joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10157480
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10188458
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::FileDescriptorProto.0
call fcn.1013ed00
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x80], 0
mov dword [esi + 8], 0x10221af0
mov dword [esi + 0xc], 0x10221af0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x84], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10157a30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10188458
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::SourceCodeInfo_Location.0
call fcn.1013ed00
mov dword [esi + 8], 0
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0x10221af0
mov dword [esi + 0x2c], 0x10221af0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10157ad0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10188458
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.1013ed00
mov dword [esi + 8], 0
xorps xmm0, xmm0
mov dword [esi + 0xc], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x18], 0x10221af0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
movsd qword [esi + 0x30], xmm0
mov dword [esi + 0x38], 0x10221af0
mov dword [esi + 0x3c], 0x10221af0
mov dword [esi + 0x44], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x71a17a
Capabilities:
Encode data using xor

Disassembly:
and al, 0x8b
push edi
sub ch, bl
test edx, edx
or al, byte [edi + 0x28]
je 0x71a057
inc edi
sub byte [eax + ecx - 0x77], dh
test eax, 0x59ffffff
mov dword [ecx + 0x59ffffff], ebp
or byte [ebx + 0x3eb2847], cl
mov dword [ebp - 0x44], ebx
lea ebx, [edi + 0x20]
lea ecx, [edi + 0x24]
test eax, eax
inc edi
sub bl, ch
add ecx, dword [ecx + 0x5f8dbc5d]
and byte [ebp - 0x3f7adbb1], cl
je 0x71a06f
mov eax, dword [ecx]
add eax, 8
jg 0x71a043
inc dword [edi]
mov ebx, 0x7f0889d8
cmp dword [ebp - 0x3c], 0
je 0x71a0d0
mov dword [ebp - 0x4c], ebx
lea ebx, [ebp - 0x2c]
loopne 0x71a04b
call dword [edi + ecx*4]
push 0x64
push edi
call 0x666c0851
sub ebx, dword [ebx + 0x1c0a7f10]
adc byte [ebp - 0x17bf2b83], cl
invalid
int1
or al, 0xc6
fild word [esi]
add byte [ecx + esi*2], dh
cmpsd dword [esi], dword es:[edi]
cmp cl, byte [edx - 0x28]
push esi
inc dword [esi - 0x36cef002]
cmp byte [ebp - 0x14], 0
lea eax, [ebp - 0x34]
mov dword [esi + 4], ebp
mov dword [eax - 4], eax
jne 0x71a103
lea eax, [ebp - 0x11]
mov eax, 0x31c883a1
or eax, 0x8c4832e
cmp cl, byte fs:[ebp - 0x7f2537a3]
jnp 0x71a17a
enter 0xffffffffffff80da, 0x7b
jb 0x71a164
pop ebx
inc esp
test byte [ebp + 0x78], bl
cld
or byte [edx - 0x3b9e6401], 8
mov byte [ebp - 0x45], al
mov ecx, ebx
push dword [ebx + 4]
call 0x664920fa
sbb edi, dword [0x7d808e50]
mov ebx, 0xf01b300
test byte [ebp + 0x31], ah
lcall 0x8d83, 0xeb7de282
dec ebp
enter 0xffffffffffffaf7c, 0xffffffffffffffe9
pushfd
test byte [ecx + 0x50b74608], ah
invalid
add byte [eax + 0x75002c7e], al
inc esi
add byte [ebp + 0x46], dh
or byte [edx + 0x17], ah
ja 0x71a18b
int1
call 0xc0f651dc
ja 0x71a153
mov al, 0x84
sal byte [edi - 0x10], 0x63
arpl di, bp
out dx, eax
fiadd word [eax]
jne 0x71a18d
inc ebx
pop es
cmp ebx, 9
ja 0x71a189
cwde
call 0x728d2b69
out dx, al
inc dword [ecx]
add byte [edx], ch
push 0
push 0x186a0
call 0xfa0d91fd
dec ebp
invalid
clc
aas
fsubr st(0)
or al, byte [ebx - 0x77]
sti
je 0x71a14f
cmp dword [esi + 0x28], 0
je 0x71a1bb
ljmp 0x2c00:0xf19c758e
rol esp, 0x67
cmp ebp, dword [ecx]
call 0x75c0d7ef
jecxz 0x71a181
loopne 0x71a15e
xlatb
xchg byte [edi + 0x71], bl
adc ah, byte [eax + 0x15]
jmp 0x39bb00e2
adc eax, 0x495f21e9
cmp dword [ecx + 0x1f58ae31], esi
and edx, dword [ebx]
or al, 0x89
dec ebp
call 0x2a4378
jg 0x71a1a5
inc ebp
invalid

Function at 0x854aa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x60500d
lea edi, [esi - 0x20400d]
push edi
or ebp, 0xffffffff
jmp 0x854ac2
Function at 0x401650
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
xor eax, eax
mov byte [ebp - 0x15], cl
mov dword [ebp - 0x14], edx
mov edx, dword [edx]
mov ecx, dword [ebx]
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
cmp esi, 2
je 0x401720
ja 0x4016d3
cmp esi, 1
je 0x40174b
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edx]
mov ebx, esi
cmp bl, 0x3d
je 0x4016c4
jle 0x4017b0
mov ebx, esi
cmp bl, 0x5c
je 0x401745
cmp bl, 0x5e
je 0x4018c5
mov ebx, esi
add edx, 1
mov byte [ecx], bl
movzx esi, byte [edx]
add ecx, 1
add edi, 1
mov ebx, esi
cmp bl, 0x3d
jne 0x401693
cmp byte [ebp - 0x15], 0
je 0x4016ad
mov ebx, edi
mov eax, 1
jmp 0x401702
cmp esi, 3
je 0x4017c6
cmp esi, 4
jne 0x401686
movzx esi, byte [edx]
lea edi, [esi - 0x40]
mov ebx, edi
cmp bl, 0x3e
jbe 0x401790
mov ebx, esi
cmp bl, 0x3f
je 0x4018b3
mov ebx, dword [ebp - 0x1c]
xor eax, eax
mov esi, dword [ebp - 0x10]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ecx], edx
mov edx, dword [ebp + 8]
mov dword [edx], ebx
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
movzx esi, byte [edx]
lea edi, [esi - 0x30]
mov ecx, edi
cmp cl, 7
jbe 0x401780
mov ecx, dword [ebp - 0x20]
add ebx, 1
mov edi, ebx
mov byte [ecx], al
add ecx, 1
jmp 0x401689
mov dword [ebp - 0x1c], edi
add edx, 1
movzx esi, byte [edx]
mov ebx, esi
cmp bl, 0x78
jbe 0x401773
mov eax, esi
mov byte [ecx], al
xor esi, esi
add ecx, 1
add dword [ebp - 0x1c], 1
add edx, 1
cmp esi, 4
jbe 0x401672
mov ebx, dword [ebp - 0x1c]
jmp 0x4017bb
movzx edi, bl
jmp dword [edi*4 + 0x4141cc]
lea eax, [esi + eax*8 - 0x30]
add edx, 1
jmp 0x401726
and esi, 0x1f
add edx, 1
mov ebx, esi
mov byte [ecx], bl
add ecx, 1
add dword [ebp - 0x1c], 1
mov edi, dword [ebp - 0x1c]
jmp 0x401689
test bl, bl
jne 0x4017f0
mov ebx, edi
mov esi, 5
cmp esi, 6
setne al
jmp 0x401702
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
movzx esi, byte [edx]
lea edi, [esi - 0x30]
mov ecx, edi
cmp cl, 0x36
ja case.0x4017e3.10
and edi, 0xff
jmp dword [edi*4 + 0x4143b0]
cmp bl, 0x3a
jne 0x4016ad
jmp 0x4017b4
shl eax, 4
add edx, 1
lea eax, [esi + eax - 0x57]
jmp 0x4017cc
shl eax, 4
add edx, 1
lea eax, [esi + eax - 0x37]
jmp 0x4017cc
shl eax, 4
add edx, 1
lea eax, [esi + eax - 0x30]
jmp 0x4017cc
mov eax, 0xb
jmp 0x401757
mov eax, 9
jmp 0x401757
mov eax, 0xd
jmp 0x401757
mov eax, 0xa
jmp 0x401757
mov eax, 0xc
jmp 0x401757
mov eax, 0x1b
jmp 0x401757
mov eax, 8
jmp 0x401757
mov eax, 7
jmp 0x401757
mov eax, 0x20
jmp 0x401757
mov esi, 3
xor eax, eax
jmp 0x401762
mov eax, 0x7f
jmp 0x401757
lea eax, [esi - 0x30]
mov esi, 2
jmp 0x401762
mov esi, 6
jmp 0x401762
mov byte [ecx], 0x7f
add ecx, 1
add dword [ebp - 0x1c], 1
mov edi, dword [ebp - 0x1c]
jmp 0x401689
mov dword [ebp - 0x1c], edi
add edx, 1
jmp 0x4016e1
