joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10117c00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2074
call fcn.101f6830
mov eax, ecx
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x2084]
mov ecx, 0x40
sub ecx, dword [esp + 0x2080]
xorps xmm0, xmm0
push esi
movlpd qword [esp + 0x10], xmm0
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x40]
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
movups xmmword [esp + 0x34], xmm0
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], ecx
nop
mov ecx, dword [eax + 0x49280]
test edx, edx
mov eax, dword [esp + 0x2090]
cmovne eax, dword [esp + 0x2094]
push 0
mov esi, dword [ecx]
cdq
push edx
push eax
call dword [esi + 0xc]
mov eax, dword [esp + 0x10]
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x28], esi
xor edx, edx
cmp cx, word [eax + 0x16]
jae 0x10117d41
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x2c], ecx
sub edx, dword [esp + 0x2088]
mov dword [esp + 0x1c], edx
jns 0x10117cf6
nop
movq xmm1, qword [esp + 0x14]
xor esi, esi
movd xmm0, ebp
psllq xmm1, xmm0
movq qword [esp + 0x14], xmm1
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test ebp, ebp
jle 0x10117cea
mov ecx, dword [eax + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, esi
add esi, 8
shl eax, cl
or ebx, eax
mov eax, dword [esp + 0x10]
cmp esi, ebp
jl 0x10117cc2
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
add edx, ebp
mov dword [esp + 0x1c], edx
js 0x10117ca0
mov esi, dword [esp + 0x28]
mov ecx, 0x40
mov eax, ebx
sub ecx, edx
mov edx, edi
sub ecx, dword [esp + 0x2088]
call fcn.101f6d80
mov ecx, dword [esp + 0x24]
call fcn.101f6da0
mov ecx, dword [esp + 0x2c]
inc esi
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x28], esi
mov word [ecx], ax
add ecx, 2
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
movzx eax, word [eax + 0x16]
cmp esi, eax
mov eax, dword [esp + 0x10]
jl 0x10117c91
mov edx, dword [esp + 0x30]
add dword [esp + 0x20], 0x1020
inc edx
mov dword [esp + 0x30], edx
cmp edx, 2
jl 0x10117c50
movzx ebx, word [eax + 0x16]
xor edi, edi
dec ebx
test ebx, ebx
jle 0x10117de4
nop word [eax + eax]
movzx eax, word [esp + edi*2 + 0x1066]
mov edx, edi
movzx esi, word [esp + edi*2 + 0x44]
and edx, 1
sub esi, eax
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
movzx esi, word [esp + edi*2 + 0x1064]
sub eax, ecx
movd xmm0, eax
movzx eax, word [esp + edi*2 + 0x46]
sub esi, eax
cvtdq2pd xmm0, xmm0
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
sub eax, ecx
addsd xmm0, qword [esp + edx*8 + 0x34]
movsd qword [esp + edx*8 + 0x34], xmm0
mov edx, edi
movd xmm0, eax
not edx
cvtdq2pd xmm0, xmm0
and edx, 1
inc edi
addsd xmm0, qword [esp + edx*8 + 0x34]
movsd qword [esp + edx*8 + 0x34], xmm0
cmp edi, ebx
jl 0x10117d70
movups xmm0, xmmword [esp + 0x34]
jmp 0x10117de7
xorps xmm0, xmm0
movaps xmm1, xmm0
unpckhpd xmm1, xmm0
divsd xmm0, xmm1
call fcn.1020c4f0
mulsd xmm0, qword [0x103d7e88]
pop edi
pop esi
pop ebp
pop ebx
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x14], xmm0
fld dword [esp + 0x14]
add esp, 0x2074
ret 0x10
Function at 0x1011c100
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0xc], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
je 0x1011c243
mov eax, dword [esi + 0x4927c]
mov dword [eax + 0x220], 0
mov eax, dword [esi + 0x4927c]
mov edx, dword [eax + 0x220]
cmp edx, 4
jae 0x1011c168
mov ecx, dword [esp + 0x20]
nop word [eax + eax]
imul ecx, ecx, 0x2e90edd
inc ecx
mov dword [eax + edx*4 + 0x20], ecx
mov eax, dword [esi + 0x4927c]
inc dword [eax + 0x220]
mov eax, dword [esi + 0x4927c]
mov edx, dword [eax + 0x220]
cmp edx, 4
jb 0x1011c140
mov edx, dword [esi + 0x4927c]
mov ecx, dword [edx + 0x28]
xor ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x2c]
add eax, eax
shr ecx, 0x1f
or ecx, eax
mov dword [edx + 0x2c], ecx
mov eax, dword [esi + 0x4927c]
mov dword [eax + 0x220], 4
mov eax, dword [esi + 0x4927c]
cmp dword [eax + 0x220], 0x7f
jae 0x1011c1e2
mov edi, dword [esi + 0x4927c]
mov edx, dword [edi + 0x220]
mov ecx, dword [edi + edx*4 + 0x1c]
xor ecx, dword [edi + edx*4 + 0x14]
mov eax, dword [edi + edx*4 + 0x18]
xor eax, dword [edi + edx*4 + 0x10]
add eax, eax
shr ecx, 0x1f
or ecx, eax
mov dword [edi + edx*4 + 0x20], ecx
mov eax, dword [esi + 0x4927c]
inc dword [eax + 0x220]
mov eax, dword [esi + 0x4927c]
cmp dword [eax + 0x220], 0x7f
jb 0x1011c1a0
mov eax, dword [esi + 0x4927c]
mov dword [eax + 0x220], 0
mov eax, dword [esi + 0x4927c]
mov eax, dword [eax + 0x220]
cmp eax, 0x7f
jae 0x1011c243
mov ebx, dword [sym.imp.WS2_32.dll_htonl]
nop dword [eax]
mov edi, dword [esi + 0x4927c]
push dword [edi + eax*4 + 0x20]
call ebx
mov ecx, dword [edi + 0x220]
mov dword [edi + ecx*4 + 0x20], eax
mov eax, dword [esi + 0x4927c]
inc dword [eax + 0x220]
mov eax, dword [esi + 0x4927c]
mov eax, dword [eax + 0x220]
cmp eax, 0x7f
jb 0x1011c210
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x1011c28e
mov ebx, dword [esp + 0x14]
nop
mov edi, dword [esi + 0x4927c]
lea ebx, [ebx + 4]
mov edx, dword [edi + 0x220]
lea ecx, [edx - 0x3f]
and ecx, 0x7f
lea eax, [edx + 1]
and eax, 0x7f
and edx, 0x7f
mov ecx, dword [edi + ecx*4 + 0x20]
xor ecx, dword [edi + eax*4 + 0x20]
mov dword [edi + edx*4 + 0x20], ecx
xor dword [ebx - 4], ecx
mov eax, dword [esi + 0x4927c]
inc dword [eax + 0x220]
sub ebp, 1
jne 0x1011c250
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x1011d060
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
push ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
movzx eax, word [edi + 0x492d8]
mov ecx, dword [edi + 0x49280]
mov dword [esp + 0x20], eax
mov eax, ebx
cdq
push edx
mov esi, dword [ecx]
push eax
call dword [esi + 0xc]
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jne 0x1011d266
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
sub eax, 0x4d
jne 0x1011d266
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
sub eax, 0x52
jne 0x1011d266
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
imul eax, eax, 0x101
mov ecx, edi
mov word [edi + 0x492d8], ax
call fcn.1010f760
mov ecx, dword [edi + 0x49280]
add ebx, 8
add ebx, eax
mov dword [esp + 0x10], ebx
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov dword [esp + 0x24], eax
cmp eax, ebx
jge 0x1011d24f
nop
xor esi, esi
lea ebx, [esi + 4]
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
shl esi, 8
or esi, eax
sub ebx, 1
jne 0x1011d115
mov ecx, edi
call fcn.1010f760
mov ebp, eax
cmp esi, 0x505244
je 0x1011d1ea
cmp esi, 0x545457
je 0x1011d1c2
cmp esi, 0x574247
jne 0x1011d217
mov ecx, edi
call fcn.1010f760
mov ecx, str.DiMAGE_A200
lea eax, [edi + 0xf8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1011d185
test dl, dl
je 0x1011d181
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1011d185
add eax, 2
add ecx, 2
test dl, dl
jne 0x1011d165
xor eax, eax
jmp 0x1011d18a
sbb eax, eax
or eax, 1
xor ecx, ecx
mov ebx, 3
test eax, eax
cmovne ebx, ecx
xor esi, esi
mov ecx, edi
call fcn.101120a0
movzx eax, ax
movd xmm0, eax
mov eax, esi
sar eax, 1
xor eax, esi
inc esi
cvtdq2ps xmm0, xmm0
xor eax, ebx
movss dword [edi + eax*4 + 0x2480c], xmm0
cmp esi, 4
jl 0x1011d198
jmp 0x1011d217
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
push eax
mov ecx, edi
call fcn.10126f70
mov eax, dword [esp + 0x10]
cdq
mov dword [edi + 0x492f8], eax
mov dword [edi + 0x492fc], edx
jmp 0x1011d217
mov ecx, dword [edi + 0x49280]
push 1
push 0
push 8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, edi
call fcn.101120a0
movzx eax, ax
mov ecx, edi
mov dword [esp + 0x14], eax
call fcn.101120a0
movzx eax, ax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [edi + 0x49280]
add eax, 8
add eax, ebp
push 0
cdq
mov esi, dword [ecx]
push edx
push eax
call dword [esi + 0xc]
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x10]
jl 0x1011d110
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov word [edi + 0x12], ax
mov eax, dword [esp + 0x1c]
mov word [edi + 0x10], bp
mov word [edi + 0x492d8], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x10128810
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x24
push ebx
mov ebx, ecx
lea edx, [esp + 8]
push ebp
mov ebp, 2
mov dword [esp + 8], ebx
push ebp
mov ecx, dword [ebx + 0x49280]
xorps xmm0, xmm0
push ebp
push edx
movups xmmword [esp + 0x20], xmm0
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x1c]
sub eax, ebp
je 0x10128904
movsd qword [esp + 0x24], xmm0
movsd xmm0, qword [esp + 0x14]
push esi
movsd qword [esp + 0x18], xmm0
push edi
mov ecx, dword [ebx + 0x49280]
lea esi, [esp + 0x14]
dec eax
lea esi, [esi + ebp*2]
push 1
mov dword [esp + 0x3c], eax
mov eax, dword [ecx]
push 2
push esi
call dword [eax + 8]
movzx esi, byte [esi]
mov ebx, ebp
movzx ecx, byte [esp + ebp*2 + 0x15]
xor ebx, 2
movzx edi, byte [esp + ebx*2 + 0x14]
movzx edx, byte [esp + ebx*2 + 0x15]
mov eax, edi
shl eax, 8
or edx, eax
mov eax, esi
shl eax, 8
or ecx, eax
movzx eax, byte [esp + ebp*2 + 0x15]
sub edx, ecx
shl eax, 8
movzx ecx, byte [esp + ebx*2 + 0x15]
or eax, esi
shl ecx, 8
inc ebp
mov ebx, dword [esp + 0x10]
or ecx, edi
movd xmm0, edx
sub ecx, eax
cvtdq2pd xmm0, xmm0
mov eax, dword [esp + 0x38]
and ebp, 3
mulsd xmm0, xmm0
addsd xmm0, qword [esp + 0x1c]
movaps xmm1, xmm0
movd xmm0, ecx
movsd qword [esp + 0x1c], xmm1
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm0
addsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 0x2c], xmm0
test eax, eax
jne 0x10128860
pop edi
pop esi
jmp 0x1012890a
movsd xmm1, qword [esp + 0x14]
comisd xmm0, xmm1
mov eax, 0x4949
mov ecx, 0x4d4d
pop ebp
pop ebx
cmova eax, ecx
add esp, 0x24
ret 4
Function at 0x10133340
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x10]
push eax
mov dword [esi + 0x34], eax
call fcn.101fc42d
xor edi, edi
mov dword [esi + 0x30], eax
add esp, 4
cmp dword [esi + 0x18], edi
jbe 0x101333b2
push ebp
mov ebp, 0x3bcd0
mov ecx, 0x11f9f253
nop
imul eax, ebx, 0x63d
xor edx, edx
add eax, 0xca25
div ebp
mov ebx, edx
mov eax, ebx
mul ecx
mov ecx, ebx
shrd eax, edx, 0x18
shl ecx, 8
sub ecx, eax
sar edx, 0x18
shr ecx, 1
add ecx, eax
mov eax, dword [esi + 0x14]
shr ecx, 0x11
xor cl, byte [edi + eax]
mov eax, dword [esi + 0x30]
mov byte [edi + eax], cl
inc edi
mov ecx, 0x11f9f253
cmp edi, dword [esi + 0x18]
jb 0x10133370
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1013b560
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov edx, 2
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edx
movzx ebx, word [esi + 0x16]
mov dword [esp + 0x24], ebx
lea eax, [ebx + ebx]
mov dword [esp + 0x20], eax
movzx eax, word [esi + 0x14]
sub eax, edx
cmp eax, edx
jle 0x1013b70c
movsd xmm2, qword [0x103d7c40]
movsd xmm3, qword [0x103d7b70]
push ebp
lea ebp, [ebx - 2]
push edi
mov dword [esp + 0x20], ebp
nop word [eax + eax]
mov eax, dword [esi + 0x188]
mov ecx, edx
movzx edi, word [esi + 0x16]
and ecx, 7
shl ecx, 2
shr eax, cl
imul edi, edx
and eax, 1
add eax, 2
add edi, eax
cmp eax, ebp
jge 0x1013b6f6
lea ecx, [edi + ebx]
mov edx, edi
sub edx, ebx
shl ecx, 3
mov ebx, dword [esp + 0x28]
lea ebp, [edi*8]
mov dword [esp + 0x10], ecx
shl edx, 3
mov dword [esp + 0x18], edx
lea ecx, [edi + ebx]
sub edi, ebx
mov ebx, dword [esp + 0x20]
sub ebx, eax
shl ecx, 3
mov eax, dword [esp + 0x10]
dec ebx
shr ebx, 1
shl edi, 3
inc ebx
mov dword [esp + 0x14], ecx
nop dword [eax]
nop dword [eax + eax]
mov esi, dword [esi + 8]
movzx eax, word [eax + esi + 6]
movzx ecx, word [esi + ebp + 6]
lea ecx, [eax + ecx*2]
movzx eax, word [edx + esi + 6]
add ecx, eax
movzx eax, word [esi + ebp + 0xe]
add ecx, eax
movzx eax, word [esi + ebp - 2]
add ecx, eax
movzx eax, word [edi + esi + 6]
add edi, 0x10
lea edx, [eax + ecx*2]
mov eax, dword [esp + 0x14]
movzx ecx, word [esi + ebp + 0xa]
add dword [esp + 0x14], 0x10
movzx eax, word [eax + esi + 6]
add edx, eax
movzx eax, word [esi + ebp + 0x16]
add edx, eax
movzx eax, word [esi + ebp - 0xa]
add edx, eax
movzx eax, word [esi + ebp - 6]
add ecx, eax
mov eax, 0x10
sub eax, edx
imul ecx, eax
mov eax, dword [esp + 0x18]
movzx eax, word [eax + esi + 2]
movd xmm1, ecx
mov ecx, dword [esp + 0x10]
cvtdq2pd xmm1, xmm1
movzx ecx, word [ecx + esi + 2]
add ecx, eax
imul ecx, edx
mov edx, dword [esp + 0x18]
mulsd xmm1, xmm2
add edx, 0x10
mov dword [esp + 0x18], edx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm2
addsd xmm1, xmm0
mulsd xmm1, xmm3
cvttsd2si eax, xmm1
mov word [esi + ebp + 2], ax
add ebp, 0x10
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
add eax, 0x10
mov dword [esp + 0x10], eax
sub ebx, 1
jne 0x1013b620
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
movzx eax, word [esi + 0x14]
inc edx
sub eax, 2
mov dword [esp + 0x24], edx
cmp edx, eax
jl 0x1013b5b0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x101861e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10268186
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10583760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.10190e00
mov edx, dword [ebp + 0xc]
mov eax, edx
mov ecx, dword [ebp + 8]
shr eax, 4
and al, 1
mov dword [ebp - 4], 0
mov byte [ebx + 0x20], al
mov eax, edx
shr eax, 5
shr edx, 3
and al, 1
and dl, 1
mov dword [ebx], vtable.Imf_2_2::RgbaOutputFile::ToYca.0
mov dword [ebx + 0x1c], ecx
mov byte [ebx + 0x21], al
mov byte [ebx + 0x22], dl
call fcn.101716d0
mov ecx, eax
call fcn.10178a30
mov ecx, dword [eax + 8]
mov edx, dword [eax]
sub ecx, edx
mov edi, dword [eax + 4]
inc ecx
mov esi, dword [eax + 0xc]
mov eax, esi
sub eax, edi
mov dword [ebx + 0x28], ecx
mov ecx, dword [ebx + 0x1c]
inc eax
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
call fcn.101716d0
mov ecx, eax
call fcn.10178ad0
mov ecx, dword [ebx + 0x1c]
mov eax, dword [eax]
test eax, eax
mov dword [ebx + 0x34], eax
cmove esi, edi
mov dword [ebx + 0x38], esi
call fcn.101716d0
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10187cd0
mov ecx, dword [eax]
mov dword [ebx + 0x3c], ecx
mov ecx, dword [eax + 4]
mov dword [ebx + 0x40], ecx
mov eax, dword [eax + 8]
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x28]
shl eax, 3
push eax
call fcn.10187760
mov ecx, dword [ebx + 0x28]
mov edi, eax
shr edi, 3
mov edx, 8
add ecx, edi
imul eax, ecx, 0x1b
xor ecx, ecx
mov dword [ebp + 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101f5a1d
mov dword [ebp + 8], eax
lea esi, [ebx + 0x50]
add esp, 0x10
mov dword [ebx + 0x48], eax
xor eax, eax
mov dword [ebp + 8], eax
lea edx, [eax + 0x10]
nop dword [eax]
mov ecx, dword [ebx + 0x28]
lea esi, [esi + 0xc]
add ecx, edi
imul ecx, eax
mov eax, dword [ebx + 0x48]
lea eax, [eax + ecx*8]
mov dword [esi - 0x10], eax
lea eax, [edx - 8]
mov ecx, dword [ebx + 0x28]
add ecx, edi
imul ecx, eax
add ecx, dword [ebx + 0x48]
mov dword [esi - 0xc], ecx
mov eax, dword [ebx + 0x28]
add eax, edi
imul eax, edx
add edx, 0x18
add eax, dword [ebx + 0x48]
mov dword [esi - 8], eax
mov eax, dword [ebp + 8]
add eax, 3
mov dword [ebp + 8], eax
cmp edx, 0xe8
jl 0x10186300
mov eax, dword [ebx + 0x28]
xor ecx, ecx
add eax, 0x1a
mov edx, 8
mov dword [ebp + 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101f5a1d
mov dword [ebp + 8], eax
add esp, 4
mov dword [ebx + 0xb8], eax
mov eax, ebx
mov dword [ebx + 0xbc], 0
mov dword [ebx + 0xc0], 0
mov dword [ebx + 0xc4], 0
mov dword [ebx + 0xc8], 7
mov dword [ebx + 0xcc], 5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10186b40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10268236
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10583760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.10190e00
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
shr eax, 5
and al, 1
mov dword [ebp - 4], 0
mov dword [edi], vtable.Imf_2_2::RgbaInputFile::FromYca.0
mov dword [edi + 0x1c], ecx
mov byte [edi + 0x20], al
call fcn.10183220
mov ecx, eax
call fcn.10178a30
mov edx, dword [eax]
mov ecx, dword [eax + 8]
mov esi, dword [eax + 4]
sub ecx, edx
mov eax, dword [eax + 0xc]
inc ecx
mov dword [edi + 0x2c], eax
sub eax, esi
inc eax
mov dword [edi + 0x30], ecx
mov ecx, dword [edi + 0x1c]
mov dword [edi + 0x34], eax
lea eax, [esi - 0x1d]
mov dword [edi + 0x24], edx
mov dword [edi + 0x28], esi
mov dword [edi + 0x38], eax
call fcn.10183220
mov ecx, eax
call fcn.10178ad0
mov ecx, dword [edi + 0x1c]
mov eax, dword [eax]
mov dword [edi + 0x3c], eax
call fcn.10183220
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10187cd0
mov ecx, dword [eax]
mov dword [edi + 0x40], ecx
mov ecx, dword [eax + 4]
mov dword [edi + 0x44], ecx
mov eax, dword [eax + 8]
mov dword [edi + 0x48], eax
mov eax, dword [edi + 0x30]
shl eax, 3
push eax
call fcn.10187760
mov ebx, eax
xor ecx, ecx
mov eax, dword [edi + 0x30]
mov edx, 8
shr ebx, 3
add eax, ebx
shl eax, 5
mov dword [ebp + 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101f5a1d
add esp, 0x10
mov dword [ebp + 8], eax
mov dword [edi + 0x4c], eax
lea esi, [edi + 0x50]
xor edx, edx
nop dword [eax]
mov ecx, dword [edi + 0x30]
lea esi, [esi + 4]
mov eax, dword [edi + 0x4c]
add ecx, ebx
imul ecx, edx
inc edx
lea eax, [eax + ecx*8]
mov dword [esi - 4], eax
cmp edx, 0x1d
jl 0x10186c40
mov eax, dword [edi + 0x30]
xor ecx, ecx
add eax, ebx
mov edx, 8
imul eax, eax, 0xe8
add eax, dword [edi + 0x4c]
mov dword [edi + 0xc4], eax
mov eax, dword [edi + 0x30]
add eax, ebx
imul eax, eax, 0xf0
add eax, dword [edi + 0x4c]
mov dword [edi + 0xc8], eax
mov eax, dword [edi + 0x30]
add eax, ebx
imul eax, eax, 0xf8
add eax, dword [edi + 0x4c]
mov dword [edi + 0xcc], eax
mov eax, dword [edi + 0x30]
add eax, 0x1a
mov dword [ebp + 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101f5a1d
mov dword [ebp + 8], eax
add esp, 4
mov dword [edi + 0xd0], eax
mov eax, edi
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xdc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10190850
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10268bf2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10583760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
call fcn.10190e60
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
call fcn.10190e00
lea esi, [edi + 0x24]
mov byte [ebp - 4], 1
push 0
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10190d80
mov dword [esi], eax
push 0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 2
mov dword [edi + 0x2c], 0
call fcn.10190e60
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 3
call fcn.10190e00
lea esi, [edi + 0x54]
mov byte [ebp - 4], 4
push 0
push 0
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10190dc0
mov dword [esi], eax
lea ecx, [edi + 0x64]
mov byte [ebp - 4], 5
mov dword [edi + 0x5c], 0
mov byte [edi + 0x60], 0
call fcn.10190e00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10195d00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10268f54
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10583760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.1018b050
mov eax, dword [ebp + 0x14]
mov ecx, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [esi], vtable.Imf_2_2::DwaCompressor.0
mov dword [esi + 0x10], eax
call fcn.10178ab0
lea edx, [ebp + 0xb]
push edx
lea ecx, [esi + 0x24]
push eax
mov dword [ebp + 8], ecx
call fcn.1019bc60
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov ecx, edi
mov byte [ebp - 4], 4
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0x42340000
call fcn.10178a30
mov ecx, edi
mov eax, dword [eax]
mov dword [esi + 0x14], eax
call fcn.10178a30
mov ecx, edi
mov eax, dword [eax + 4]
mov dword [esi + 0x18], eax
call fcn.10178a30
mov ecx, edi
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
call fcn.10178a30
push edi
mov eax, dword [eax + 0xc]
mov dword [esi + 0x20], eax
mov dword [esi + 0x70], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x84], 0
call fcn.101c1860
add esp, 4
test al, al
je 0x10195e79
push edi
call fcn.101c18a0
add esp, 4
mov eax, dword [eax]
mov dword [esi + 0x8c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x101a9ba0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebp
mov ebp, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
cmp edi, ebp
je 0x101a9cc9
push esi
lea esi, [edi + 0x20]
cmp esi, ebp
je 0x101a9cc8
push ebx
movups xmm1, xmmword [esi]
mov eax, esi
movups xmm0, xmmword [esi + 0x10]
movd ebx, xmm1
movups xmmword [esp + 0x10], xmm1
movups xmmword [esp + 0x20], xmm0
cmp ebx, dword [edi]
jae 0x101a9c35
mov byte [esp + 0x34], 0
lea eax, [esi + 0x20]
push dword [esp + 0x34]
push eax
push esi
push edi
call fcn.101a9e40
mov al, byte [esp + 0x24]
add esp, 0x10
mov byte [edi + 4], al
mov ax, word [esp + 0x16]
mov dword [edi], ebx
mov word [edi + 6], ax
mov eax, dword [esp + 0x18]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x18], eax
mov eax, dword [esp + 0x2c]
mov dword [edi + 0x1c], eax
jmp 0x101a9cbc
mov ecx, dword [esi - 0x20]
lea edx, [esi - 0x20]
cmp ebx, ecx
jae 0x101a9c80
nop
mov dword [eax], ecx
mov cl, byte [edx + 4]
mov byte [eax + 4], cl
mov cx, word [edx + 6]
mov word [eax + 6], cx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x10], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x14], ecx
mov ecx, dword [edx + 0x18]
mov dword [eax + 0x18], ecx
mov ecx, dword [edx + 0x1c]
mov dword [eax + 0x1c], ecx
mov eax, edx
mov ecx, dword [edx - 0x20]
sub edx, 0x20
cmp ebx, ecx
jb 0x101a9c40
mov cl, byte [esp + 0x14]
mov byte [eax + 4], cl
mov cx, word [esp + 0x16]
mov dword [eax], ebx
mov word [eax + 6], cx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0x1c], ecx
add esi, 0x20
cmp esi, ebp
jne 0x101a9bc2
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x20
ret