joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10008c10
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov eax, dword [ecx + 0x18]
lock dec dword [eax]
jne 0x1000246e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
add eax, 0x18
push eax
call fcn.1000d190
add esp, 4
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x10002486
push 1
push eax
push dword [ebx + 0x1c]
call fcn.10017710
add esp, 0xc
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x1000249b
push 1
push eax
push dword [ebx + 0x28]
call fcn.10017710
add esp, 0xc
mov esi, dword [ebx + 0x3c]
test esi, esi
je 0x100024e4
mov edi, dword [ebx + 0x34]
shl esi, 4
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x100024ce
nop word cs:[eax + eax]
nop dword [eax + eax]
add edi, 0x10
add esi, 0xfffffff0
je 0x100024e4
mov eax, dword [edi]
test eax, eax
je 0x100024c0
push 1
push eax
push dword [edi - 4]
call fcn.10017710
add esp, 0xc
add edi, 0x10
add esi, 0xfffffff0
jne 0x100024c8
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x100024fe
shl eax, 4
je 0x100024fe
push 4
push eax
push dword [ebx + 0x34]
call fcn.10017710
add esp, 0xc
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x10002558
mov esi, dword [ebx + 0x40]
shl eax, 3
lea edi, [eax + eax*2]
add esi, 0x10
mov eax, dword [esi - 0xc]
test eax, eax
jne 0x1000252f
jmp 0x1000253d
add esi, 0x18
add edi, 0xffffffe8
je 0x10002558
mov eax, dword [esi - 0xc]
test eax, eax
je 0x1000253d
push 1
push eax
push dword [esi - 0x10]
call fcn.10017710
add esp, 0xc
mov eax, dword [esi - 4]
test eax, eax
je 0x10002520
mov ecx, dword [esi]
test ecx, ecx
je 0x10002520
push 1
push ecx
push eax
call fcn.10017710
add esp, 0xc
jmp 0x10002520
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x10002577
shl eax, 3
lea eax, [eax + eax*2]
test eax, eax
je 0x10002577
push 4
push eax
push dword [ebx + 0x40]
call fcn.10017710
add esp, 0xc
cmp byte [ebx + 0x78], 2
je 0x100025c6
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x10002592
push 1
push eax
push dword [ebx + 0x50]
call fcn.10017710
add esp, 0xc
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x100025ac
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x100025ac
push 1
push ecx
push eax
call fcn.10017710
add esp, 0xc
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x100025c6
mov ecx, dword [ebx + 0x70]
test ecx, ecx
je 0x100025c6
push 1
push ecx
push eax
call fcn.10017710
add esp, 0xc
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x100025e5
lock dec dword [eax]
jne 0x100025e5
add ebx, 0x7c
mov dword [ebp - 0x10], 0xffffffff
push ebx
call fcn.1000cd60
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000dbb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x1000eb80
lea ebx, [esi + 4]
mov eax, dword fs:[0]
mov dword [esi + 0x38], eax
lea eax, [esi + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
push dword [eax + 8]
push dword [eax]
push ebx
call fcn.100cf730
add esp, 0xc
mov eax, dword [esi + 0xc]
movsd xmm0, qword [esi + 4]
lea edi, [esi + 0x10]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x24]
movsd qword [esi + 0x10], xmm0
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], 0
push edi
push eax
call fcn.10013060
add esp, 8
mov eax, dword [esi + 0x24]
mov dword [esi + 4], 0
push ebx
push dword [ebp + 0x14]
push 0
mov dword [esi], eax
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
call sub.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
je 0x1000dc95
mov dword [esi + 0x40], 0
push eax
push edi
call fcn.100c5160
add esp, 8
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 8], ecx
mov dword [edi + 4], eax
mov dword [edi], 1
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1000dc82
add eax, eax
je 0x1000dc82
push 2
push eax
push dword [esi]
call fcn.10017710
add esp, 0xc
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov dword [edi + 4], eax
mov dword [edi], 0
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x1000dc71
jmp 0x1000dc82
Function at 0x1000dcd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x1000eb90
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
lea edx, [esi + 0x50]
mov edi, dword fs:[0]
mov dword [esi + 0x50], edi
mov dword fs:[0], edx
lea edx, [esi + 4]
push ecx
push eax
push edx
call fcn.100cf730
add esp, 0xc
mov eax, dword [esi + 0xc]
movsd xmm0, qword [esi + 4]
lea ecx, [esi + 0x3c]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x10]
movsd qword [esi + 0x10], xmm0
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], 0
push eax
push ecx
call fcn.10013060
add esp, 8
mov dword [esi + 0x24], 0x800
mov dword [esi + 0x34], 0
push 1
push 0x800
call fcn.100176f0
add esp, 8
test eax, eax
je 0x1000dede
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x3c]
mov dword [esi + 4], eax
mov dword [esi + 8], 0x800
mov dword [esi + 0xc], 0
mov ecx, dword [ecx]
mov dword [esi + 0x30], edx
mov dword [esi + 0x38], ecx
nop dword [eax]
lea ecx, [esi + 0x24]
push ecx
push eax
lea eax, [esi + 0x34]
push eax
push 0
push dword [esi + 0x30]
push dword [esi + 0x38]
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1000ddcd
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x58], 0
push eax
push ecx
lea eax, [esi + 4]
push eax
call fcn.1000f580
add esp, 0xc
mov eax, dword [esi + 4]
jmp 0x1000dd90
test eax, eax
jne 0x1000ddfd
mov eax, dword [esi + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x34]
cmp eax, 0xb
jbe 0x1000deb4
mov dword [esi + 0x58], 0
lea eax, [esi + 0x28]
push 0xde
push eax
call fcn.100c5160
add esp, 8
jmp 0x1000de11
mov dword [esi + 0x58], 0
lea ecx, [esi + 0x28]
push eax
push ecx
call fcn.100c5160
add esp, 8
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 1
test eax, eax
je 0x1000de39
push 1
push eax
push dword [esi + 4]
call fcn.10017710
add esp, 0xc
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1000de52
add eax, eax
je 0x1000de52
push 2
push eax
push dword [esi + 0x30]
call fcn.10017710
add esp, 0xc
cmp dword [esi + 0x10], 1
jne 0x1000de6f
mov eax, dword [esi + 0x14]
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 0x18]
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
mov dword [edx], 1
jmp 0x1000dea0
lea eax, [esi + 0x14]
mov dword [esi + 0x58], 1
push eax
push dword [ebp + 8]
call fcn.10019550
add esp, 8
cmp dword [esi + 0x10], 1
je 0x1000dea0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1000dea0
push 1
push eax
push dword [esi + 0x14]
call fcn.10017710
add esp, 0xc
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esi + 0xc]
movsd xmm0, qword [esi + 4]
mov dword [esi + 0x1c], ecx
movsd qword [esi + 0x14], xmm0
mov byte [esi + 0x20], al
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x1000de40
jmp 0x1000de52
push 1
push 0x800
call fcn.100da490
add esp, 8
ud2
Function at 0x10010f40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0x10011330
mov edi, dword [ebp + 8]
lea eax, [esi + 0x28]
lea ebx, [esi + 8]
mov ecx, dword fs:[0]
mov dword [esi + 0x28], ecx
mov dword fs:[0], eax
lea eax, [esi + 4]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], eax
push ebx
push dword [ebp + 0xc]
call fcn.1000ecc0
add esp, 8
test eax, eax
je 0x10010fbb
mov dword [edi + 4], eax
mov dword [edi], 1
mov eax, dword [esi + 0x28]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esi + 8]
test edi, edi
js 0x10011056
je 0x10010fe4
push 1
push edi
call fcn.100176f0
add esp, 8
test eax, eax
jne 0x10010fe9
push 1
push edi
call fcn.100da490
add esp, 8
ud2
mov eax, 1
mov dword [esi + 8], eax
lea eax, [esi + 0x1c]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x30], 0
push eax
push dword [ebp + 0xc]
call fcn.1000edd0
add esp, 8
mov edi, dword [ebp + 8]
test eax, eax
je 0x10011039
mov dword [edi + 4], eax
mov eax, dword [esi + 0xc]
mov dword [edi], 1
test eax, eax
je 0x10010fa8
push 1
push eax
push dword [esi + 8]
call fcn.10017710
add esp, 0xc
jmp 0x10010fa8
mov ecx, dword [esi + 0x10]
movsd xmm0, qword [esi + 8]
lea eax, [edi + 4]
mov dword [eax + 8], ecx
movsd qword [eax], xmm0
mov dword [edi], 0
jmp 0x10010fa8
call fcn.1000f180
ud2
Function at 0x100111f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0x10011350
mov edi, dword [ebp + 8]
lea eax, [esi + 0x28]
lea ebx, [esi + 8]
mov ecx, dword fs:[0]
mov dword [esi + 0x28], ecx
mov dword fs:[0], eax
lea eax, [esi + 4]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], eax
push ebx
push dword [ebp + 0xc]
call fcn.10008930
add esp, 8
test eax, eax
je 0x1001126b
mov dword [edi + 4], eax
mov dword [edi], 1
mov eax, dword [esi + 0x28]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esi + 8]
test edi, edi
js 0x10011306
je 0x10011294
push 1
push edi
call fcn.100176f0
add esp, 8
test eax, eax
jne 0x10011299
push 1
push edi
call fcn.100da490
add esp, 8
ud2
mov eax, 1
mov dword [esi + 8], eax
lea eax, [esi + 0x1c]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x30], 0
push eax
push dword [ebp + 0xc]
call fcn.10008a00
add esp, 8
mov edi, dword [ebp + 8]
test eax, eax
je 0x100112e9
mov dword [edi + 4], eax
mov eax, dword [esi + 0xc]
mov dword [edi], 1
test eax, eax
je 0x10011258
push 1
push eax
push dword [esi + 8]
call fcn.10017710
add esp, 0xc
jmp 0x10011258
mov ecx, dword [esi + 0x10]
movsd xmm0, qword [esi + 8]
lea eax, [edi + 4]
mov dword [eax + 8], ecx
movsd qword [eax], xmm0
mov dword [edi], 0
jmp 0x10011258
call fcn.1000f180
ud2
Function at 0x1001a480
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], esp
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0x1001a710
mov edi, dword [ebp + 0xc]
lea eax, [esi + 0x40]
mov ecx, dword fs:[0]
mov dword [esi + 0x40], ecx
mov dword fs:[0], eax
mov eax, dword [edi + 8]
test eax, eax
jne 0x1001a552
push 1
push 0x1d
call fcn.100176f0
add esp, 8
test eax, eax
je 0x1001a676
mov dword [esi], eax
mov dword [esi + 4], 0x1d
mov dword [esi + 8], 0
mov dword [esi + 0x48], 1
mov eax, esi
push 0x1d
push 0
push eax
call fcn.1000f580
add esp, 0xc
mov eax, dword [esi + 8]
lea ecx, [eax + 0x1d]
mov dword [esi + 8], ecx
add eax, dword [esi]
push 0x1d
push 0x101013b4
push 0x1d
push eax
call fcn.1001a810
add esp, 0x10
mov eax, dword [esi + 8]
mov edi, dword [ebp + 0xc]
movsd xmm0, qword [esi]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 4]
movsd qword [esi + 0x18], xmm0
test eax, eax
je 0x1001a540
push 1
push eax
push dword [edi]
call fcn.10017710
add esp, 0xc
mov eax, dword [esi + 0x20]
movsd xmm0, qword [esi + 0x18]
mov dword [edi + 8], eax
movsd qword [edi], xmm0
mov eax, dword [edi + 8]
mov ecx, dword [edi]
mov dword [esi + 0x48], 0
mov edx, esi
push eax
mov dword [esi + 0x28], ecx
push ecx
push edx
call fcn.100cf730
add esp, 0xc
mov eax, dword [esi + 8]
movsd xmm0, qword [esi]
mov ecx, esi
mov dword [esi + 0x20], eax
mov dword [esi + 8], eax
movzx eax, word [esi + 0x15]
movsd qword [esi], xmm0
mov dword [esi + 0xc], 1
mov byte [esi + 0x10], 0
movsd qword [esi + 0x18], xmm0
mov word [esi + 0x11], ax
mov al, byte [esi + 0x17]
mov byte [esi + 0x13], al
lea eax, [esi + 0x2c]
push ecx
push eax
call fcn.1001a8f0
add esp, 8
mov ebx, dword [ebp + 8]
mov edi, dword [esi + 0x2c]
push edi
push 0
push 0x1f0001
call sub.KERNEL32.dll_OpenMutexW
test eax, eax
mov dword [esi + 0x24], edi
jne 0x1001a5d1
push edi
push 0
push 0
call sub.KERNEL32.dll_CreateMutexW
test eax, eax
je 0x1001a63a
mov dword [ebx + 4], eax
mov dword [ebx], 0
mov eax, dword [esi + 0x30]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x1001a5f6
add eax, eax
je 0x1001a5f6
push 2
push eax
push dword [esi + 0x24]
call fcn.10017710
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
test eax, eax
je 0x1001a612
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x1001a612
push 1
push ecx
push eax
call fcn.10017710
add esp, 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x1001a627
push 1
push eax
push dword [esi + 0x28]
call fcn.10017710
add esp, 0xc
mov eax, dword [esi + 0x40]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0x48], 2
push eax
mov eax, esi
push eax
call fcn.100c5160
add esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], eax
mov dword [ebx], 1
mov eax, dword [esi + 0x30]
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x1001a5e4
jmp 0x1001a5f6
push 1
push 0x1d
call fcn.100da490
add esp, 8
ud2
Function at 0x1001f3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov dl, byte [eax + 0x108]
mov cl, byte [eax + 0x109]
test esi, esi
je 0x1001f42b
mov edi, dword [esp + 0x18]
inc dl
movzx ebx, dl
mov ch, byte [eax + ebx + 8]
add cl, ch
movzx ebp, cl
mov dh, byte [eax + ebp + 8]
mov byte [eax + ebx + 8], dh
mov byte [eax + ebp + 8], ch
add ch, byte [eax + ebx + 8]
movzx ebx, ch
mov ch, byte [eax + ebx + 8]
xor byte [edi], ch
inc edi
dec esi
jne 0x1001f400
mov byte [eax + 0x108], dl
mov byte [eax + 0x109], cl
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100243f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x258
mov esi, esp
mov dword [esi + 0x240], ebp
mov dword [esi + 0x244], esp
mov dword [esi + 0x250], 0xffffffff
mov dword [esi + 0x24c], 0x10026dd0
lea ecx, [esi + 0x10]
lea edi, [esi + 0x38]
mov eax, dword fs:[0]
mov dword [esi + 0x248], eax
lea eax, [esi + 0x248]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], 0x101032f0
mov dword [esi + 0x14], 4
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 3
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x34], eax
lea eax, [ebp + 0xc]
mov dword [esi + 0x38], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x3c], fcn.100e5310
mov dword [esi + 0x40], eax
lea eax, [esi + 0x30]
mov dword [esi + 0x44], 0x1000ba00
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 0x1000ba00
lea eax, [esi + 4]
push ecx
push eax
call fcn.100da500
add esp, 8
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov dword [esi + 0x250], 0
push eax
mov dword [esi], ecx
push ecx
push edi
call fcn.10025800
add esp, 0xc
mov edi, dword [ebp + 8]
cmp dword [esi + 0x38], 1
jne 0x100244fd
movsd xmm0, qword [esi + 0x3c]
movsd xmm1, qword [esi + 0x44]
lea eax, [esi + 0x10]
movsd qword [esi + 0x18], xmm1
movsd qword [esi + 0x10], xmm0
push eax
push edi
call fcn.10021d60
add esp, 8
mov edi, dword [ebp + 8]
mov eax, dword [esi + 8]
test eax, eax
jne 0x10024516
jmp 0x10024523
lea eax, [esi + 0x40]
push 0x200
push eax
push edi
call fcn.100f0640
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x10024523
push 1
push eax
push dword [esi]
call fcn.10017710
add esp, 0xc
mov eax, dword [esi + 0x248]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1003ca80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov dword [esi + 0xc8], ebp
mov dword [esi + 0xcc], esp
mov dword [esi + 0xd8], 0xffffffff
mov dword [esi + 0xd4], 0x1003efc0
mov edi, dword [ebp + 0xc]
lea eax, [esi + 0xd0]
mov ebx, dword [ebp + 8]
mov ecx, dword fs:[0]
mov dword [esi + 0xd0], ecx
mov dword fs:[0], eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
mov eax, edx
sub eax, ecx
cmp eax, 2
call fcn.1003cae2
Function at 0x10060d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0x10069fe0
lea eax, [esi + 0x28]
mov ecx, dword fs:[0]
mov dword [esi + 0x28], ecx
mov dword fs:[0], eax
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0x30], 0
mov eax, esi
push 0x20
push 0
push eax
call fcn.1000f580
add esp, 0xc
mov ecx, dword [esi + 8]
mov eax, dword [esi]
mov edi, dword [ebp + 0x10]
lea edx, [ecx + 0x20]
mov dword [esi + 8], edx
mov edx, dword [ebp + 8]
movsd xmm0, qword [edx + 0x18]
movsd qword [eax + ecx + 0x18], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [eax + ecx + 0x10], xmm0
movsd xmm0, qword [edx]
movsd xmm1, qword [edx + 8]
mov edx, dword [ebp + 0xc]
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
mov ebx, dword [esi + 8]
movsd xmm0, qword [esi]
mov dword [esi + 0x18], ebx
movsd qword [esi + 0x10], xmm0
cmp ebx, edi
mov eax, ebx
mov ecx, dword [esi + 0x10]
cmova eax, edi
push eax
mov dword [esi + 0xc], ecx
push ecx
push edx
call fcn.100f0640
add esp, 0xc
cmp ebx, edi
jbe 0x10060e79
mov dword [esi + 0x30], 1
push 0x1c
push str.failed_to_write_whole_buffercalled__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
push 0xe
mov eax, esi
push eax
call fcn.100414f0
add esp, 0x10
mov eax, dword [esi]
cmp al, 3
jne 0x10060e9f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10060e8e
push 1
push eax
push dword [esi + 0xc]
call fcn.10017710
add esp, 0xc
mov eax, dword [esi + 0x28]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esi + 4]
mov dword [esi], eax
mov dword [esi + 0x30], 2
mov dword [esi + 4], ecx
push 0x1011b230
push 0x1011b134
mov eax, esi
push eax
push 0x2b
push 0x1011b107
call fcn.100df140
add esp, 0x14
ud2
Function at 0x10066930
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x6c]
push ebp
call fcn.10052b00
add esp, 4
cmp ax, 0x25
je 0x10066999
mov ecx, dword [ebp + 4]
mov esi, dword [ebp + 8]
mov edi, eax
mov eax, ecx
sub eax, esi
cmp eax, 2
jb 0x10066999
lea ebx, [esi + 2]
cmp esi, 0xfffffffd
mov dword [ebp + 8], ebx
ja 0x10066abd
mov eax, ecx
mov word [esp + 6], dx
mov dword [esp], ebx
sub eax, ebx
jb 0x10066ac9
mov edx, dword [ebp]
movzx ebx, byte [edx + esi]
movzx esi, byte [edx + esi + 1]
shl ebx, 8
or esi, ebx
cmp eax, esi
jae 0x100669a9
mov ebx, dword [esp + 0x68]
mov dword [ebx], 2
mov eax, ebx
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp]
mov ebx, dword [esp + 0x68]
add eax, esi
mov dword [ebp + 8], eax
jb 0x10066ad8
cmp ecx, eax
jb 0x10066ae7
add edx, dword [esp]
cmp di, 0x16
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
jne 0x100669f4
cmp esi, 4
jb 0x10066999
mov dword [esp + 0x2c], 4
xor ecx, ecx
mov eax, dword [edx]
bswap eax
jmp 0x10066aa1
lea eax, [esp + 0x24]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.10046ff0
add esp, 8
mov eax, dword [esp + 8]
test eax, eax
je 0x10066a5d
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x48], eax
mov edx, dword [esp + 0x10]
movzx eax, word [esp + 6]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], edx
movsd xmm0, qword [esp + 0x48]
movsd qword [esp + 0x14], xmm0
movsd qword [esp + 0x3c], xmm0
movsd qword [esp + 8], xmm0
mov word [esp + 0x22], ax
cmp di, 0x25
mov word [esp + 0x20], di
je 0x10066999
jmp 0x10066a84
mov eax, dword [esp + 0x44]
movsd xmm0, qword [esp + 0x3c]
mov di, 0x25
mov dword [esp + 0x10], eax
movsd qword [esp + 8], xmm0
cmp di, 0x25
mov word [esp + 0x20], di
je 0x10066999
movsd xmm0, qword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x38], ecx
movsd qword [esp + 0x30], xmm0
mov ecx, 1
mov dword [ebx], ecx
mov dword [ebx + 4], eax
movsd xmm0, qword [esp + 0x30]
mov eax, dword [esp + 0x38]
movsd qword [ebx + 8], xmm0
mov dword [ebx + 0x10], eax
jmp 0x1006699f
push ebx
push esi
call fcn.100e21d0
add esp, 8
ud2
push ecx
push dword [esp + 4]
call fcn.100e2170
add esp, 8
ud2
push eax
push dword [esp + 4]
call fcn.100e21d0
add esp, 8
ud2
push ecx
push eax
call fcn.100e2170
add esp, 8
ud2
Function at 0x100868a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push edi
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
xor eax, eax
nop dword [eax]
cmp eax, esi
jae 0x100868cd
mov edx, esi
lea ecx, [edi + eax]
sub edx, eax
push edx
push ecx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
mov eax, esi
jne 0x100868b0
mov al, 1
pop esi
pop edi
ret
xor eax, eax
pop esi
pop edi
ret
Function at 0x10096800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x10096822
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret