joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4761db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
call fcn.00476102
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
and dword [ebp - 4], 0xffff0000
mov esi, eax
je 0x476247
call fcn.00476108
mov edx, eax
mov eax, ebx
call fcn.00476099
test eax, eax
jne 0x476213
mov eax, dword [esi + 0xc]
jmp 0x476376
call fcn.0047611e
mov edx, eax
mov eax, ebx
call fcn.00476099
test eax, eax
jne 0x47622d
mov eax, dword [esi + 0x10]
jmp 0x476376
call fcn.00476132
mov edx, eax
mov eax, ebx
call fcn.00476099
test eax, eax
jne 0x476247
mov eax, dword [esi + 0x14]
jmp 0x476376
call fcn.004760f6
xor esi, esi
xor cl, cl
cmp dword [eax], esi
je 0x476273
test cl, cl
jne 0x476281
mov edx, dword [ebp + 8]
cmp dword [eax + 4], edx
jne 0x476264
inc cl
jmp 0x47626b
mov edx, dword [eax + 0xc]
lea eax, [eax + edx + 0x11]
cmp dword [eax], esi
jne 0x476254
test cl, cl
jne 0x476281
push ebx
push dword [ebp + 8]
call fcn.004761a5
jmp 0x476376
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x78]
mov dword [ebp - 0x1c], edi
add edi, ecx
mov ecx, dword [edi + 0x1c]
add ecx, dword [ebp + 8]
cmp dword [ebp - 4], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], ecx
jne 0x4762c3
mov edx, dword [edi + 0x10]
mov esi, dword [edi + 0x14]
add esi, edx
cmp ebx, esi
jbe 0x4762b9
xor eax, eax
jmp 0x476375
sub ebx, edx
mov esi, dword [ecx + ebx*4]
add esi, dword [ebp + 8]
jmp 0x476337
mov edx, dword [edi + 0x24]
add edx, dword [ebp + 8]
mov ecx, dword [edi + 0x20]
add ecx, dword [ebp + 8]
and dword [ebp - 8], esi
mov dword [ebp - 0x14], edx
mov edx, dword [edi + 0x18]
dec edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
js 0x476337
jmp 0x4762e9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
test esi, esi
jne 0x476337
mov eax, dword [ebp - 8]
add eax, edx
cdq
sub eax, edx
mov edx, dword [ebp + 0xc]
mov ebx, eax
sar ebx, 1
mov eax, dword [ecx + ebx*4]
add eax, dword [ebp + 8]
call fcn.00476099
cmp eax, 1
jne 0x476311
mov dword [ebp - 4], ebx
jmp 0x47632c
cmp eax, 0xffffffff
jne 0x47631c
inc ebx
mov dword [ebp - 8], ebx
jmp 0x47632c
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + ebx*2]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + eax*4]
add esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
jle 0x4762e3
cmp esi, edi
jbe 0x476373
mov eax, dword [eax + 0x7c]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp + 8]
cmp esi, eax
jae 0x476373
xor eax, eax
cmp byte [esi], 0x2e
je 0x476356
inc eax
cmp byte [eax + esi], 0x2e
jne 0x47634f
lea edi, [eax + esi + 1]
mov ebx, dword [edi]
push esi
mov dword [edi], 0x4c4c44
call fcn.004763f9
push edi
push eax
mov dword [edi], ebx
call fcn.004761db
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x419677
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [esp + 0x3c]
xor ebx, ebx
cmp esi, 1
je 0x4196a7
cmp esi, 2
je 0x4196a7
cmp esi, 4
je 0x4196a7
cmp esi, 8
je 0x4196a7
cmp esi, 0x18
je 0x4196a7
cmp esi, 0x20
je 0x4196a7
xor eax, eax
jmp 0x419871
mov ecx, dword [0x3657e5c]
push ebp
push edi
xor edi, edi
mov dword [esp + 0x10], edi
test ecx, ecx
jle 0x41986d
mov edx, dword [esp + 0x28]
mov eax, dword [edi*4 + 0x3658068]
cmp dword [eax], edx
je 0x4196da
inc edi
mov dword [esp + 0x10], edi
cmp edi, ecx
jl 0x4196c1
jmp 0x41986d
cmp dword [esp + 0x38], 0x20
jne 0x419844
mov eax, dword [eax + 8]
test eax, eax
je 0x41971a
cmp esi, 0x20
je 0x4196f6
cmp esi, 0xffffffff
jne 0x41971a
push esi
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call eax
jmp 0x41986b
mov eax, dword [esp + 0x2c]
inc eax
imul ebp, eax, 3
and ebp, 0xfffffffc
mov eax, ebp
mov dword [esp + 0x14], ebp
imul eax, dword [esp + 0x30]
push eax
push 0
push dword [0x3656df4]
call dword [0x3654bf4]
mov dword [esp + 0x18], eax
test eax, eax
je 0x41986d
mov ebx, dword [esp + 0x30]
test ebx, ebx
jle 0x41980f
mov edx, dword [esp + 0x24]
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
mov esi, edx
test eax, eax
jle 0x4197ef
mov ebp, ecx
mov edi, eax
mov ecx, 0xff
movzx eax, byte [esi + 2]
sub eax, ecx
movzx ecx, byte [esi + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp + 2], al
movzx eax, byte [esi + 1]
sub eax, ecx
movzx ecx, byte [esi + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp + 1], al
movzx eax, byte [esi]
lea esi, [esi + 4]
sub eax, ecx
movzx ecx, byte [esi - 1]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp], al
lea ebp, [ebp + 3]
dec edi
jne 0x419780
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
add edx, dword [esp + 0x34]
add ecx, ebp
dec dword [esp + 0x24]
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ecx
jne 0x41976d
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x3658068]
push esi
push dword [esp + 0x44]
mov esi, dword [esp + 0x20]
push dword [esp + 0x44]
push ebp
push ebx
push dword [esp + 0x40]
push esi
push dword [esp + 0x3c]
call dword [eax + 4]
push esi
push 0
push dword [0x3656df4]
mov ebx, eax
call dword [0x3654bf8]
jmp 0x41986d
cmp dword [esp + 0x38], 0x18
jne 0x41986d
push esi
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [eax + 4]
mov ebx, eax
pop edi
mov eax, ebx
pop ebp
pop esi
pop ebx
add esp, 0xc
ret 0x28
Function at 0x100015f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
push ebx
push esi
push edi
call fcn.100031f7
mov esi, eax
test esi, esi
je 0x10001879
mov ecx, esi
call fcn.10001d40
lea eax, [esp + 0x10]
mov word [esp + 0x10], 0x7962
push eax
mov eax, dword [esi + 0x64]
push 0
push 0
push 0
mov dword [esp + 0x23], 0x756f4365
mov byte [esp + 0x22], 0x74
mov word [esp + 0x28], 0x74
mov byte [esp + 0x27], 0x6e
call eax
mov edi, eax
test edi, edi
je 0x100016db
mov ecx, dword [esi + 0x60]
call ecx
cmp eax, 0xb7
jne 0x10001661
mov eax, dword [esi + 0x1c]
push edi
jmp 0x100016d9
lea eax, [esp + 0x20]
push eax
mov eax, dword [esi + 0x84]
push 0x202
call eax
lea eax, [esi + 0xe4]
mov dword [esi + 0x4f8], eax
mov dword [esi + 0x6c8], eax
mov eax, dword [esi + 0x50]
call eax
imul eax, eax, 0x2c31
lea edi, [esi + 0x500]
mov dword [esp + 0x1c], 0x1ff
mov dword [esi + 0x604], eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0x10]
push edi
call eax
test eax, eax
jne 0x100016b8
mov word [edi], 0x3f
mov eax, dword [esi + 0x4c]
push edi
call eax
inc eax
mov dword [esi + 0x6e4], 0xffffffff
mov dword [esi + 0x600], eax
lea eax, [esi + 0x6cc]
push eax
mov eax, dword [esi + 0x54]
call eax
mov ecx, esi
call fcn.10001f20
xor edi, edi
lea ebx, [esi + 0xd4]
nop word [eax + eax]
xor edx, edx
nop dword [eax]
nop word [eax + eax]
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [edx + eax], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [edx + eax + 1], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [edx + eax + 2], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [edx + eax + 3], cl
add edx, 4
cmp edx, 0x100
jl 0x10001700
mov eax, dword [esi + 0x4f8]
mov byte [eax + 0x110], 0
mov eax, dword [esi + 0x4f8]
add eax, 0x100
push eax
push 0x10
push ebx
call fcn.10003235
add esp, 0xc
lea eax, [esi + 0x500]
push eax
mov eax, dword [esi + 0x4f8]
add eax, 0x111
push eax
mov eax, dword [esi + 0x48]
call eax
mov eax, dword [esi + 0x600]
xor ebx, ebx
add eax, 0x111
mov dword [esi + 0x4fc], eax
add eax, 0xffffff00
je 0x10001809
mov ecx, dword [esi + 0x4f8]
movzx eax, bl
lea edx, [ecx + ebx]
inc ebx
mov al, byte [eax + ecx]
xor byte [edx + 0x100], al
mov eax, dword [esi + 0x4fc]
sub eax, 0x100
cmp ebx, eax
jb 0x100017e4
mov ecx, esi
call fcn.10002060
test eax, eax
je 0x10001829
mov ecx, esi
call fcn.10001080
lea ebx, [esi + 0xd4]
test eax, eax
jne 0x100016f0
mov eax, dword [esi + 0x6c0]
add eax, 1
mov dword [esi + 0x6c0], eax
js 0x10001842
cmp eax, dword [esi + 0x6c4]
jl 0x1000184c
mov dword [esi + 0x6c0], 0
mov eax, dword [esi + 0x18]
push 0xafc8
call eax
add edi, 0x2d
lea ebx, [esi + 0xd4]
cmp edi, 0x708
jl 0x100016f0
mov ecx, esi
xor edi, edi
call fcn.10001f20
jmp 0x100016e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.10001a00
push 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x24], 0x775c3a63
push ecx
lea eax, [esi + 0x10]
mov dword [ebp - 0x15], 0x32336d65
push eax
lea eax, [esi + 4]
mov dword [ebp - 0xf], 0x652e646d
push eax
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x1a], 0x7379735c
mov dword [ebp - 0x1f], 0x776f646e
mov word [ebp - 0xb], 0x6578
mov word [ebp - 0x11], 0x635c
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 9], 0
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x1b], 0x73
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 1
call eax
test eax, eax
jne 0x10001b5c
mov dword [ebp - 8], 0x92
jmp 0x10001c34
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0xc
push eax
lea eax, [esi + 8]
mov dword [ebp - 0x38], 0
push eax
mov eax, dword [edi + 0x2c]
lea ebx, [esi + 0xc]
push ebx
mov dword [ebp - 0x34], 1
call eax
test eax, eax
jne 0x10001b94
mov dword [ebp - 8], 0x9b
jmp 0x10001c34
lea eax, [ebp - 0x94]
push 0x44
push eax
call fcn.1000320e
xor eax, eax
mov dword [ebp - 0x94], 0x44
mov word [ebp - 0x64], ax
mov eax, dword [ebx]
mov dword [ebp - 0x5c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x4c]
push 0x10
push eax
mov dword [ebp - 0x68], 0x101
call fcn.1000320e
add esp, 0x10
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp + 8]
test eax, eax
push 0
push 0
push 0
push 1
push 0
push 0
cmovne ecx, eax
mov eax, dword [edi + 0x30]
push 0
push ecx
call eax
test eax, eax
jne 0x10001c0c
mov dword [ebp - 8], 0xb5
jmp 0x10001c34
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x4c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x44]
push 8
push edi
mov dword [esi + 0x24], eax
call fcn.1000329f
add esp, 8
test eax, eax
jne 0x10001c5d
mov dword [ebp - 8], 0xc3
push 2
lea eax, [ebp - 8]
mov edx, 6
push eax
movzx eax, byte [esi]
mov ecx, edi
push eax
call fcn.10002440
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.10001a00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
mov dword [eax], edi
mov dword [eax + 4], esi
push 0x10001880
mov dword [esi + 0x14], 1
call fcn.100032f0
add esp, 4
push eax
mov eax, dword [edi + 0x20]
push 0
push 0
call eax
mov dword [esi + 0x18], eax
test eax, eax
jne 0x10001c92
mov dword [eax], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
mov word [ebp - 0x17], 0x7365
push ebx
push 0x80
push 3
push ebx
push 1
mov esi, ecx
mov dword [ebp - 0x27], 0x73755c3a
push 0x80000000
lea eax, [ebp - 0x28]
mov dword [ebp - 0xc], 0x696e69
push eax
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x23], 0x5c737265
mov word [ebp - 0x1f], 0x7570
mov dword [ebp - 0x10], 0x2e6e6f69
mov dword [ebp - 0x1c], 0x5c63696c
mov dword [ebp - 0x15], 0x70697263
mov byte [ebp - 0x1d], 0x62
mov byte [ebp - 0x28], 0x63
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x11], 0x74
call eax
mov dword [ebp - 8], eax
lea edi, [esi + 0xd4]
cmp eax, 0xffffffff
je 0x10001de8
push ebx
lea ecx, [ebp - 4]
push ecx
push 0x10
push edi
push eax
mov eax, dword [esi + 0x38]
call eax
test eax, eax
je 0x10001dd8
cmp dword [ebp - 4], 0x10
mov eax, 1
cmove ebx, eax
push dword [ebp - 8]
mov eax, dword [esi + 0x1c]
call eax
test ebx, ebx
jne 0x10001e73
mov eax, dword [esi + 0xb8]
push edi
call eax
test eax, eax
je 0x10001e33
xor edx, edx
nop word [eax + eax]
imul ecx, dword [esi + 0x604], 0x343fd
add ecx, 0x269ec3
imul eax, ecx, 0x343fd
movsx ecx, cl
add eax, 0x269ec3
mov dword [esi + 0x604], eax
movsx eax, al
imul ecx, eax
mov byte [edx + edi], cl
inc edx
cmp edx, 0x10
jb 0x10001e00
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 0x44]
call eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 0x40]
call eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001e73
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x3c]
push 0x10
push edi
push ebx
call eax
mov eax, dword [esi + 0x1c]
push ebx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x12], 0x6d6f632e
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], 0x6e65706f
push 0x20
push eax
mov dword [edi + 0x6c0], 0
mov dword [ebp - 0x1c], 0x76726573
mov dword [ebp - 0xe], 0x436d0000
mov dword [ebp - 0x18], 0x616e7265
mov word [ebp - 0x14], 0x656d
mov dword [edi + 0x6c4], 3
mov dword [ebp - 4], 0
call fcn.1000320e
add esp, 8
mov dword [ebp - 0x3c], 2
lea eax, [ebp - 4]
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x38], 1
push eax
lea eax, [ebp - 0x40]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [edi + 0xa4]
call eax
mov ebx, 2
test eax, eax
jne 0x1000200c
mov ecx, dword [ebp - 4]
mov eax, ecx
test eax, eax
je 0x1000200c
cmp dword [eax + 0x10], 0x10
je 0x10001fd9
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x10001fc1
mov eax, dword [edi + 0xa8]
push ecx
call eax
jmp 0x1000200c
mov eax, dword [eax + 0x18]
push ecx
mov esi, dword [eax + 4]
mov eax, dword [edi + 0xa8]
call eax
inc dword [edi + 0x6c4]
mov word [ebp - 4], 0xbb01
mov ax, word [ebp - 4]
mov word [edi + 0x620], bx
mov dword [edi + 0x624], esi
mov word [edi + 0x622], ax
mov word [ebp - 4], 0xbb01
movzx eax, word [ebp - 4]
mov word [edi + 0x632], ax
mov word [ebp - 4], 0xbb01
movzx eax, word [ebp - 4]
mov word [edi + 0x630], bx
mov word [edi + 0x640], bx
mov dword [edi + 0x634], 0x24954692
mov dword [edi + 0x644], 0xc15b1c67
mov word [edi + 0x642], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002260
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, ecx
mov ecx, 1
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
mov edx, dword [ebx + 0x6e4]
xor esi, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], ecx
nop word [eax + eax]
mov eax, dword [ebx + 0x94]
test ecx, ecx
je 0x10002355
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x134], edx
push ecx
push 0
push 0
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x138], 1
push ecx
push 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0
call eax
test eax, eax
js 0x1000242f
jne 0x100022df
inc edi
jmp 0x100023c6
push 0
mov eax, 5
sub eax, esi
push eax
lea eax, [ebp - 0x14]
add eax, esi
push eax
push dword [ebp - 0x18]
mov eax, dword [ebx + 0x9c]
call eax
test eax, eax
jle 0x1000242f
add esi, eax
inc edi
cmp esi, 5
jne 0x100023c6
cmp byte [ebp - 0x14], 0x17
jne 0x1000242f
cmp byte [ebp - 0x13], 3
jne 0x1000242f
cmp byte [ebp - 0x12], 3
jne 0x1000242f
movzx eax, byte [ebp - 0x11]
mov byte [ebp - 3], al
movzx eax, byte [ebp - 0x10]
mov byte [ebp - 4], al
movzx ebx, word [ebp - 4]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x1000242f
mov ebx, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
jmp 0x100023c9
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
sub ecx, esi
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x240], 1
push ecx
push 0
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 0
call eax
test eax, eax
js 0x1000242f
jne 0x1000239d
inc edi
jmp 0x100023c3
mov ecx, dword [ebp - 0xc]
push 0
push dword [ebp - 0x20]
lea eax, [ecx + 0x6ec]
add eax, esi
push eax
push dword [ebp - 0x18]
mov eax, dword [ecx + 0x9c]
call eax
test eax, eax
jle 0x1000242f
add esi, eax
cmp esi, ebx
je 0x100023d6
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp edi, 0x5a
jge 0x1000242f
mov edx, dword [ebp - 0x18]
jmp 0x10002290
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
test esi, esi
je 0x1000242f
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x6c8]
lea edx, [edi + ebx]
movzx ecx, bl
inc ebx
mov al, byte [ecx + eax]
xor byte [edx + 0x6ec], al
cmp ebx, esi
jb 0x100023e2
cmp esi, 2
jb 0x1000242f
lea eax, [esi - 2]
mov dword [edi + 0x618], eax
movsx eax, byte [edi + 0x6ec]
mov dword [edi + 0x610], eax
mov al, byte [edi + 0x6ed]
mov byte [edi + 0x614], al
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
add eax, 7
push edi
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x58]
lea ebx, [esi + 0x6cc]
push ebx
call eax
cmp dword [esi + 0x6e8], 0
je 0x1000247b
mov eax, dword [esi + 0x5c]
push ebx
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
lea edi, [edx + 2]
cmp edi, 0xffff
ja 0x100024ad
movzx ecx, di
mov eax, ecx
mov word [esi + 0x106eb], 0x317
shr eax, 8
mov byte [esi + 0x106ed], 3
mov byte [esi + 0x106ee], al
mov byte [esi + 0x106ef], cl
mov eax, dword [ebp - 4]
mov byte [esi + 0x106f0], al
mov al, byte [ebp + 8]
mov byte [esi + 0x106f1], al
test edx, edx
je 0x100024d6
lea eax, [esi + 0x106f2]
push eax
push edx
push dword [ebp + 0xc]
call fcn.10003235
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x100024fa
nop dword [eax]
mov eax, dword [esi + 0x6c8]
lea edx, [esi + ebx]
movzx ecx, bl
inc ebx
mov al, byte [ecx + eax]
xor byte [edx + 0x106f0], al
cmp ebx, edi
jb 0x100024e0
push dword [ebp - 8]
mov edx, dword [esi + 0x6e4]
lea eax, [esi + 0x106eb]
push eax
push ecx
mov ecx, esi
call fcn.10003330
mov ecx, dword [esi + 0x5c]
add esp, 0xc
test eax, eax
lea eax, [esi + 0x6cc]
push eax
jne 0x10002538
mov dword [esi + 0x6e8], 1
call ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call ecx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100025e0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword fs:[0x30]
push ebx
mov dword [ebp - 0x20], edx
xor ebx, ebx
push esi
mov eax, dword [eax + 0xc]
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 0x14]
mov dword [ebp - 4], eax
mov edx, dword [eax + 4]
mov dword [ebp - 0xc], edx
cmp eax, edx
je 0x1000267e
nop word [eax + eax]
cmp word [eax + 0x24], 0x30
ja 0x10002673
mov esi, dword [eax + 0x28]
xor edi, edi
movzx ecx, word [esi]
mov dword [ebp - 8], ecx
test cx, cx
je 0x10002660
mov eax, ecx
nop dword [eax]
lea ecx, [eax + 0x20]
lea ebx, [eax - 0x41]
movzx edx, cl
movzx ecx, al
lea esi, [esi + 2]
cmp bl, 0x19
cmova edx, ecx
movzx ecx, word [esi]
imul edi, edi, 0xc85e31
mov al, cl
movsx edx, dl
add edi, edx
test cx, cx
jne 0x10002630
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp edi, dword [ebp - 0x10]
je 0x10002726
cmp dword [eax + 0x10], 0
je 0x10002714
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp eax, edx
jne 0x10002610
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
test ebx, ebx
je 0x1000271d
mov eax, dword [ebx + 0x3c]
xor edi, edi
mov ecx, dword [eax + ebx + 0x78]
mov edx, dword [eax + ebx + 0x50]
add ecx, ebx
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], edx
mov esi, dword [ecx + 0x20]
mov eax, dword [ecx + 0x14]
add esi, ebx
mov dword [ebp - 0x10], esi
mov esi, dword [ecx + 0x24]
add esi, ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x1c]
add esi, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], esi
xor esi, esi
test eax, eax
je 0x10002740
nop dword [eax]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + esi*4]
add ecx, ebx
lea eax, [ecx + 0xdc]
cmp edx, eax
jbe 0x1000270c
mov al, byte [ecx]
xor edx, edx
test al, al
je 0x10002704
nop word [eax + eax]
imul edx, edx, 0xc85e31
lea ecx, [ecx + 1]
movsx eax, al
add edx, eax
mov al, byte [ecx]
test al, al
jne 0x100026f0
cmp edx, dword [ebp + 8]
je 0x1000272e
mov edx, dword [ebp - 0xc]
inc esi
cmp esi, dword [ebp - 8]
jb 0x100026d0
jmp 0x1000273d
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x10]
jmp 0x1000267e
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
movzx eax, word [eax + esi*2]
mov edi, dword [edi + eax*4]
add edi, ebx
mov ecx, dword [ebp - 4]
cmp edi, ecx
jb 0x1000275f
mov eax, dword [ebp - 0x1c]
add eax, ecx
cmp edi, eax
jae 0x1000275f
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
test edi, edi
je 0x1000271d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x20]
push edi
mov ecx, dword [eax]
call fcn.10002550
mov ecx, dword [ebp + 0x10]
add esp, 4
mov edx, eax
xor eax, eax
test edx, edx
pop edi
pop esi
mov dword [ecx], edx
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a9e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1000a600
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000aa12
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x10038144]
call dword [ebp - 8]
jmp 0x1000aa1c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret