joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5481e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
movzx esi, byte [eax]
lea ecx, [eax + 1]
movzx eax, byte [ecx]
xor edx, edx
shl esi, 8
push edi
mov edi, dword [0x39983644]
inc edx
add esi, eax
cmp edi, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
jb 0x54838e
mov eax, dword [0x39983638]
push ebx
mov ecx, dword [ebp - 8]
add ecx, edi
shr ecx, 1
movzx edx, byte [eax + ecx*8 - 8]
movzx ebx, byte [eax + ecx*8 - 7]
shl edx, 8
add edx, ebx
cmp edx, esi
jae 0x54823e
lea edx, [ecx + 1]
mov dword [ebp - 8], edx
jmp 0x548243
jbe 0x548248
lea edi, [ecx - 1]
cmp edi, dword [ebp - 8]
jae 0x54821c
cmp edi, dword [ebp - 8]
jb 0x54838d
mov ebx, dword [ebp - 0xc]
lea ecx, [eax + ecx*8]
mov esi, dword [ecx - 4]
mov edi, dword [ecx + 4]
add esi, eax
add edi, eax
mov al, byte [ebx]
mov dword [ebp - 8], 0xffff
mov dword [ebp - 0x10], 1
mov byte [ebp - 1], al
jmp 0x548385
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jae 0x54838d
jmp 0x5482f4
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
and al, 0x7f
movzx ax, al
inc ecx
imul eax, ecx
inc dword [ebp - 0x10]
mov dword [ebp - 8], eax
movzx eax, byte [ebp - 1]
inc ebx
cmp dword [eax*4 + 0x3997eec0], 2
mov al, byte [ebx]
mov byte [ebp - 1], al
jl 0x5482f4
test al, al
je 0x5482fa
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jae 0x5482fa
movzx eax, byte [ebp - 1]
mov eax, dword [eax*4 + 0x3997eec0]
cdq
push 2
pop ecx
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jne 0x5482f4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 0xfffffffe
cmp ebx, eax
ja 0x5482fa
cmp byte [ebx + 1], 0xec
je 0x5482f4
cmp ebx, eax
je 0x5482fa
cmp byte [ebx + 2], 0xec
jne 0x5482fa
cmp byte [ebp - 1], 0x7f
ja 0x548286
cmp esi, edi
jae 0x548378
mov ecx, dword [ebp - 0x10]
push 2
pop edx
mov ax, word [esi]
cmp cx, ax
je 0x548329
jb 0x548378
cmp esi, edi
jae 0x548378
cmp al, 2
jne 0x54831a
add esi, edx
jmp 0x548323
add esi, edx
movzx eax, word [esi]
lea esi, [esi + eax*2 + 2]
cmp esi, edi
jb 0x548304
jmp 0x548378
add esi, edx
cmp cx, dx
jne 0x54833b
push edx
push dword [ebp + 0xc]
call fcn.0054765a
jmp 0x548378
mov ax, word [esi]
add esi, edx
test ax, ax
mov dword [ebp - 0xc], eax
jbe 0x548378
mov ax, word [esi]
cmp word [ebp - 8], ax
je 0x548365
jbe 0x548371
add dword [ebp - 0xc], 0xffff
inc esi
inc esi
cmp word [ebp - 0xc], 0
ja 0x548348
jmp 0x548378
movzx eax, cx
push eax
push dword [ebp + 0xc]
call fcn.0054765a
movzx eax, word [ebp - 0xc]
lea esi, [esi + eax*2]
cmp byte [ebp - 1], 0x80
jb 0x54838d
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
ja 0x54838d
cmp esi, edi
jb 0x548279
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x56a78f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 0xc]
mov cl, byte [esi]
mov dx, word [esi + 0xe]
push edi
mov byte [ebp - 1], al
push 0x20
pop eax
sub eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov al, 1
shl al, cl
dec al
mov byte [ebp - 3], al
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp + 8]
shr ebx, cl
mov cl, byte [esi]
and bl, al
xor eax, eax
inc eax
shl eax, cl
mov byte [ebp - 2], bl
cmp dx, ax
jne 0x56a7e9
push edx
mov ecx, esi
call fcn.0056a67f
mov ecx, esi
call fcn.00567e74
movzx dx, bl
jmp 0x56a889
mov cl, byte [ebp - 1]
movzx eax, bl
mov ebx, eax
movzx edi, dx
shl eax, cl
shl ebx, 0xc
add ebx, edi
xor eax, edi
lea edi, [esi + eax*2 + 0x4020]
mov ax, word [edi]
jmp 0x56a823
movzx ecx, ax
mov ecx, dword [esi + ecx*4 + 0x20]
mov dword [ebp - 0xc], ecx
and ecx, 0xfffff
cmp ebx, ecx
je 0x56a864
mov eax, dword [ebp - 0xc]
shr eax, 0x14
test ax, ax
jne 0x56a809
push edx
mov ecx, esi
call fcn.0056a67f
mov ax, word [esi + 2]
cmp ax, 0xfff
jae 0x56a868
movzx ecx, word [edi]
inc eax
movzx edx, ax
shl ecx, 0x14
add ecx, ebx
mov dword [esi + edx*4 + 0x20], ecx
mov word [edi], ax
mov cl, byte [esi + 1]
mov word [esi + 2], ax
xor eax, eax
inc eax
shl eax, cl
cmp edx, eax
jl 0x56a884
inc cl
mov byte [esi + 1], cl
jmp 0x56a884
mov edx, eax
jmp 0x56a889
cmp byte [esi + 0xd], 0
jne 0x56a884
mov cl, byte [esi]
xor eax, eax
inc eax
shl eax, cl
mov ecx, esi
push eax
call fcn.0056a67f
mov ecx, esi
call fcn.00567e74
movzx dx, byte [ebp - 2]
mov ecx, dword [ebp + 0xc]
sub dword [ebp + 0x10], ecx
cmp dword [ebp + 0x10], ecx
jl 0x56a89f
shl dword [ebp + 8], cl
mov al, byte [ebp - 3]
jmp 0x56a7b8
pop edi
mov word [esi + 0xe], dx
pop esi
mov al, 1
pop ebx
leave
ret 0xc

Function at 0x575392
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
inc eax
xor ecx, ecx
cmp dword [esi + 0xc], ecx
push edi
mov edi, dword [esi + 0x24]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], ebx
je 0x5753b7
mov dl, byte [esi + 0x20]
mov byte [ebx], dl
cmp dword [ebp + 0x10], ecx
jne 0x5753df
push 0xc
push esi
mov dx, 0x10
call fcn.0057501c
push 0xc
push esi
mov dx, 0x10
call fcn.0057501c
cmp dword [esi + 0xc], 0
je 0x575438
inc dword [esi + 0x18]
jmp 0x575438
cmp dword [esi + 0x14], eax
jne 0x5753f3
push 0xc
push esi
mov dx, 0x10
mov dword [esi + 0x14], ecx
call fcn.0057501c
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 0x10]
mov eax, edi
call fcn.00574ed9
test eax, eax
jle 0x57541e
mov ebx, eax
push dword [ebp - 4]
movzx eax, word [edi]
push esi
call fcn.00575077
xor dword [ebp - 4], 1
inc edi
inc edi
dec ebx
jne 0x575406
mov ebx, dword [ebp + 0xc]
push 0xc
push esi
mov dx, 0x10
call fcn.0057501c
cmp dword [esi + 0xc], 0
je 0x575438
mov eax, dword [esi + 0x18]
mov al, byte [eax]
mov byte [esi + 0x20], al
mov eax, dword [esi + 0x18]
pop edi
pop esi
sub eax, ebx
pop ebx
leave
ret 0xc
Function at 0x575444
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi + 4]
push edi
mov edi, dword [esi + 0x24]
xor ebx, ebx
mov eax, edi
inc ebx
call fcn.00574ed9
mov ecx, dword [ebp + 0xc]
and dword [esi + 0xc], 0
test eax, eax
mov dword [esi + 0x18], ecx
jle 0x575485
mov dword [ebp + 8], eax
movzx eax, word [edi]
push ebx
push esi
call fcn.00575077
inc edi
inc edi
xor ebx, 1
dec dword [ebp + 8]
jne 0x575471
cmp dword [esi + 0xc], 0
je 0x57548e
inc dword [esi + 0x18]
mov eax, dword [esi + 0x18]
sub eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x58d525
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push dword [ecx + 0x1c]
mov esi, dword [ebx + 0x1c]
push dword [ecx + 0xf4]
shl esi, 3
push dword [ebp + 0xc]
lea eax, [esi + esi]
call fcn.0058d339
and dword [ebp - 4], 0
cmp dword [ebx + 0xc], 0
jle 0x58d5a0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub edx, ecx
mov dword [ebp - 8], edx
push edi
and dword [ebp + 0xc], 0
test esi, esi
mov edi, dword [edx + ecx]
mov eax, dword [ecx]
jbe 0x58d591
mov dword [ebp + 0x10], esi
movzx edx, byte [eax + 1]
movzx ebx, byte [eax]
add edx, dword [ebp + 0xc]
xor dword [ebp + 0xc], 1
add ebx, edx
sar ebx, 1
mov byte [edi], bl
inc edi
inc eax
inc eax
dec dword [ebp + 0x10]
jne 0x58d56f
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 8]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add ecx, 4
cmp eax, dword [ebx + 0xc]
jl 0x58d55f
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x58d648
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ecx + 0x1c]
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x1c]
push dword [ecx + 0xf4]
mov ebx, eax
shl esi, 3
lea eax, [esi + esi]
push ebx
call fcn.0058d339
and dword [ebp - 4], 0
cmp dword [edi + 0xc], 0
jle 0x58d6de
mov dword [ebp - 0x10], ebx
test esi, esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0xc], 1
jbe 0x58d6cf
mov dword [ebp - 0x14], esi
movzx edi, byte [eax + 1]
movzx edx, byte [ecx + 1]
movzx ebx, byte [eax]
add edx, edi
movzx edi, byte [ecx]
add edi, dword [ebp - 0xc]
xor dword [ebp - 0xc], 3
add edi, edx
mov edx, dword [ebp - 8]
add ebx, edi
sar ebx, 2
inc dword [ebp - 8]
