joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052c4a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e9492
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10001db8
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10001db8
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10001db8
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10001db8
or dword [esi + 0x7c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x64], bl
mov byte [esi + 0x65], bl
mov byte [esi + 0x66], bl
mov byte [esi + 0x67], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10054207
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e9636
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10001e14
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10001e14
mov eax, dword [esi + 0x18]
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.10001e14
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
mov byte [ebp - 4], 2
call fcn.10001e14
mov al, byte [esi + 0x64]
push 5
mov byte [ebx + 0x64], al
mov al, byte [esi + 0x65]
mov byte [ebx + 0x65], al
mov al, byte [esi + 0x66]
mov byte [ebx + 0x66], al
mov al, byte [esi + 0x67]
mov byte [ebx + 0x67], al
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x7c], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10059463
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e9bfb
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.100025df
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10062460
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x10062518
cmp word [ecx], 0x5a4d
jne 0x10062518
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x10062518
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x10062518
test al, 7
jne 0x10062518
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10062518
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x100624ee
sub ecx, 0x74
je 0x100624e7
dec ecx
dec ecx
je 0x100624e7
dec ecx
dec ecx
je 0x100624e0
sub ecx, 0x3c
je 0x100624d9
sub ecx, 0x8464
je 0x100624ee
sub ecx, 0x2400
jne 0x10062518
push 0xa
pop ecx
jmp 0x100624f3
mov ecx, 0x3030401
jmp 0x100624f3
mov ecx, 0x3030701
jmp 0x100624f3
mov ecx, 0x3030501
jmp 0x100624f3
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x10062518
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x1006250d
cmp eax, 0x20b
jne 0x10062518
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x1006251a
xor eax, eax
ret 4
Function at 0x10066c5e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ea6ac
call fcn.100e0f70
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10061b77
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.100a220c
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.100a220c
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.100a220c
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.100a220c
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.100a220c
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.100a220c
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.100a220c
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.100a220c
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10066e5a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ea70b
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10067048
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.100670fd
mov al, byte [edi + 0x18]
add edi, 0x34
mov byte [esi + 0x18], al
mov al, byte [edi - 0x1b]
mov byte [esi + 0x19], al
mov eax, dword [edi - 0x18]
mov dword [esi + 0x1c], eax
mov al, byte [edi - 0x14]
mov byte [esi + 0x20], al
mov al, byte [edi - 0x13]
mov byte [esi + 0x21], al
mov eax, dword [edi - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x2c], eax
mov al, byte [edi - 4]
mov byte [esi + 0x30], al
mov al, byte [edi - 3]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x31], al
call fcn.10002692
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100677be
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x100677dd
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x100677cc
pop edi
cmp esi, 4
jb 0x100677e7
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x100677f8
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x10067804
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x1006780e
movzx ecx, byte [ecx]
xor eax, ecx
ret

Function at 0x10073d04
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [ecx + 0x3c]
cmp edx, 2
jge 0x10073d1d
cmp byte [ecx + 0x42], 0
mov eax, dword [esp + 4]
je 0x10073d82
cmp eax, 0x3f
jb 0x10073d82
jmp 0x10073d71
mov eax, dword [esp + 4]
cmp eax, 0x2c
jb 0x10073d82
cmp edx, 3
jl 0x10073d35
cmp eax, 0x2c
jne 0x10073d34
push 0x48
jmp 0x10073d81
dec eax
cmp edx, 4
jl 0x10073d44
cmp eax, 0x2c
jne 0x10073d43
push 0x49
jmp 0x10073d81
dec eax
cmp eax, 0x3a
jb 0x10073d82
cmp byte [ecx + 0x14], 0
je 0x10073d63
cmp eax, 0x3a
jne 0x10073d58
push 0x44
jmp 0x10073d81
cmp eax, 0x3b
jne 0x10073d61
push 0x45
jmp 0x10073d81
dec eax
dec eax
cmp eax, 0x3f
jb 0x10073d7a
cmp byte [ecx + 0x42], 0
je 0x10073d7a
cmp eax, 0x3f
jne 0x10073d77
push 0x46
jmp 0x10073d81
dec eax
jmp 0x10073d82
cmp eax, 0x44
jne 0x10073d82
push 0x47
pop eax
ret 4

Function at 0x1007546b
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100eb24f
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi + 0x24], 0xffffffff
lea ecx, [esi + 0x30]
mov byte [esi], bl
mov byte [esi + 1], 1
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ebx
call fcn.10001db8
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.100025df
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100755cb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100eb2e3
call fcn.100e0f70
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10001db8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.100025df
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.1007566c
lea eax, [esi + 0xb8]
mov dword [eax], edi
mov dword [eax + 4], edi
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 6
call fcn.10001db8
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 7
call fcn.10001db8
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea eax, [esi + 0xfc]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10079006
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100eb73f
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x38]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ax, word [edi + 0x30]
mov word [esi + 0x30], ax
mov al, byte [edi + 0x32]
mov byte [esi + 0x32], al
mov al, byte [edi + 0x33]
mov byte [esi + 0x33], al
mov al, byte [edi + 0x34]
mov byte [esi + 0x34], al
mov al, byte [edi + 0x35]
mov byte [esi + 0x35], al
mov al, byte [edi + 0x36]
mov byte [esi + 0x36], al
lea eax, [edi + 0x38]
push eax
call fcn.10001e14
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
push eax
lea ecx, [esi + 0x44]
call fcn.10002692
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov ax, word [edi + 0x64]
mov word [esi + 0x64], ax
mov ax, word [edi + 0x66]
mov word [esi + 0x66], ax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1007d82b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100ebb12
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f00e8
mov dword [esi + 4], 0x100f00cc
mov dword [esi + 8], 0x100f7db4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
call fcn.100025df
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 5
call fcn.10057010
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100f91e4
mov dword [esi + 4], 0x100f91c8
mov dword [esi + 8], 0x100f91b8
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1007dc8e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ebbc3
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov al, byte [edi + 8]
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.10001e14
mov eax, dword [edi + 0x1c]
and dword [ebp - 4], 0
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
lea eax, [edi + 0x34]
push eax
lea ecx, [esi + 0x34]
call fcn.1001449e
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1008ff04
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100eca2d
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x38]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
lea eax, [edi + 0x38]
push eax
call fcn.10002692
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
push eax
lea ecx, [esi + 0x44]
call fcn.10002692
mov eax, dword [edi + 0x50]
lea ecx, [esi + 0x60]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov al, byte [edi + 0x58]
mov byte [esi + 0x58], al
mov al, byte [edi + 0x59]
mov byte [esi + 0x59], al
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [edi + 0x60]
push eax
mov byte [ebp - 4], 1
call fcn.10090228
add edi, 0x6c
lea ecx, [esi + 0x6c]
push edi
mov byte [ebp - 4], 2
call fcn.1001449e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1009387b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ecca7
call fcn.100e0f70
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.100025df
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x100980f5
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100ed24b
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001e14
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10098178
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100a2134
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ed89f
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 4
call fcn.10093c39
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], ebx
or dword [esi + 0x128], 0xffffffff
or dword [esi + 0x12c], 0xffffffff
mov byte [esi + 0x118], 1
mov byte [esi + 0x119], bl
mov byte [esi + 0x11a], bl
mov byte [esi + 0x11b], bl
mov dword [esi + 0x120], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100a7ea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.100a7550
push 0x41
mov ecx, esi
call fcn.100a7550
push 0x59
mov ecx, esi
call fcn.100a7550
push 0x26
mov ecx, esi
call fcn.100a7550
push 0x53
mov ecx, esi
call fcn.100a7550
push 0x59
mov ecx, esi
call fcn.100a7550
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x100a7f30
test cl, cl
jbe 0x100a7f2c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x1011005c]
xor eax, edi
dec ecx
jne 0x100a7f16
xor edi, edi
jmp 0x100a7f5f
cmp bl, cl
jne 0x100a7f37
inc edi
jmp 0x100a7f42
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x1011005c]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x100a7eee
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.100a7590
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.100a76b0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x100dfdb0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [0x1010f46c]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x67452301
mov dword [ecx + 0x24], 0xefcdab89
mov dword [ecx + 0x28], 0x98badcfe
mov dword [ecx + 0x2c], 0x10325476
mov dword [ecx + 0x30], 0xc3d2e1f0
ret

Function at 0x100e0540
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
mov edi, edx
cmp eax, 0x38
jbe 0x100e0582
cmp eax, 0x40
je 0x100e0574
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
mov ecx, dword [esi + 0x20]
bswap ecx
mov dword [edi], ecx
mov edx, dword [esi + 0x24]
bswap edx
mov dword [edi + 4], edx
mov eax, dword [esi + 0x28]
bswap eax
mov dword [edi + 8], eax
mov ecx, dword [esi + 0x2c]
bswap ecx
mov dword [edi + 0xc], ecx
mov edx, dword [esi + 0x30]
bswap edx
mov dword [edi + 0x10], edx
pop edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x67452301
mov dword [esi + 0x24], 0xefcdab89
mov dword [esi + 0x28], 0x98badcfe
mov dword [esi + 0x2c], 0x10325476
mov dword [esi + 0x30], 0xc3d2e1f0
pop esi
pop ebx
ret

Function at 0x100e07d0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x1010f470]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret