joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100409b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10040ab8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10040ab8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10040ab8
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.1003f6d0
add esp, 0x10
cmp eax, 2
je 0x100409f9
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x100409ed
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.1003f6d0
add esp, 0x10
cmp eax, 4
jne 0x100409ed
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10040a28
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.1003f6d0
add esp, 0x10
cmp eax, 2
jne 0x100409ed
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x10040a83
cmp eax, 0x8664
jne 0x100409ed
push 0x108
push ebx
push edi
push esi
call fcn.1003f6d0
add esp, 0x10
cmp eax, 0x108
jne 0x100409ed
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.1003f6d0
add esp, 0x10
cmp eax, 0xf8
jne 0x100409ed
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x10001ec0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 8]
lea edx, [ecx*8]
mov eax, 0x2aaaaaab
imul edx
mov eax, edx
shr eax, 0x1f
push esi
mov esi, dword [esp + 0x14]
add eax, edx
cmp esi, eax
jl 0x1000204c
cmp ecx, 3
jne 0x10001f4e
mov eax, dword [esp + 8]
movzx ecx, byte [eax]
shr ecx, 2
mov dl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [esp + 0x10]
mov byte [ecx], dl
movzx esi, byte [eax + 1]
xor edx, edx
mov dl, byte [eax]
shr esi, 4
and edx, 3
shl edx, 4
or edx, esi
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
movzx esi, byte [eax + 2]
xor edx, edx
mov dl, byte [eax + 1]
shr esi, 6
and edx, 0xf
shl edx, 2
or edx, esi
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
movzx eax, byte [eax + 2]
and eax, 0x3f
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], dl
xor eax, eax
pop esi
ret
cmp ecx, 2
jne 0x10001f9e
mov eax, dword [esp + 8]
movzx ecx, byte [eax]
shr ecx, 2
mov dl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [esp + 0x10]
mov byte [ecx], dl
movzx esi, byte [eax + 1]
xor edx, edx
mov dl, byte [eax]
shr esi, 4
and edx, 3
shl edx, 4
or edx, esi
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
movzx eax, byte [eax + 1]
and eax, 0xf
mov dl, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
xor eax, eax
pop esi
ret
cmp ecx, 1
jne 0x10001fd7
mov ecx, dword [esp + 8]
movzx eax, byte [ecx]
shr eax, 2
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [esp + 0x10]
mov byte [eax], dl
movzx ecx, byte [ecx]
and ecx, 3
shl ecx, 4
mov dl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov cl, 0x3d
mov byte [eax + 1], dl
mov byte [eax + 2], cl
mov byte [eax + 3], cl
xor eax, eax
pop esi
ret
mov eax, ecx
cdq
mov ecx, 3
idiv ecx
push ebx
xor ebx, ebx
test eax, eax
mov dword [esp + 0x10], edx
jle 0x10002021
mov esi, dword [esp + 0x14]
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, eax
mov ebx, eax
lea ebx, [ebx]
push 4
push esi
push 3
push edi
call fcn.10001ec0
add esp, 0x10
add esi, 4
add edi, 3
dec ebp
jne 0x10002000
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
pop edi
pop ebp
test edx, edx
jle 0x10002049
mov ecx, dword [esp + 0x14]
lea eax, [ebx*4]
sub esi, eax
add eax, ecx
push esi
push eax
push edx
mov edx, dword [esp + 0x18]
lea eax, [edx + ebx*2]
add eax, ebx
push eax
call fcn.10001ec0
add esp, 0x10
pop ebx
xor eax, eax
pop esi
ret
Function at 0x100027e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [0x10016180]
movzx ecx, word [esp + 8]
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x10002818
pop edi
xor al, al
pop ebx
mov ecx, dword [esp]
call fcn.10009483
pop ecx
ret 0x14
push ebp
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea edx, [ebx + 1]
push edx
call fcn.1000886d
mov edx, dword [esp + 0x2c]
mov ebp, eax
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
add esp, 4
cmp edx, 0x3e8
mov dword [esp + 0x1c], ecx
jl 0x10002875
mov eax, edx
cdq
mov esi, 0x3e8
idiv esi
mov dword [esp + 0x1c], eax
cmp ebx, ecx
jle 0x10002890
lea esp, [esp]
mov al, byte [esp + 0x1c]
imul cl
add al, dl
sub byte [ecx + ebp], al
inc ecx
cmp ecx, ebx
jl 0x10002880
mov eax, ebp
mov byte [ebx + ebp], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100028a0
mov ecx, dword [esp + 0x20]
sub eax, edx
push eax
push ebp
call fcn.100015a0
push ebp
call fcn.1000944d
mov ecx, dword [esp + 0x14]
add esp, 4
pop esi
pop ebp
pop edi
mov al, 1
pop ebx
call fcn.10009483
pop ecx
ret 0x14
Function at 0x10002aa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10011c2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x102c
call fcn.100094a0
mov eax, dword [0x10016180]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
mov dword [esp + 0x1048], eax
mov eax, dword [ebp + 0xc]
push 0x80000000
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10002b1d
mov esi, dword [ebp + 8]
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x1001316c
mov ecx, esi
mov byte [esi + 4], bl
call fcn.100015a0
jmp 0x10002bf7
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov byte [esp + 0x30], bl
xor eax, eax
mov ecx, 0x3ff
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
push ebx
lea ecx, [esp + 0x14]
push ecx
stosw word es:[edi], ax
push 0xfff
lea edx, [esp + 0x3c]
push edx
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov dword [esp + 0x1058], ebx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
je 0x10002bc4
lea esp, [esp]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
jbe 0x10002bc4
xor eax, eax
cmp ecx, ebx
mov byte [esp + ecx + 0x30], bl
jbe 0x10002b8e
mov dl, byte [ebp + 0x10]
sub byte [esp + eax + 0x30], dl
inc eax
cmp eax, ecx
jb 0x10002b82
lea eax, [esp + 0x30]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002b95
sub eax, edx
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.100024e0
push ebx
lea ecx, [esp + 0x14]
push ecx
push 0xfff
lea edx, [esp + 0x3c]
push edx
push esi
call edi
test eax, eax
jne 0x10002b70
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1c]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.100014b0
cmp dword [esp + 0x2c], 0x10
jb 0x10002bf7
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10008c5d
add esp, 4
mov ecx, dword [esp + 0x103c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1034]
mov eax, esi
call fcn.10009483
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002c20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10011c4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x438
mov eax, dword [0x10016180]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov dword [esp + 0x438], eax
push edi
lea eax, [esp + 0x14]
push eax
push ecx
xor ebx, ebx
push edx
mov dword [esp + 0x1c], ebx
call fcn.10001e40
mov ecx, eax
call fcn.10001010
test eax, eax
push ebx
push 0x1001316c
je 0x10002c95
mov esi, dword [ebp + 8]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.100015a0
jmp 0x10002d5c
mov byte [esp + 0x40], bl
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0xf
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0x400
mov dword [esp + 0x18], 1
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.100015a0
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push ebx
push eax
push ecx
mov dword [esp + 0x464], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002d1c
lea eax, [esp + 0x38]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002d04
sub eax, edx
push eax
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x24]
call fcn.100015a0
mov eax, dword [esp + 0x14]
push eax
call fcn.10001e40
mov ecx, eax
call fcn.10001020
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x24]
push ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.100014b0
cmp dword [esp + 0x34], 0x10
jb 0x10002d5c
mov edx, dword [esp + 0x20]
push edx
call fcn.10008c5d
add esp, 4
mov ecx, dword [esp + 0x444]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x43c]
mov eax, esi
call fcn.10009483
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002d80
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10011c68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [0x10016180]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
lea eax, [esp + 4]
push eax
push ecx
push edx
call fcn.10001e40
mov ecx, eax
call fcn.10001010
test eax, eax
je 0x10002dc7
xor al, al
jmp 0x10002e67
push ebx
mov eax, 4
push 0
push 0x1001316c
lea ecx, [esp + 0x1c]
mov bl, 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.100015a0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x54], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10002e35
xor bl, bl
jmp 0x10002e3f
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 4]
mov dword [edx], eax
mov ecx, dword [esp + 8]
push ecx
call fcn.10001e40
mov ecx, eax
call fcn.10001020
cmp dword [esp + 0x2c], 0x10
jb 0x10002e64
mov edx, dword [esp + 0x18]
push edx
call fcn.10008c5d
add esp, 4
mov al, bl
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2c]
call fcn.10009483
add esp, 0x3c
ret

Function at 0x10003120
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10011cab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
mov eax, dword [0x10016180]
push ebx
push esi
push edi
mov dword [esp + 0x13c], eax
xor ebx, ebx
xor eax, eax
mov byte [esp + 0x30], bl
mov ecx, 0x40
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0xf
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003192
sub eax, edx
push eax
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
call fcn.100015a0
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1c]
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov dword [esp + 0x158], ebx
mov byte [esi + 4], bl
call fcn.100014b0
cmp dword [esp + 0x2c], 0x10
jb 0x100031e0
mov eax, dword [esp + 0x18]
push eax
call fcn.10008c5d
add esp, 4
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x13c]
mov eax, esi
call fcn.10009483
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003c30
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push 0x515
push eax
call fcn.10001cf0
mov ecx, dword [eax + 0x18]
add esp, 8
cmp ecx, 0x10
jb 0x10003c51
mov eax, dword [eax + 4]
jmp 0x10003c54
add eax, 4
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0
push 0
push ecx
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esp + 0x18], 0x10
jb 0x10003c7f
mov eax, dword [esp + 4]
push eax
call fcn.10008c5d
add esp, 4
add esp, 0x1c
ret

Function at 0x100041a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x10011de0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [0x10016180]
push ebx
push esi
mov dword [esp + 0x60], eax
lea eax, [esp + 0xc]
push edi
push eax
call fcn.10003f80
mov ecx, dword [eax + 0x18]
mov edi, 0x10
add esp, 4
cmp ecx, edi
jb 0x100041e2
mov eax, dword [eax + 4]
jmp 0x100041e5
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esi, eax
cmp dword [esp + 0x28], edi
jb 0x10004201
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10008c5d
add esp, 4
xor ebx, ebx
neg esi
sbb esi, esi
lea edx, [esp + 0x48]
push 0x643
and esi, 0x3ed78
push edx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
add esi, 0x708
call fcn.10001cf0
lea eax, [esp + 0x34]
push 0x647
push eax
mov dword [esp + 0x80], ebx
call fcn.10001cf0
add esp, 0x10
cmp dword [esp + 0x44], edi
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x70], 1
mov dword [esp + 0xc], ebx
jae 0x10004262
lea ecx, [esp + 0x30]
cmp dword [esp + 0x60], edi
mov eax, dword [esp + 0x4c]
jae 0x10004270
lea eax, [esp + 0x4c]
lea edx, [esp + 0xc]
push edx
push ecx
push eax
push 0x80000001
call fcn.10002d80
push ebx
call fcn.1000956a
mov edx, dword [esp + 0x20]
mov ecx, eax
sub eax, edx
cdq
xor eax, edx
sub eax, edx
add esp, 0x14
cmp eax, esi
mov eax, dword [esp + 0x44]
jle 0x10004305
cmp eax, edi
mov edx, dword [esp + 0x30]
jae 0x100042ab
lea edx, [esp + 0x30]
cmp dword [esp + 0x60], edi
mov eax, dword [esp + 0x4c]
jae 0x100042b9
lea eax, [esp + 0x4c]
push ecx
push edx
push eax
push 0x80000001
call fcn.100020e0
mov eax, dword [esp + 0x54]
add esp, 0x10
cmp eax, edi
jb 0x100042de
mov eax, dword [esp + 0x30]
push eax
call fcn.10008c5d
add esp, 4
cmp dword [esp + 0x60], edi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
jb 0x10004301
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.10008c5d
add esp, 4
mov al, 1
jmp 0x1000433b
cmp eax, edi
jb 0x10004316
mov edx, dword [esp + 0x30]
push edx
call fcn.10008c5d
add esp, 4
cmp dword [esp + 0x60], edi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
jb 0x10004339
mov eax, dword [esp + 0x4c]
push eax
call fcn.10008c5d
add esp, 4
xor al, al
mov ecx, dword [esp + 0x68]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x5c]
pop ebx
call fcn.10009483
add esp, 0x68
ret
Function at 0x10005720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10011f2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
or eax, 0xffffffff
xor ebx, ebx
mov dword [esi + 8], eax
mov dword [esi + 4], eax
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x14]
mov dword [esi], 0x1001329c
mov dword [esp + 0x18], ebx
mov dword [ecx + 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 8], ebx
lea edi, [esi + 0x20]
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov dword [edi + 8], ebx
mov eax, dword [esp + 0x20]
push eax
mov byte [esp + 0x1c], 2
call fcn.10004eb0
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, edi
call fcn.10004eb0
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x10005d80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10011f93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esp + 8], esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x3c]
mov dword [esi], 0x100131d4
mov dword [esp + 0x14], ebx
mov dword [ecx + 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 8], ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
push 0x1001316c
mov byte [esp + 0x18], 1
mov dword [esi + 0x48], 4
mov byte [esi + 0x34], bl
mov dword [esi + 0x38], ebx
call fcn.10004eb0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100061a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10011fc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
or eax, 0xffffffff
push esi
mov esi, ecx
mov dword [esi + 8], eax
mov dword [esi + 4], eax
xor eax, eax
lea ecx, [esi + 0x20]
mov dword [esi + 0xc], eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
mov dword [esp + 4], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push eax
mov dword [esi], 0x10013328
call fcn.10004eb0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x100064a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10012043
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor edx, edx
push esi
mov esi, ecx
push edi
or edi, 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 4], edi
lea ecx, [esi + 0x20]
mov dword [esi + 0xc], edx
mov dword [ecx + 4], edx
mov dword [ecx], edx
mov dword [ecx + 8], edx
mov dword [esp + 8], esi
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 1
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], edx
lea eax, [esi + 0x34]
mov dword [esi], 0x10013358
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax + 0xc], edx
mov dword [eax], 0x1001329c
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x28], edx
mov dword [esp + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x30], eax
mov dword [eax + 0x2c], eax
mov eax, dword [esp + 0x1c]
push eax
mov byte [esp + 0x18], 1
mov dword [esi + 0x1c], edx
mov dword [esi + 0x18], edx
call fcn.10004eb0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x100065e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1001205b
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x34]
push ebx
mov ecx, esi
call fcn.10006060
test eax, eax
je 0x1000662e
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [eax + 0x20]
call fcn.10004eb0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
push 0x34
call fcn.100087c9
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x10006657
mov edx, dword [esp + 0x20]
push edx
push ebx
mov ecx, eax
call fcn.10005720
jmp 0x10006659
xor eax, eax
test eax, eax
mov dword [esp + 0x14], 0xffffffff
je 0x1000668b
mov dword [eax + 0x30], esi
mov ecx, dword [esi + 0x2c]
mov dword [eax + 0x2c], ecx
mov edx, dword [esi + 0x2c]
mov dword [edx + 0x30], eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
test edi, edi
mov ecx, edi
je 0x100066c0
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x100066b3
mov ecx, dword [ecx + 0x10]
test ecx, ecx
jne 0x10006691
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
push 0
push 0
push 0
push 3
call fcn.10006fc0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8