp eax, ecx
jae 0x100211e0
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10021270
push dword [ebp - 0x20]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100213d0
mov edx, dword [eax]
jmp 0x10021201
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x2c]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x20]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x1002122c
mov dword [ecx + eax*8], esi
jmp 0x1002123e
cmp ebx, edx
jne 0x10021235
mov dword [ecx + eax*8], esi
jmp 0x10021242
mov edx, dword [ebp - 0x1c]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10021242
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100549d6
int3
Function at 0x10021270
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x100213ba
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10009180
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1002138d
movzx edx, byte [eax + 8]
mov ecx, dword [ecx]
xor edx, 0x811c9dc5
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x1002130e
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10021383
mov edx, dword [edx + 4]
movzx ebx, word [eax + 8]
cmp bx, word [edx + 8]
jne 0x1002134a
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10021342
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x10021380
cmp edi, edx
je 0x1002135d
nop
mov edx, dword [edx + 4]
cmp bx, word [edx + 8]
je 0x10021396
cmp edi, edx
jne 0x10021350
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x100212d2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10021380
push str.invalid_hash_bucket_count
call fcn.100549d6
int3

Function at 0x10021450
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [ecx + 4]
add ecx, 0x10
jmp fcn.10020ea0
Function at 0x10022870
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081715
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100a9080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov al, byte [ebx + 8]
lea ecx, [ebp - 0x4c]
mov byte [edi], al
xorps xmm0, xmm0
mov eax, dword [0x100b3920]
push 0x12
push str.alt_all_containers
movups xmmword [ebp - 0x4c], xmm0
mov esi, dword [eax + 8]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
call fcn.10007860
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push 0x10090228
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], 0
call fcn.10007860
lea eax, [ebx + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1000fdc0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x1002295b
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10022951
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10022aa1
push ecx
push edx
call fcn.10056002
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0xf
jbe 0x100229a8
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002299e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10022aa1
push ecx
push edx
call fcn.10056002
add esp, 8
cmp byte [ebx + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x10022a05
lea eax, [ebp - 0x18]
push eax
push 0x40
push 2
push 0x416d1d
call esi
mov eax, 0x416d1d
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 2
push 0x416d1d
call esi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 2
push 0x416d22
call esi
mov eax, 0x416d22
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
jmp 0x10022a5a
lea eax, [ebp - 0x1c]
mov word [ebp - 0x18], 0x7474
push eax
push 0x40
push 2
push 0x416d1d
call esi
movzx eax, word [ebp - 0x18]
mov word [0x416d1d], ax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 2
push 0x416d1d
call esi
lea eax, [ebp - 0x1c]
mov word [ebp - 0x18], 0x6f74
push eax
push 0x40
push 2
push 0x416d22
call esi
movzx eax, word [ebp - 0x18]
mov word [0x416d22], ax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 2
push 0x416d22
call esi
cmp byte [edi], 0
mov ecx, str.disabled
mov eax, str.enabled
cmove eax, ecx
push eax
push str.Tooltips_for_all_containers_while_holding_alt:__s
call fcn.10031c60
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10055fba
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.1005d2a4
int3
Function at 0x10023340
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100a9080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 8]
mov ebx, ecx
push eax
push 0x40
push 1
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [edi]
mov byte [ebx], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10055fba
mov esp, ebp
pop ebp
ret

Function at 0x100236d0
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100a9080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp eax, ecx
je 0x100236f3
mov dword [ebx + 4], eax
mov ecx, eax
mov eax, 0x63d5e0
cmp ecx, dword [ebx + 8]
je 0x10023707
mov eax, dword [eax]
mov dword [ecx], eax
add dword [ebx + 4], 4
jmp 0x10023714
push 0x63d5e0
push ecx
mov ecx, ebx
call fcn.1001f010
cmp dword [ebx + 0xc], 0
mov dword [ebp - 0xc], 0
jle 0x1002385d
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x10], 0
push 0x274
call fcn.10055fcd
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
lea eax, [ebp - 8]
mov dword [ebp - 0x14], esi
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
push eax
mov dword [esi + 0x6c], 0
push 0x40
mov dword [esi + 0x84], 0
mov dword [esi + 0x110], 0
push 0x274
mov dword [esi + 0x144], 0
push esi
mov dword [esi + 0x148], 0
call edi
push 0x274
push 0
push esi
call fcn.10057da0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x274
push esi
call edi
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
je 0x100237c8
mov dword [eax], esi
add dword [ebx + 4], 4
jmp 0x100237d4
lea ecx, [ebp - 0x14]
push ecx
push eax
mov ecx, ebx
call fcn.1001f010
push 0
mov ecx, esi
mov eax, 0x423331
call eax
push 0x10c
call fcn.10055fcd
add esp, 4
mov edi, eax
push 0x10c
push 0
push edi
call fcn.10057da0
mov edx, dword [esi]
add esp, 8
mov ecx, edi
push 0x10c
call fcn.10037ff0
add esp, 8
mov dword [esi], edi
mov edx, 0x10c
mov ecx, edi
call fcn.10037f00
mov eax, dword [esi]
mov edi, dword [ebp - 0x10]
mov dword [eax + 4], 0x100236c0
lea eax, [edi + 0x14]
add dword [esi + 0x34], eax
lea eax, [edi + 0x14]
add dword [esi + 0x30], eax
lea eax, [edi + 0x14]
add dword [esi + 0x3c], eax
lea eax, [edi + 0x14]
add dword [esi + 0x38], eax
add edi, 0x14
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 0xc]
jl 0x10023732
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10055fba
mov esp, ebp
pop ebp
ret
Function at 0x10025070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100a9080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, ecx
je 0x100251b4
mov ecx, dword [0x7f94e0]
test ecx, ecx
je 0x100251b4
mov edx, dword [ecx + 0x84]
test edx, edx
je 0x100251b4
mov eax, dword [0x63d6c0]
cmp eax, dword [edx]
jne 0x100251b4
mov eax, dword [ecx + 0x88]
test eax, eax
je 0x100250cf
cmp word [eax + 0x9e], 0
jne 0x100251b4
mov al, byte [ecx + 0xb1]
cmp al, 0x64
je 0x100250e1
cmp al, 0x6f
jne 0x100251b4
cmp byte [edi + 8], 0
jne 0x10025130
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 7
push 0x53f424
call esi
mov ecx, 0x53f424
mov eax, dword [ecx]
mov dword [edi + 8], eax
mov ax, word [ecx + 4]
mov word [edi + 0xc], ax
mov al, byte [ecx + 6]
mov ecx, 0x90909090
mov byte [edi + 0xe], al
mov eax, 0x53f424
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x10025168
cmp byte [0x53f424], 0x90
je 0x10025171
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push 0x53f424
call esi
mov eax, 0x53f424
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push 0x53f424
call esi
cmp dword [ebp + 8], 2
mov eax, dword [0x100a9b1c]
jne 0x10025198
mov dword [edi + 4], 2
pop edi
mov byte [eax], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10055fba
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 4], 1
pop edi
mov byte [eax], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10055fba
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x100a9b1c]
mov dword [edi + 4], 0
mov byte [eax], 0
mov eax, dword [0x100a9b18]
mov dword [eax], 0
cmp byte [edi + 8], 0
je 0x1002520d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push 0x53f424
call esi
mov eax, dword [edi + 8]
mov ecx, 0x53f424
mov dword [ecx], eax
mov ax, word [edi + 0xc]
mov word [ecx + 4], ax
mov al, byte [edi + 0xe]
mov byte [ecx + 6], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push ecx
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10055fba
mov esp, ebp
pop ebp
ret 4