Function at 0x403a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
cmp byte [0x41a11c], 0
jne 0x403a2e
mov byte [0x41a11c], 1
call fcn.00403a60
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x403a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x414014]
test eax, eax
je 0x403a77
leave
mov eax, 0x414010
jmp fcn.00403a10
mov eax, section..data
call fcn.00403a10
mov eax, 0x414018
call fcn.00403a10
mov eax, 0x414008
leave
jmp fcn.00403a10

Function at 0x403aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x41a034], 0
je 0x403abd
mov eax, 4
call fcn.004013b0
test al, al
jne 0x403ac0
leave
ret
mov eax, section..data
call fcn.00403a10
mov eax, 0x414020
call fcn.00403a10
mov eax, 0x414008
leave
jmp fcn.00403a10

Function at 0x403ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, section..data
mov ebp, esp
sub esp, 8
call fcn.00403a10
mov eax, 0x414008
leave
jmp fcn.00403a10
Function at 0x4089f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
test ebx, ebx
je 0x408a7e
mov dword [esp + 4], 0x2f
mov dword [esp], ebx
call sub.cygwin1.dll_strrchr
test eax, eax
je 0x408a64
lea edx, [eax + 1]
mov ecx, edx
sub ecx, ebx
cmp ecx, 6
mov dword [ebp - 0x1c], edx
jle 0x408a64
lea esi, [eax - 6]
mov edi, str._.libs_
mov ecx, 7
repe cmpsb byte [esi], byte es:[edi]
jne 0x408a64
mov esi, dword [ebp - 0x1c]
mov ecx, 3
mov edi, 0x417668
mov ebx, dword [ebp - 0x1c]
repe cmpsb byte [esi], byte es:[edi]
seta cl
mov esi, ecx
setb cl
mov edx, esi
cmp dl, cl
jne 0x408a64
lea ebx, [eax + 4]
mov eax, dword [sym.imp.cygwin1.dll_program_invocation_short_name]
mov dword [eax], ebx
mov eax, dword [sym.imp.cygwin1.dll_program_invocation_name]
mov dword [0x41a680], ebx
mov dword [eax], ebx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x37
mov dword [esp + 4], 1
mov dword [esp], str.A_NULL_argv_0__was_passed_through_an_exec_system_call._n
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
call sub.cygwin1.dll_abort
nop
nop
nop
nop
nop
Function at 0x40b960
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test ebx, ebx
je 0x40ba82
xor esi, esi
cmp byte [ebx], 0x27
je 0x40ba16
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x417aa8
mov dword [esp + 4], 0x417ac4
mov dword [esp], ebx
call fcn.00409cd0
test eax, eax
js 0x40ba22
or esi, dword [eax*4 + 0x417aa8]
mov edx, 1
mov dword [edi], 1
xor ecx, ecx
mov dword [edi + 4], 0
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebx], esi
mov ebx, ecx
or ebx, edx
je 0x40b9e1
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], 0x417a84
call sub.cygwin1.dll_getenv
xor ecx, ecx
mov edx, 0x400
test eax, eax
je 0x40b9ff
mov edx, 0x200
xor ecx, ecx
mov dword [edi], edx
mov eax, 4
mov dword [edi + 4], ecx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
add ebx, 1
mov si, 4
jmp 0x40b988
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], str.eEgGkKmMpPtTyYzZ0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00412820
test eax, eax
jne 0x40bad8
movzx eax, byte [ebx]
sub eax, 0x30
cmp al, 9
jbe 0x40ba78
mov edx, dword [ebp - 0x1c]
cmp ebx, edx
jne 0x40ba6b
jmp 0x40baf0
cmp ebx, edx
je 0x40baf0
add ebx, 1
movzx eax, byte [ebx]
sub eax, 0x30
cmp al, 9
ja 0x40ba63
mov edx, dword [edi]
mov ecx, dword [edi + 4]
jmp 0x40b9c7
mov dword [esp], str.BLOCK_SIZE
call sub.cygwin1.dll_getenv
test eax, eax
mov ebx, eax
jne 0x40b97d
mov dword [esp], str.BLOCKSIZE
call sub.cygwin1.dll_getenv
test eax, eax
mov ebx, eax
jne 0x40b97d
mov dword [esp], 0x417a84
call sub.cygwin1.dll_getenv
xor ecx, ecx
mov edx, 0x400
test eax, eax
je 0x40bacc
mov edx, 0x200
xor ecx, ecx
mov dword [edi], edx
xor esi, esi
mov dword [edi + 4], ecx
jmp 0x40b9c7
mov edx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov dword [edx], 0
mov edx, dword [edi]
jmp 0x40b9ce
or esi, 0x80
cmp byte [edx - 1], 0x42
je 0x40bb10
or esi, 0x20
mov edx, dword [edi]
mov ecx, dword [edi + 4]
jmp 0x40b9c7
or esi, 0x100
cmp byte [edx - 2], 0x69
jne 0x40ba78
jmp 0x40bafc
Function at 0x40bf70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
lea ebx, [eax + 2]
movzx eax, word [ebx]
test ax, ax
je 0x40bfb4
cmp ax, 0x5b
je 0x40bfd5
cmp ax, 0x2a
je 0x40bfc0
cmp ax, 0x3f
je 0x40bfc0
cmp ax, 0x2b
je 0x40bfc0
cmp ax, 0x40
je 0x40bfc0
cmp ax, 0x21
je 0x40bfc0
add ebx, 2
cmp ax, 0x29
jne 0x40bf7d
mov esi, ebx
add esp, 0x10
mov eax, esi
pop ebx
pop esi
pop ebp
ret
add ebx, 2
cmp word [ebx], 0x28
jne 0x40bfac
mov eax, ebx
call fcn.0040bf70
lea ebx, [eax + 2]
jmp 0x40bf7d
mov eax, dword [0x41a7f0]
test eax, eax
je 0x40c030
movzx edx, word [ebx + 2]
lea eax, [ebx + 2]
cmp dx, 0x21
je 0x40c026
mov ecx, dword [0x41a7f0]
test ecx, ecx
js 0x40c020
cmp dx, 0x5d
jne 0x40c00c
nop
lea esi, [esi]
add eax, 2
movzx edx, word [eax]
cmp dx, 0x5d
je 0x40bfd0
test dx, dx
jne 0x40c000
add esp, 0x10
mov eax, esi
pop ebx
pop esi
pop ebp
ret
cmp dx, 0x5e
jne 0x40bff5
add eax, 2
movzx edx, word [eax]
jmp 0x40bff5
mov dword [esp], str.POSIXLY_CORRECT
call sub.cygwin1.dll_getenv
cmp eax, 1
sbb eax, eax
or eax, 1
mov dword [0x41a7f0], eax
jmp 0x40bfde

Function at 0x40c050
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
lea ebx, [eax + 1]
movzx eax, byte [ebx]
test al, al
je 0x40c08b
cmp al, 0x5b
je 0x40c0a8
cmp al, 0x2a
je 0x40c094
cmp al, 0x3f
nop
je 0x40c094
cmp al, 0x2b
je 0x40c094
cmp al, 0x40
je 0x40c094
cmp al, 0x21
lea esi, [esi]
je 0x40c094
add ebx, 1
cmp al, 0x29
jne 0x40c05d
mov esi, ebx
add esp, 0x10
mov eax, esi
pop ebx
pop esi
pop ebp
ret
add ebx, 1
cmp byte [ebx], 0x28
jne 0x40c085
mov eax, ebx
call fcn.0040c050
lea ebx, [eax + 1]
jmp 0x40c05d
mov eax, dword [0x41a7f0]
test eax, eax
je 0x40c0f8
movzx edx, byte [ebx + 1]
lea eax, [ebx + 1]
cmp dl, 0x21
je 0x40c0f0
mov ecx, dword [0x41a7f0]
test ecx, ecx
js 0x40c0e8
cmp dl, 0x5d
jne 0x40c0db
lea esi, [esi]
add eax, 1
movzx edx, byte [eax]
cmp dl, 0x5d
je 0x40c0a3
test dl, dl
jne 0x40c0d0
add esp, 0x10
mov eax, esi
pop ebx
pop esi
pop ebp
ret
cmp dl, 0x5e
jne 0x40c0c7
lea esi, [esi]
add eax, 1
movzx edx, byte [eax]
jmp 0x40c0c7
mov dword [esp], str.POSIXLY_CORRECT
call sub.cygwin1.dll_getenv
cmp eax, 1
sbb eax, eax
or eax, 1
mov dword [0x41a7f0], eax
jmp 0x40c0b1
Function at 0x1000a463
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000a4a2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000a4a2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000a4a2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000a4a2
cmp dword [ecx + 0x74], 0xe
jbe 0x1000a4a2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000d11f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000d1bc
push ebx
push esi
call fcn.1000d0e8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000d07c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000d169
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000d1bb
push edi
push eax
call fcn.1000e0da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000d189
call fcn.1000bbc4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000d1ba
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000d07c
add esp, 0x20
test eax, eax
jne 0x1000d1a8
push edi
call fcn.1000bbc4
jmp 0x1000d1b0
push ebx
call fcn.1000bbc4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000d429
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10014658
push 0x10014650
push str.FlsAlloc
push 0x1f
call fcn.1000d345
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000d45d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001313c]
call esi
jmp 0x1000d463
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000d4a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10014668
push 0x10014660
push str.FlsGetValue
push 0x21
call fcn.1000d345
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000d4de
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001313c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000d4e6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10014670
push 0x10014668
push str.FlsSetValue
push 0x22
call fcn.1000d345
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000d520
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001313c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001164
cmp dword [ebp - 4], 0x50000000
jb 0x100010e1
cmp dword [ebp - 4], 0x80000000
ja 0x100010e1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100010ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10029030
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001107
jmp 0x10001164
cmp dword [ebp - 0x14], 0x10000
jne 0x1000114a
cmp dword [ebp - 0x18], 0x10000
jb 0x1000114a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113d
mov eax, dword [ebp - 8]
jmp 0x10001166
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000115f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100010ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000122c
cmp dword [ebp - 4], 0x50000000
jb 0x100011ac
cmp dword [ebp - 4], 0x80000000
ja 0x100011ac
mov dword [ebp - 4], 0x80010000
jmp 0x10001185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10029030
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100011d2
jmp 0x1000122c
cmp dword [ebp - 0x14], 0x10000
jne 0x10001215
cmp dword [ebp - 0x18], 0x10000
jb 0x10001215
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001208
mov eax, dword [ebp - 8]
jmp 0x1000122e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001227
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10080c28]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10080c38], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x10080c48]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1002249c
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x10080c48], 0
call fcn.10001a30
mov ecx, dword [0x10080c44]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1002249c
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x10080c44], 0
mov dword [0x10080c38], 0
xor eax, eax
mov esp, ebp
pop ebp
ret