inc eax
inc eax
inc ecx
inc ecx
dec dword [ebp - 0x14]
mov byte [edx], bl
jne 0x58d69d
mov edi, dword [ebp + 8]
add dword [ebp - 0x10], 8
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [edi + 0xc]
jl 0x58d67b
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x58e6db
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x58e70b
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
and dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
jmp 0x58e70b
mov eax, dword [esi]
mov dword [eax + 0x14], 0x31
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [esi + 0x1a8]
cmp dword [eax + 8], 0
jne 0x58e6fd
xor eax, eax
cmp dword [esi + 0x44], eax
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
ret
Function at 0x58e8cb
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x58e8fb
push esi
call fcn.00593b99
cmp dword [esi + 0x40], 0
je 0x58e8f4
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
jmp 0x58e98b
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x58e969
mov eax, dword [esi + 0x1b8]
cmp dword [eax + 0x10], 0
je 0x58e95b
mov eax, dword [esi + 8]
test eax, eax
je 0x58e91b
push esi
call dword [eax]
mov eax, dword [esi + 0x1b8]
push esi
call dword [eax]
test eax, eax
je 0x58e957
cmp eax, 2
je 0x58e95b
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x58e911
cmp eax, 3
je 0x58e93e
cmp eax, 1
jne 0x58e911
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x58e911
mov ecx, dword [esi + 0x144]
add dword [eax + 8], ecx
jmp 0x58e911
xor eax, eax
jmp 0x58e98b
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
jmp 0x58e986
cmp eax, 0xcc
je 0x58e986
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
call fcn.0058e6db
pop esi
ret 4
Function at 0x5e5710
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 4]
mov edx, 0x365
cmp eax, edx
ja 0x5e5848
je 0x5e5836
add edx, 0xfffffff4
cmp eax, edx
ja 0x5e57cc
je 0x5e57c1
sub eax, 0x1b5
je 0x5e57b6
sub eax, 0x10f
je 0x5e57a8
sub eax, 0x1d
je 0x5e579a
sub eax, 0x26
je 0x5e578c
sub eax, 0x4b
je 0x5e577e
dec eax
dec eax
je 0x5e5770
sub eax, 3
jne 0x5e592d
mov ecx, dword [ecx + 0x4c]
and ecx, 0x2000000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x4000000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x40000000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x8000000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x10000000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x20000000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x80000000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x1000000
jmp 0x5e583f
sub eax, 0x35c
je 0x5e582b
dec eax
je 0x5e5820
dec eax
je 0x5e5815
dec eax
je 0x5e580a
dec eax
je 0x5e57ff
dec eax
je 0x5e57f4
dec eax
jne 0x5e592d
mov ecx, dword [ecx + 0x4c]
and ecx, 0x20000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x40000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x80000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x100000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x200000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x400000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x800000
jmp 0x5e583f
mov ecx, dword [ecx + 0x4c]
and ecx, 0x10000
xor eax, eax
or eax, ecx
jmp 0x5e5926
mov edx, 0x4e4
cmp eax, edx
ja 0x5e58d6
je 0x5e58ce
sub eax, 0x36a
je 0x5e58c3
sub eax, 0x3a
je 0x5e58b8
sub eax, 4
je 0x5e58ad
sub eax, 0xd
je 0x5e58a2
dec eax
je 0x5e5894
sub eax, 0x12c
je 0x5e5889
dec eax
jne 0x5e592d
mov ecx, dword [ecx + 0x48]
and ecx, 4
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 2
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 0x100000
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 0x80000
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 0x40000
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 0x20000
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 0x10000
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 1
jmp 0x5e5922
sub eax, 0x4e5
je 0x5e591c
dec eax
je 0x5e5914
dec eax
je 0x5e590c
dec eax
je 0x5e5904
dec eax
je 0x5e58f9
sub eax, 0x68
jne 0x5e592d
mov ecx, dword [ecx + 0x48]
and ecx, 0x200000
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 0x80
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 0x40
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 0x20
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 0x10
jmp 0x5e5922
mov ecx, dword [ecx + 0x48]
and ecx, 8
xor eax, eax
or ecx, eax
je 0x5e592d
xor eax, eax
inc eax
jmp 0x5e592f
xor eax, eax
ret 4

Function at 0x5f9f04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cx, word [eax]
push 9
pop edx
mov dword [ebp + 8], ecx
lea ecx, [eax + 2]
mov ax, word [ebp + 8]
xor ax, word [ecx]
inc ecx
inc ecx
dec edx
jne 0x5f9f1a
pop ebp
ret 4
Function at 0x61ad1b
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x61ad2a
xor eax, eax
jmp 0x61adfb
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x61addd
push edi
mov edi, eax
shr edi, 3
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x39825798]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x39825798]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x39825798]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x39825798]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x39825798]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x39825798]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x39825798]
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x39825798]
inc edx
dec edi
jne 0x61ad4a
pop edi
test eax, eax
je 0x61adf5
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x39825798]
inc edx
dec eax
jne 0x61ade1
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x61b2f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x61b31f
test ecx, ecx
jne 0x61b329
test esi, esi
jne 0x61b329
mov eax, edx
jmp 0x61b39a
cmp eax, 0xffffffff
jne 0x61b329
push 0xfffffffffffffffe
pop eax
jmp 0x61b39a
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x61b39a
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x61b35f
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x61b37e
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x61b447
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x61b3bf
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x61b3c9
xor ecx, ecx
jmp 0x61b408
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x61b3eb
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.0061c62f
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x61b433
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x61b447
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x61b301
pop edi
pop esi
leave
ret
Function at 0x6f56e3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100e1b19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0070b9e3
lea ebx, [esi + 0x30]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x18], edi
call fcn.00711ec3
lea ecx, [esi + 0x8140]
mov byte [esp + 0x18], 1
call fcn.007104c3
lea ecx, [esi + 0x91b8]
mov byte [esp + 0x18], 2
call fcn.0070e2e3
lea ecx, [esi + 0x9288]
mov byte [esp + 0x18], 3
call fcn.00726003
lea ecx, [esi + 0x92c8]
mov byte [esp + 0x18], 4
call fcn.00726403
lea ecx, [esi + 0xa320]
mov byte [esp + 0x18], 5
call fcn.00723db3
xor eax, eax
lea ecx, [esi + 0xa39c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea ecx, [esi + 0xa5c0]
mov byte [esp + 0x18], 6
call fcn.006ec483
push 0x100e652c
lea edx, [esi + 0xa3b0]
push edx
mov dword [esi + 0xa368], edi
mov dword [esi + 0xa36c], edi
mov dword [esi + 0xa370], edi
mov dword [esi + 0xa374], edi
mov dword [esi + 0xa378], edi
mov dword [esi + 0xa380], edi
mov dword [esi + 0xa384], edi
mov dword [esi + 0xa38c], edi
mov dword [esi + 0xa388], edi
mov dword [esi + 0xa394], edi
mov dword [esi + 0xa398], edi
mov dword [esi + 0xa3ac], edi
mov dword [esi + 0x915c], ebx
call dword [0x100e53a8]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xa5b8], edi
mov dword [esi + 0xa5bc], edi
mov dword [esi + 0xa5e0], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x6f56fa
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100e1b19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0070b9e3
lea ebx, [esi + 0x30]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x18], edi
call fcn.00711ec3
lea ecx, [esi + 0x8140]
mov byte [esp + 0x18], 1
call fcn.007104c3
lea ecx, [esi + 0x91b8]
mov byte [esp + 0x18], 2
call fcn.0070e2e3
lea ecx, [esi + 0x9288]
mov byte [esp + 0x18], 3
call fcn.00726003
lea ecx, [esi + 0x92c8]
mov byte [esp + 0x18], 4
call fcn.00726403
lea ecx, [esi + 0xa320]
mov byte [esp + 0x18], 5
call fcn.00723db3
xor eax, eax
lea ecx, [esi + 0xa39c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea ecx, [esi + 0xa5c0]
mov byte [esp + 0x18], 6
call fcn.006ec483
push 0x100e652c
lea edx, [esi + 0xa3b0]
push edx
mov dword [esi + 0xa368], edi
mov dword [esi + 0xa36c], edi
mov dword [esi + 0xa370], edi
mov dword [esi + 0xa374], edi
mov dword [esi + 0xa378], edi
mov dword [esi + 0xa380], edi
mov dword [esi + 0xa384], edi
mov dword [esi + 0xa38c], edi
mov dword [esi + 0xa388], edi
mov dword [esi + 0xa394], edi
mov dword [esi + 0xa398], edi
mov dword [esi + 0xa3ac], edi
mov dword [esi + 0x915c], ebx
call dword [0x100e53a8]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xa5b8], edi
mov dword [esi + 0xa5bc], edi
mov dword [esi + 0xa5e0], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x6f7303
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100e1cb4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x10a8]
mov dword [esp + 0xc], esi
mov dword [esi], 0x100e914c
call fcn.006f56e3
xor ebp, ebp
lea ecx, [esi + 0xb698]
mov dword [esp + 0x18], ebp
call fcn.00736a63
lea ecx, [esi + 0x4a0f8]
mov byte [esp + 0x18], 1
call fcn.00755a03
lea ecx, [esi + 0x4a938]
mov byte [esp + 0x18], 2
call fcn.00757223
lea ecx, [esi + 0x4a988]
mov byte [esp + 0x18], 3
call fcn.006f20a3
lea ecx, [esi + 0x4b580]
mov byte [esp + 0x18], 4
call fcn.0070a3b3
lea edx, [esi + 0x3c]
xor eax, eax
mov edi, edx
mov dword [esi + 4], 0x50
mov dword [esi + 8], ebp
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x38], ebp
mov ecx, 0x402
rep stosd dword es:[edi], eax
mov edi, dword [0x100e538c]
lea eax, [esi + 0x1044]
push eax
mov byte [esp + 0x1c], 5
mov dword [edx], ebp
call edi
lea ecx, [esi + 0x1064]
push ecx
mov dword [esi + 0x105c], ebp
mov dword [esi + 0x1060], 0xffffffff
call edi
lea edx, [esi + 0x108c]
push edx
mov dword [esi + 0x107c], ebp
mov dword [esi + 0x1080], ebp
mov dword [esi + 0x1084], ebp
mov dword [esi + 0x1088], ebp
call edi
push ebp
push ebp
push 1
push ebp
mov dword [esi + 0x10a4], ebp
mov dword [esi + 0xb690], ebp
call dword [0x100e52f8]
cmp eax, ebp
mov dword [esi + 0x4b5d4], eax
jne 0x6f7456
call dword [0x100e53a4]
push eax
push 0x100e97f8
push 0x1013e6d8
call fcn.00705083
add esp, 0xc
mov edi, dword [0x100e53a8]
push 0x100e652c
lea eax, [esi + 0x4b5d8]
push eax
call edi
push 0x100e652c
lea ecx, [esi + 0x4b7e4]
push ecx
mov dword [esi + 0x4b7e0], ebp
call edi
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x70a3b3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100e2468
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea edi, [esi + 4]
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], ebx
mov word [esi + 0x30], bx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x70a41a
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 8]
push ecx
push edi
push edx
push eax
call fcn.00708f93
mov eax, dword [edi + 4]
push eax
call fcn.007601b8
add esp, 0x14
mov ecx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [esi + 0x4c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret