joyce8/EMBER2024-capa huggingface dataset:
Function at 0x118c7c64
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [eax + ebp - 0x2a862fa2]
sar eax, 0xd9
sar byte [esp + eax - 0x15], 0xc1
not edx
or ax, 0xcb16
xadd word [esp + eax*4 - 0x32c5a], ax
and eax, eax
not ecx
adc byte [esp + eax - 0xe280], al
or edx, ecx
inc dword [esp + eax*2 - 0x1c502]
mov dword [eax + ebp - 0xe281], edx
push eax
add dword [esp + eax - 0xe281], 0xd5148f1b
mov dword [esp + eax - 0xe281], esi
ret 4
mov dword [esp], 0xc5882728
movzx ecx, dl
mov edx, dword [edi + ecx*2 - 0x18]
xchg dword [esp + ecx - 0xc], ecx
bt ecx, ecx
btc cx, cx
xor edx, ebx
xor edx, 0x92b59104
dec dword [esp]
sub edx, 0xf6bbc3bc
movzx eax, word [esp]
rol edx, 3
bts cx, 0x8b
sal ax, cl
shl eax, cl
xor edx, 0x3e1fbb39
dec word [esp + eax - 0xaffff]
and eax, ecx
bt eax, 0xaf
xor ebx, edx
neg dword [esp + eax*4 - 0x200000]
xor word [esp + eax - 0x7ffff], ax
xchg word [esp + eax - 0x7fffe], cx
adc esi, edx
or eax, eax
sal dword [esp + eax - 0x80000], 0x64
and cx, word [esp + eax*4 - 0x1fffff]
mov edx, dword [eax + ebp - 0x80000]
ror al, 0xe2
mov ecx, dword [ebp + eax - 0x7fffc]
inc byte [esp + eax - 0x7fffe]
lea eax, [eax + eax*8 + 0x2a3e2fa6]
jno 0x118289a3
push edi
dec ecx
dec esi
dec ebp
dec ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi], cl
and edx, 0xfffffff3
invalid

Function at 0x118c7ea1
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea edi, [edx + esi*8 + 0x828ac22]
dec esp
mov edi, dword [esp + esi*2 - 0xd8]
dec esp
mov dword [esp + esi - 0x70], eax
dec eax
mov dword [esp + esi*4 - 0x1b8], 0x2affe23
inc ecx
or bh, dl
dec ebp
arpl cx, cx
inc ecx
pop ebp
call fcn.1117caec
sub ecx, 0x1306882
push 0x721a5da4
call fcn.118da91f
dec eax
lea esi, [edi*4 + 0x13963d2b]
add cx, si
mov edi, dword [ecx + ebx - 0x55f3]
inc ebp
movsx esp, dh
inc ecx
sar esi, cl
dec ebp
sub ebp, esi
inc ecx
xor edi, edi
inc edi
xor edi, 0x5e07b6b7
imul al
dec ecx
xchg esi, esi
rol edi, 1
rol esi, cl
shr al, 0xc4
dec edi
lea eax, [esp + ecx*4 + 0x3f153327]
inc edx
lea edi, [edi + ecx*2 + 0x5de6d366]
inc ecx
shl dh, 3
setnp dl
inc ecx
push edi
xor dword [esp + ecx*4 - 0x157cc], edi
inc ecx
pop edi
inc cx
inc eax
inc ecx
neg dh
dec ecx
imul esi, esi
dec eax
arpl di, di
shr eax, cl
dec esp
adc ebx, edi
dec eax
inc edx
inc ecx
setle al
dec edx
lea edi, [eax + esi*8 + 0x6012a0b0]
jge fcn.10cf108c

Function at 0x118c8077
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
dec word [esp + 6]
setp byte [esp + 0xf]
jne 0x111af055
call fcn.118f4228
neg eax
push 0x7d843202
shl byte [esp + 1], 0x61
not eax
jns 0x10ce30dd
Function at 0x118ccebb
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x5e07b6b7
dec edi
lea ebp, [ecx + esi*8 + 0x1d2b878d]
rol ecx, 1
inc ecx
lea ecx, [esp + ecx - 0x5664260]
dec esp
mov dword [esp], esi
inc ecx
movzx edi, cl
dec esp
mov dword [esp + edi*2 - 0x20], edi
inc ebp
mov edx, ebp
dec ebp
xor esp, ecx
inc edx
xor dword [esp], ecx
inc ecx
movsx eax, si
shl eax, 4
inc ecx
pop edi
inc ecx
shl edx, 0xed
inc ecx
sar cl, 0x64
dec al
dec eax
arpl cx, cx
dec esp
adc ebx, ecx
dec esi
lea esi, [edi + edx + 0x5c9b110b]
dec edx
lea ebx, [ebx - 2]
cwde
inc esi
movzx ebp, word [ebx]
inc bp
xor ebp, edi
inc esp
xchg edi, ecx
xchg di, ax
dec eax
bswap eax
inc cx
neg ebp
dec ecx
bswap edx
inc ecx
not esi
inc cx
dec ebp
bswap edi
dec eax
lea ecx, [eax*4 - 0x3ed401dd]
inc cx
sar ecx, 0xac
inc cx
xor ebp, 0xf4d6f9c
stosd dword es:[edi], eax
salc
inc cx
neg ebp
jmp 0x10cf50e2

Function at 0x118d6dbb
Capabilities:
Encode data using base64

Disassembly:
shr dword [esp + edx - 0x77dff58], 0x66
xor word [esp + edx - 0x77dff55], dx
lea eax, [esp + eax + 0x14]
sbb dl, 0x90
sar edx, 0x7b
sub dword [esp + edx*2 + 5], ecx
mov ecx, dword [eax + edx*2]
sal edx, 0xed
call fcn.111b1565

Function at 0x118d798b
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 4], eax
shl byte [esp], 2
push 0x4b8887b2
test ebx, ebx
push 0x387bb2e
jmp 0x118d7ba4
mov dword [esp + eax*2 - 0x2f183816], eax
mov dword [esp + eax*2 - 0x2f183816], ebx
ror al, 0xa3
mov ebx, edx
shl eax, 0x52
imul eax, eax
movsx edx, al
add edx, ebx
shl edx, 2
bt eax, eax
ror eax, 0xc5
ror eax, 0xc9
add eax, ebp
push 0x6115107
shl word [esp + 1], 0xa7
adc eax, edx
sub dword [esp], 0xdf188301
jns 0x10d12b42
jmp 0x118d9583
lea esp, [esp + 0xc]
je 0x10d0c7bf

Function at 0x118d8c04
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [ebp + edx - 0x5a33ff00]
mov dword [esp], 0x2882dfb5
push ecx
mov cl, byte [edx]
mov edx, 0x2a171f9f
sar edx, 6
bswap edx
lea ebp, [edx + ebp - 0x7e5ca7fe]
neg word [esp + edx - 0x7e5ca800]
mov word [edx + ebp - 0x7e5ca800], cx
jno 0x10d4adf0

Function at 0x118dd64c
Capabilities:
Encode data using base64

Disassembly:
and al, cl
mov edx, 0xca9690bd
not al
mov word [ebp + 2], ax
lea eax, [edx - 0x554eae6c]
mov ecx, dword [edi + eax - 0x7547e255]
xor ecx, ebx
mov dword [esp + eax - 0x7547e251], 0x2c23a93f
cdq
rol ecx, 1
xor ecx, 0xc9388d22
pop eax
mul edx
shr eax, 0x91
rol ecx, 2
cbw
Function at 0x118f7406
Capabilities:
Encode data using base64

Disassembly:
ror eax, 1
push edx
mov dword [esp + 8], edx
dec dl
inc eax
bswap eax
call fcn.10d6ab7e

Function at 0x118fe48a
Capabilities:
Encode data using base64

Disassembly:
ror eax, 3
push ecx
push ecx
xor ebx, eax
bt edx, edx
ror byte [esp + 4], 0xc7
add esi, eax
lea eax, [ecx + edx*4 + 0x43b4802c]
bt edx, 0xa1
and eax, dword [esp]
mov ecx, dword [ebp]
lea eax, [edx + edx*4 + 0x652aa90d]
sar eax, 0x6b
mov edx, dword [ebp + 4]
add ecx, edx
movzx edx, ax
neg byte [esp + edx - 0x8a5d]
mov dword [ebp + edx*2 - 0x114be], ecx
cdq
pop eax
movzx eax, byte [edi - 5]
sbb edi, 4
rol byte [esp + 7], 0xc4
xor al, bl
mov ecx, edx
sub al, 0x97
shl ecx, cl
call fcn.10d1eee7
test al, 0xbe
invalid
mov dword [esp + ecx - 0x91], 0xd3136b26
xor eax, ebx
shl ecx, cl
lea ecx, [edx*2 + 0x5b85ac9d]
jbe 0x10d0fb25
rol eax, 1
shr word [esp + 2], 0x81
sar cx, 0xec
xor eax, 0x40151b28
mov dword [esp], ecx
lea eax, [eax + edx - 0x514dae8b]
shr byte [esp + 1], 0xa1
jbe 0x10d430b4
mov edx, 0xe208f8fd
jne 0x118fe45b
pop edi
mul dword [edi + eax + 0x1c]
cwde
sar byte [edx - 0x77e2031b], cl
adc dl, byte [edx]
in eax, 0xfc
sbb eax, 0x32eae230
in eax, 0xfc
sbb eax, 0x3202c2f0
in eax, 0xfc
sbb eax, 0xe3e724ca
movsb byte es:[edi], byte [esi]
mov byte [0xc7d812e3], al
outsb dx, byte [esi]
dec ebx
xor eax, 0xbd099155
invalid
Function at 0x1190343a
Capabilities:
Encode data using base64

Disassembly:
shl ax, 0xc3
sbb cx, ax
dec dl
sal cx, cl
inc ecx
ror dl, cl
btc cx, cx
adc dl, 0xb
sar cx, cl
xor ecx, ecx
neg eax
xor bl, dl
dec cl
dec cx
xadd al, cl
add edx, esp
sar ax, 0x88
mov al, byte [edx + ecx - 0xf8]
setne cl
jnp 0x111ae7a6
btr cx, ax
neg edx
bts eax, 9
shl ecx, 0x38
neg ecx
xor edx, 0xc314121c
or al, 0x38
lea edx, [edx + ecx*8 - 0x1306882]
jne 0x111791e5
dec esp
mov edx, dword [ebp]
mov si, word [ebp + 8]
inc ecx
mov esi, 0x4e382d31
inc ecx
movsx edx, si
dec eax
lea ebp, [ebp + edx - 0x2d27]
inc bx
mov dword [esi + edx - 0x4e382d31], esi
dec eax
lea ebx, [edx + ebx - 0x2d35]
mov eax, dword [ebx + edx*2 - 0x5a62]
dec ecx
sal esi, 0x11
dec esi
lea eax, [esi*4 + 0x152178a6]
inc ecx
movzx esi, dh
inc ecx
xor eax, edi
bswap eax
inc ecx
movsx edi, dh
inc cx
rol esi, 0xed
dec esi
lea eax, [esi + esi + 0x68b85081]
ror eax, 1
inc cx
shr esi, 0xc9
dec esp
lea esp, [edi + esi*8 + 0x4423bfb1]
not eax
mov ecx, 0xaeb21d2a
dec ecx
shl eax, cl
dec esp
lea ecx, [esi*4 - 0x3fc28dd6]
rol eax, 1
inc ecx
ror esp, cl
inc ecx
push edi
xor dword [esp + edx*2 - 0x5a62], eax
shl ecx, cl
dec eax
shl esi, 0x31
inc ecx
pop edi
dec ecx
sbb ecx, 0xe02cbc9d
inc esp
movzx ebp, dh
dec eax
bswap esi
dec eax
arpl ax, ax
push edx
dec eax
adc edx, edx
dec esp
adc ebx, eax
inc esp
movzx edx, word [esp + edx - 0x5a60]
inc ecx
rol esi, 0x81
dec esp
mov dword [esp + edx - 0x5a63], ebx
ret
xadd al, ch
xor edx, eax
sub ax, 0xd309
ror edx, 1
neg ecx
dec ecx
dec edx
not edx
xor ebx, edx
add esi, edx
movsx edx, cx
btc ax, dx
mov dl, byte [edi + edx - 0x105]
cbw
bts ecx, ecx
adc edi, 0xfffffff9
bts ax, 0xd
bt eax, 0x90
xor dl, bl
cwde
sub dl, 8
cbw
neg ecx
rol dl, cl
xadd ecx, eax
not dl
jnp 0x10d43f6c
lea edx, [ecx + ecx - 0x5549b057]
mov word [ebp + ecx*2 - 2], ax
movzx eax, cx
div dl
jmp esi
sub ax, 0xcc20
sub ax, ax
xor cl, bl
add cl, 1
sar eax, 0x84
xor cl, 0xa9
or eax, dword [esp + eax - 0x37a8ffc]
ror byte [esp + eax*2 - 0x6f5fbc5], 0x81
rol cl, 1
call fcn.1117dfcf
adc edx, esp
xchg ch, cl
mov byte [edx + ecx*2 - 0x200], al
mov edx, dword [edi + ecx - 0x105]
sub ecx, ecx
mov eax, ecx
or eax, eax
xor edx, ebx
shl eax, 0x8b
adc edx, 0xb80a768e
not eax
jmp 0x10d6a9ea

Function at 0x11903b25
Capabilities:
Encode data using xor

Disassembly:
xor edx, 0x40151b28
lea edx, [edx + ecx + 0x55ac172e]
not eax
shl cx, 0x25
ror edx, 3
cbw
pop ecx
xor ebx, edx
mov ecx, eax
pop ecx
sal ecx, cl
adc esi, edx
push eax
mov eax, dword [ebp + eax - 0x6c01fffe]
push ecx
mov edx, dword [ebp + ecx*8 - 0x75893ffc]
add eax, edx
mov dword [esp + ecx*4 - 0x3ac49ff4], ecx
mov dword [ebp + ecx*4 - 0x3ac49ffc], eax
movsx edx, word [esp + ecx*2 - 0x1d624ff0]
lea ebp, [ebp + ecx*2 - 0x1d624ffc]
inc ecx
jl 0x10cd6927
xchg dword [esp + 8], ecx
add ecx, 0xffb5b453
jmp ecx
Function at 0x1190771f
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
jmp 0x118c8678
dec ebp
add ebx, esp
dec esi
mov eax, dword [ebp + esi*2 - 0xe8fcc6a]
call fcn.1116f81e
mov edx, esi
dec ebp
mov esp, dword [ebp + ebp - 0x349a82a3]
inc ecx
shr esi, 6
movzx ecx, dx
inc ebp
or esi, edx
inc ecx
movzx esi, byte [edx + ebx - 0x349a82ac]
inc esp
movzx ecx, dx
dec ebp
lea edx, [ecx + 0x7d12d112]
inc ecx
xor dh, bh
inc ecx
mov eax, ebp
inc cx
ror ecx, 0x67
inc ebp
bt ecx, ecx
inc eax
rol dh, 1
dec eax
sar edx, 0xf8
dec eax
mul edx
inc eax
sbb dh, 0xbc
inc ebp
xadd ebp, edx
inc eax
xor dh, 0x96
inc ebp
sub ch, dl
inc eax
not dh
inc ecx
sete dl
inc ebp
movsx eax, cx
inc ecx
sbb dh, dl
movzx edi, dx
dec esp
lea ebp, [edi - 0x2d529c6e]
inc ecx
imul eax
inc esp
xor bh, dh
dec ecx
imul ebp
inc ecx
neg dh
dec eax
add esi, esp
sal cl, 0x85
dec esp
bts eax, edx
mul eax
dec esp
mov dword [edx + esi], esp
inc ecx
inc ebp
inc ecx
setge cl
inc esp
movsx esp, cl
inc esi
mov esp, dword [ebx + edx*2 - 0x69350405]
jno 0x1190c568
lea eax, [eax + ecx - 0x4f5bad25]
inc edx
ror eax, 3
lea eax, [ecx + eax - 0x196368bf]
jmp 0x118e0b3b
rol cl, 1
add cl, dl
xchg edx, eax
sub dl, 0x88
rol cl, 1
lea eax, [edx*8 - 0x6c7372ff]
cwde
xor bl, cl
or edx, 0xb5a3280f
sar dx, 0x4e
xadd edx, eax
add ecx, esp
shl ax, 0xa6
sbb eax, edx
cmovge eax, edx
mov edx, dword [ecx]
movsx ecx, ax
adc ax, 0x2819
or ecx, 0x3fb6f78a
mov dword [ebp - 6], edx
cdq
rol eax, cl
call fcn.118f465a
xchg ebx, eax
popfd
mov ah, 0x61
adc dword [eax], ebx
lea ebx, [edi]
shl bl, 1
push ss
out dx, al
daa
test ebx, edi
fdivr st(7), st(0)
push ss
out dx, al
daa
ret
lea ecx, [edx*4 - 0x7cd18bd7]
lea edx, [ecx*8 + 0x603d8aaa]
xor ebx, eax
sal ecx, cl
cmovnp cx, dx
ror ecx, 0xa1
adc esi, eax
movzx eax, cl
xchg al, cl
bts ecx, 0x2e
movzx edx, byte [edi + ecx - 0x2d106905]
not cx
xor dl, bl
sar al, 0x22
sar cx, 0x65
adc dl, 0xaf
sar cl, 0x85
btc cx, cx
rol dl, 1
dec dl
lea ecx, [eax + 0x463ca4b9]
rol dl, 1
xor bl, dl
inc ecx
setno al
btr ax, 0x32
adc edx, esp
add cl, ah
not eax
mov eax, dword [edx + ecx - 0x463ca4ba]
mov edx, ecx
mov dword [ecx + ebp - 0x463ca4bc], eax
movzx eax, cx
dec edx
sbb cl, cl
movzx ecx, byte [ecx + edi - 0x463ca406]
lea edi, [edi + edx - 0x463ca4bf]
sub al, dh
inc edx
cwd
xor cl, bl
add cl, 0xb0
jmp 0x10d07210
inc edi
lea ebp, [ebp + ecx*2 - 0x5af1fbbb]
inc eax
xadd bh, dl
cbw
call fcn.118dd477
dec ecx
xchg esi, edx
inc ecx
rol ebp, 3
dec eax
add esi, 0x422bf591
inc ecx
push ecx
jno 0x118fe2e5
dec eax
mov edi, dword [ebp]
inc ecx
mov edx, 0x349a82ab
inc ebp
mov ebp, edx
dec esi
lea esp, [esp + edx - 0x349a81d3]
inc ecx
movzx esi, bp
inc esp
movzx esi, dh
dec ebx
mov dword [esp + edx - 0x349a82ab], edi
jmp 0x111b1109
inc cx
rol ecx, 0x61
inc ebp
xor esp, edi
bts edx, eax
cwde
inc ecx
not esp
inc esp
adc esp, eax
inc ecx
rol esp, 2
inc ecx
bswap esp
inc ecx
sub esp, 0xd23f26ab
inc ecx
rol dh, 0x41
inc ecx
or eax, edx
inc ecx
push edi
inc esi
xor dword [esp + edx - 0x349a8200], esp
inc ebp
add esi, ebp
inc ecx
pop edi
dec ebp
arpl sp, sp
jnp 0x10d5c96f
Function at 0x1190c9a7
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [ebp + 4]
shrd edx, eax, cl
mov ecx, dword [esp + 4]
pop ecx
mov dword [ebp + 2], edx
mov eax, 0x3027ad94
mov edx, dword [ebp + eax*2 - 0x604f5b26]
lea ebp, [ebp + eax*2 - 0x604f5b22]
neg byte [esp + eax - 0x3027ad94]
movzx eax, byte [eax + edi - 0x3027ad9a]
dec word [esp]
mov ecx, 0xc3b1f6bd
or word [esp + 1], 0x120
sbb edi, 6
xor al, bl
sub dword [esp], ecx
and cl, 0x33
dec ecx
xor al, 8
lea ecx, [ecx + ecx*8 + 0x2e0b92a5]
ror al, 1
add al, 0x2e
sar word [esp + ecx*8 - 0x7a69d2a7], 0x4e
neg al
sar ecx, 0x52
dec dword [esp + ecx - 0x3d3]
dec al
sar ecx, cl
shr ecx, 0x24
xor bl, al
lea eax, [esp + eax + 4]
call fcn.10d44e5a
inc ecx
xor eax, edi
not eax
dec edx
lea edi, [eax*4 + 0x178f5a2e]
rol eax, 1
dec eax
bswap esi
dec esp
bt edi, ecx
inc eax
movsx edx, bh
bswap eax
jae 0x1182df8f
inc ecx
push 0xbd02616f
invalid
neg eax
sub eax, 0xc036c812
inc cx
dec esp
lea esp, [esi*4 - 0x7f461bc5]
xor eax, 0x6ab31d35
inc eax
not bh
dec eax
rol edx, 0x32
not cl
inc ecx
push edi
inc ecx
mov edi, 0x8829838d
inc edx
xor dword [esp + ecx*2 - 0x15752], eax
inc ecx
pop edi
dec ecx
rol ecx, cl
dec eax
arpl ax, ax
sbb dl, dl
dec edi
lea esp, [esp + ebp*4 + 0x5d217bbe]
dec esp
adc ebx, eax
inc ecx
jmp ebx
mov eax, dword [ebp]
jo 0x11174379

Function at 0x1190ce9f
Capabilities:
Encode data using base64

Disassembly:
xor bx, cx
sar dl, 0x61
or dx, 0x100c
adc edx, 0xdc258fa0
sbb ebp, 2
btr edx, 0x9e
mov dword [esp], edx
mov word [ebp], cx
lea ecx, [edx + eax - 0x60f38a80]
pop eax
pop edx
pop edx
jb fcn.10ce0aa7

Function at 0x1190f2a2
Capabilities:
Encode data using base64

Disassembly:
or dl, byte [esp + ecx*8 - 0x566d0]
add dword [esp + edx*4 - 0x200], ecx
ror eax, 2
sar ecx, cl
dec cx
xor eax, 0x5c8a1a8b
shl dword [esp + ecx - 0xffff], 0x34
ror eax, 2
neg eax
pop edx
xor ebx, eax
mov dword [ebp + ecx*8 - 0x80002], eax
shl edx, 0xc1
lea ebp, [ecx + ebp - 0x10009]
sub ecx, edx
btc cx, cx
jb fcn.10ce0aa7
not eax
rol eax, 1
lea eax, [eax + ecx*4 + 0x77124345]
mov dword [esp + ecx - 0xde], ecx
xor ebx, eax
add esi, eax
pop eax
shl byte [esp + ecx - 0xde], 0x84
cdq
mov eax, dword [edi + ecx*8 - 0x6fb]
lea edi, [ecx + edi - 0xe9]
sbb cx, word [esp + ecx - 0xdc]
xor eax, ebx
jmp 0x10cfce2b
Function at 0x100074c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
cmp byte [ebp + 0xc], 0
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmovne esi, edi
test esi, esi
jne 0x100074e9
mov byte [ebp - 8], 0
jmp 0x10007509
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp - 4]
setne byte [ebp - 8]
push edi
push eax
push dword [ebp + 8]
call fcn.100178d0
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x10007533
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007540
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp byte [ebp + 0xc], 0
mov eax, edx
push edi
cmovne esi, eax
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x18], edi
test esi, esi
jne 0x10007567
xor bl, bl
jmp 0x1000758c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
setne bl
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], bl
push ecx
call fcn.100178d0
add esp, 0xc
test bl, bl
je 0x100075b5
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100075c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x1000760e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov cl, byte [ebp - 1]
movzx eax, cl
sub eax, 0xe8
je 0x10007691
sub eax, 1
je 0x10007691
sub eax, 0x16
jne 0x10007682
mov eax, dword [ebp + 8]
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
call fcn.1000eec0
add esp, 4
cmp al, 0x15
je 0x1000763b
cmp al, 0x25
jne 0x10007682
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x14], 4
push 4
push esi
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10007675
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
inc esi
mov dword [eax], esi
call fcn.1000ee70
add esp, 4
add eax, 4
add eax, esi
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100076c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.100075c0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe9
test eax, eax
je 0x1000771a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x1000775a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.100075c0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
test eax, eax
je 0x100077ca
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x1000780a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cb00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003cdc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10051068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 8
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10016233
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10015914
add esp, 8
mov dword [esi + 4], eax
mov ecx, ebx
mov dword [ebx + 0x34], esi
call fcn.1000dae0
mov eax, ebx
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea esi, [eax + 8]
lea ebx, [eax + 4]
mov dword [eax + 0x20], ecx
mov dword [eax + 0xc], ebx
lea edi, [eax + 0x14]
mov dword [eax + 0x2c], edx
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x10054a9c]
mov dword [eax], 0
mov eax, dword [0x10054a98]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret