joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444ee0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4507a6
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x46e230]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x41c], ecx
mov ecx, dword [ebp - 0x41c]
add ecx, 0x40
call fcn.004020b0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x41c]
mov dword [eax], 0
mov ecx, dword [ebp - 0x41c]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x41c]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x41c]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x41c]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x41c]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x41c]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x41c]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x41c]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 0x41c]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x41c]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 0x41c]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x41c]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x41c]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x41c]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x41c]
mov dword [eax + 0x3c], 0
xor ecx, ecx
mov word [ebp - 0x414], cx
push 0x3fe
push 0
lea edx, [ebp - 0x412]
push edx
call fcn.0044bb74
add esp, 0xc
push 0x200
lea eax, [ebp - 0x414]
push eax
call fcn.00444ca0
add esp, 8
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00404660
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00425630
movzx edx, al
test edx, edx
jne 0x44505d
push 0x45fa4c
lea ecx, [ebp - 0x10]
call fcn.004256a0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x41c]
add ecx, 0x40
call fcn.00402110
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004020f0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044bb5e
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403e59
pop dword [ebp - 0x18]
mov eax, 0xb4510757
add eax, 0x4bef3702
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x4e5d44df
sub dword [ebp - 0x28], 0xaff94
mov dword [ebp - 0x24], 0x3a4aa61a
add dword [ebp - 0x24], 0xf7e8a62b
mov dword [ebp - 0x20], 0x60380b0c
add dword [ebp - 0x20], 0xec143922
mov dword [ebp - 0x1c], 0x328870aa
sub dword [ebp - 0x1c], 0x328870aa
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x105f90ef
add dword [ebp - 0x28], 0x6412d867
mov dword [ebp - 0x24], 0xff90b9a6
add dword [ebp - 0x24], 0x41dba7cf
mov dword [ebp - 0x20], 0x42ec507
sub dword [ebp - 0x20], 0xa0bf589b
mov dword [ebp - 0x1c], 0xfef2947d
sub dword [ebp - 0x1c], 0xfef2947d
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xae7be7f6
sub eax, 0xae3b6722
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39a71
push 0
call eax
mov ecx, 0xc8d4dc48
sub ecx, 0xc8d488a9
xor ebx, ebx
add ebx, eax
mov edx, 0x46024ae0
add edx, 0xba3ec520
add edx, dword [ebp - 0x18]
mov edi, 0x936374a2
sub dword [ebp - 0x10], 0x7e52461f
mov esi, dword [edx]
sub dword [ebp - 8], eax
xor esi, edi
xor dword [ebp - 8], ebx
mov dword [ebx], esi
add ebx, 0xd5e08955
add ebx, 0x2a1f76af
add edx, 4
loop 0x403f72
add eax, 0x1414f
xor ebx, ebx
add ebx, eax
add eax, 0xb5d6d091
add eax, 0x4a292f74
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10001193
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov edi, eax
mov eax, dword [0x1000b70c]
xor esi, esi
cmp eax, esi
je 0x100011d7
cmp ecx, 0x90
jae 0x100011d7
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 8]
push dword [ebp + 0xc]
push ecx
xor ecx, ecx
cmp dword [ebp + 0x14], esi
setne cl
inc ecx
inc ecx
push ecx
call eax
add esp, 0x1c
neg eax
sbb eax, eax
inc eax
jmp 0x100012af
push ebx
push dword [ebp + 0x14]
call fcn.100010f6
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x100012ac
push esi
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push 0x70000
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100012a5
cmp esi, dword [ebp - 0x20]
jg 0x100012a5
jl 0x10001224
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x24]
ja 0x100012a5
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0xc], eax
ja 0x100012a5
cmp edi, dword [ebp - 0x14]
ja 0x100012a5
push esi
push dword [ebp + 8]
push esi
push eax
call fcn.10007720
xor ecx, ecx
add eax, dword [ebp + 0xc]
push esi
push dword [ebp - 0x14]
adc edx, ecx
push edx
push eax
call fcn.10007720
push esi
push dword [ebp - 0x10]
xor ecx, ecx
dec edi
add eax, edi
adc edx, ecx
push edx
push eax
call fcn.10007720
push esi
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x100012a5
cmp dword [ebp + 0x14], esi
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x10001287
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push ebx
call eax
test eax, eax
push ebx
je 0x100012a6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x100012ae
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret

Function at 0x1000141f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001429
repz ret
jmp fcn.10001874

Function at 0x100053e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ecx
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.10003f4c
xlatb
jb 0x1000545b
pushfd
lea eax, [ebp - 0x72c]
push eax
call fcn.10003f5c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10003f11
invalid
inc dword [ebx - 0x7a76f33c]
sbb al, 0xf9
invalid
invalid
call fcn.10003f4c
mov bh, 0xe2
mov cl, 0x8d
test eax, ebp
clc
invalid
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40645d
pop dword [ebp - 0xc]
mov eax, 0x40645d
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xab19876b
add dword [ebp - 0x1c], 0xa338bde0
mov dword [ebp - 0x18], 0x3b719566
sub dword [ebp - 0x18], 0x93e4921
mov dword [ebp - 0x14], 0xbb4790a7
add dword [ebp - 0x14], 0x9104b387
mov dword [ebp - 0x10], 0x4e0433ec
add dword [ebp - 0x10], 0xb1fbcc14
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xb2734a2a
sub dword [ebp - 0x1c], 0x3e00e0d4
mov dword [ebp - 0x18], 0x292743e2
add dword [ebp - 0x18], 0x18451d93
mov dword [ebp - 0x14], 0xc031f68c
sub dword [ebp - 0x14], 0x5cc28a20
mov dword [ebp - 0x10], 0x25fb1516
sub dword [ebp - 0x10], 0x25fb1516
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x9b4a51ec
add eax, 0x64f62e90
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3a697
push 0
call eax
mov ecx, 0x29e3a150
sub ecx, 0x29e34be0
xor edi, edi
add edi, eax
mov edx, 0x451400
add edx, dword [ebp - 0xc]
mov esi, 0x529737ac
add esi, 0x370ba980
add dword [ebp - 4], ecx
mov ebx, dword [edx]
add dword [ebp - 4], edi
xor ebx, esi
xor dword [ebp - 4], 0x3bd6b928
mov dword [edi], ebx
sub dword [ebp - 4], edi
add edi, 0x25e7b43f
sub edi, 0x25e7b43b
add edx, 0x70a58d33
add edx, 0x8f5a72d1
loop 0x406571
add eax, 0x14893
mov ebx, eax
add eax, 5
mov ecx, 0xfd0993aa
sub ecx, 0xfcc993aa
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x3e9600ea
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x520d3586
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100245d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fe3c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
push 0
push 0x105cbeaf
mov byte [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1001fa30
mov dword [esi + 0x24], 0
mov eax, esi
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100247a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fe449
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea edi, [esi + 0x18]
mov dword [ebp - 4], 1
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.100245d0
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 5
call fcn.100245d0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 1
mov dword [esi + 0xbc], 0x3f800000
cmp esi, eax
je 0x10024880
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x10024877
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.1001fa30
mov eax, dword [ebp + 0xc]
cmp edi, eax
je 0x1002489b
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x10024892
mov eax, dword [eax]
push ecx
push eax
mov ecx, edi
call fcn.1001fa30
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x30]
cmp ecx, eax
je 0x100248b2
push dword [ebp + 0x18]
push dword [eax + 4]
push dword [eax]
call fcn.1004ef20
mov ecx, dword [ebp + 0x18]
lea edx, [esi + 0x40]
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x3c], eax
mov al, byte [ecx]
lea edi, [ecx + 0xc]
mov byte [edx], al
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
lea eax, [edx + 0xc]
mov dword [ebp + 8], eax
cmp eax, edi
je 0x100248f7
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x100248e5
mov eax, dword [edi]
push dword [edi + 0x10]
mov ecx, dword [ebp + 8]
push eax
call fcn.1001fa30
mov ecx, dword [ebp + 0x18]
lea edx, [esi + 0x40]
movups xmm0, xmmword [ecx + 0x24]
movups xmmword [edx + 0x24], xmm0
mov al, byte [ecx]
lea edx, [esi + 0x74]
mov byte [edx], al
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
lea eax, [edx + 0xc]
mov dword [ebp + 8], eax
cmp eax, edi
je 0x10024937
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x10024927
mov edi, dword [edi]
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.1001fa30
mov ecx, dword [ebp + 0x18]
lea edx, [esi + 0x74]
movups xmm0, xmmword [ecx + 0x24]
mov eax, dword [ebp + 0x1c]
pop edi
movups xmmword [edx + 0x24], xmm0
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 0x20]
movups xmmword [esi + 0xa8], xmm0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0xb8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xbc], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1005d420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010aa4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.100d2da1
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x1005d4ab
push eax
push esi
call fcn.100d30fd
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.100d2780
int3
Function at 0x10070100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1010b5ed
push eax
mov dword fs:[0], esp
push esi
push edi
push 8
mov esi, ecx
call fcn.100d51af
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
mov edx, dword [edx]
mov dword [eax], edx
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x10070a70
push 0
push 0
call fcn.100dd362
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x1007016e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push 6
mov dword [edi], 0
call fcn.100d3582
int3

Function at 0x10070240
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1010b60d
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
push 0x30
mov ebx, ecx
call fcn.100d51af
mov edx, dword [ebp + 0x18]
mov edi, eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 0x18], edi
mov esi, dword [edx]
mov edx, dword [edx + 4]
mov dword [edi + 4], edx
mov dword [edi], esi
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [edi + 0xc], ecx
mov eax, dword [edx]
mov esi, dword [edx + 8]
mov ecx, dword [edx + 4]
mov dword [edx + 8], 0
mov dword [edx + 4], 0
mov dword [edx], 0
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], esi
mov eax, dword [eax]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edi + 0x28], eax
lea esi, [ebx + 4]
mov dword [ebp - 4], 0
push esi
push 0
push edi
push 0x10070ac0
push 0
push 0
call fcn.100dd362
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x100702f6
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 6
mov dword [esi], 0
call fcn.100d3582
int3
Function at 0x10070310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010b63c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
push 0x30
mov dword [ebp - 0x10], edi
call fcn.100d51af
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 8], ecx
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0x14], ecx
cmp ecx, eax
je 0x100703b6
sub eax, ecx
lea ecx, [ebx + 0x10]
mov edi, eax
mov dword [ebp + 0x18], eax
sar edi, 3
push edi
call fcn.10060350
push dword [ebp + 0x18]
mov esi, dword [ebx + 0x10]
push dword [ebp + 0x14]
push esi
call fcn.100d6e00
lea eax, [esi + edi*8]
add esp, 0xc
mov edi, dword [ebp - 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x18], ebx
mov eax, dword [eax]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebx + 0x28], eax
lea esi, [edi + 4]
mov dword [ebp - 4], 1
push esi
push 0
push ebx
push 0x10070ac0
push 0
push 0
call fcn.100dd362
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x10070403
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
push 6
mov dword [esi], 0
call fcn.100d3582
int3

Function at 0x10070520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1010b65d
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
push 0x20
mov ebx, ecx
call fcn.100d51af
mov edx, dword [ebp + 0x14]
mov edi, eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x14], edi
mov esi, dword [edx]
mov edx, dword [edx + 4]
mov dword [edi], esi
mov dword [edi + 4], edx
mov ecx, dword [ecx]
mov dword [edi + 8], ecx
mov eax, dword [eax]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edi + 0x18], eax
lea esi, [ebx + 4]
mov dword [ebp - 4], 0
push esi
push 0
push edi
push 0x10070dd0
push 0
push 0
call fcn.100dd362
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x100705a8
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 6
mov dword [esi], 0
call fcn.100d3582
int3
Function at 0x1007f310
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 0xcc
ja 0x1007f336
lea eax, [edi + 8]
mov dword [edi], eax
lea ebx, [edi + 4]
mov eax, edi
mov dword [ebx], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, Ordinal_2
cmp esi, eax
cmovl eax, esi
mov esi, eax
cmp esi, 0xccccccc
ja 0x1007f36c
test esi, esi
jle 0x1007f36c
nop
lea eax, [esi + esi*4]
shl eax, 2
push 0x101125b0
push eax
call fcn.100d58c6
add esp, 8
test eax, eax
jne 0x1007f38f
shr esi, 1
jne 0x1007f350
xor eax, eax
lea ebx, [edi + 4]
push eax
call fcn.100d560e
add esp, 4
lea eax, [edi + 8]
mov dword [edi], eax
mov esi, 0xcc
mov eax, edi
mov dword [ebx], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
lea ebx, [edi + 4]
cmp esi, 0xcc
jbe 0x1007f371
mov dword [edi], eax
mov eax, edi
pop edi
mov dword [ebx], esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10085bd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1010c315
push eax
mov dword fs:[0], esp
sub esp, 8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10085c6b
sub eax, 1
je 0x10085c13
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 4
call fcn.100d51af
mov dword [ebp + 8], eax
mov dword [eax], 0x10085bb0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x10085de0
push 0
push 0
call fcn.100dd362
add esp, 0x1c
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10085dcc
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.10062070
cmp dword [ebp - 0x10], 0
jne 0x10085dc7
jmp 0x10085db2
push esi
push edi
call fcn.10063320
call fcn.100d0fd0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call fcn.100d14a0
push 0x1006fc00
push 0x105ef73c
call fcn.100d0ce0
call fcn.100d1030
mov dword [0x1076aa94], 0
call fcn.10086c70
mov ecx, dword [0x1076aa6c]
test ecx, ecx
je 0x10085cc2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x1076aa6c], 0
mov ecx, dword [0x1076aa68]
test ecx, ecx
je 0x10085cdc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x1076aa68], 0
mov ecx, dword [0x1076aa78]
test ecx, ecx
je 0x10085cf6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x1076aa78], 0
mov esi, dword [0x105ef74c]
mov ecx, esi
call fcn.1008dbf0
mov eax, dword [0x105ef74c]
xor ecx, ecx
cmp eax, esi
cmove eax, ecx
mov dword [0x105ef74c], eax
test esi, esi
je 0x10085d3d
mov ecx, esi
call fcn.1009acc0
mov eax, dword [0x105ef74c]
test eax, eax
je 0x10085d2e
dec dword [eax + 0x374]
push dword [0x105ef750]
push esi
call fcn.10088510
add esp, 8
push dword [0x105ef740]
push 0xfffffffffffffffc
push dword [0x105ec750]
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.100d0fd0
call edi
push eax
call fcn.100d14a0
push 0x100790d0
push 0x105ec7a0
call fcn.100d0ce0
call fcn.100d1030
call fcn.100d0fd0
call edi
push eax
call fcn.100d14a0
push 0x100790f0
push 0x105ef748
call fcn.100d0ce0
call fcn.100d1030
cmp byte [0x105ec7fd], 0
pop edi
pop esi
je 0x10085da8
mov ecx, 0x105ec7ec
call fcn.100cf540
mov ecx, 0x105ec828
call fcn.100cf540
mov ecx, dword [ebp - 0xc]
mov eax, 1
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
call fcn.100dd3f3
push 6
mov dword [ebp - 0x10], 0
call fcn.100d3582
int3
Function at 0x100890e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1008912c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1008910f
cmp edi, 2
jb 0x1008910f
cmp byte [esi], cl
jne 0x1008910f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10525220]
test edi, edi
jne 0x100890f5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1008915b
cmp cl, 0x23
jne 0x10089142
cmp byte [esi], cl
jne 0x10089142
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10525220]
test cl, cl
jne 0x10089133
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10089270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10089283
mov dword [edi], 0
mov edx, 0x105cdf00
call fcn.10089170
mov esi, eax
test esi, esi
je 0x1008936c
push esi
call fcn.100ddb7e
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x10089363
push 2
push 0
push esi
call fcn.100de829
add esp, 0xc
test eax, eax
jne 0x10089363
push esi
call fcn.100ddb7e
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10089363
push 0
push dword [ebp + 8]
push esi
call fcn.100de829
add esp, 0xc
test eax, eax
jne 0x10089363
mov eax, dword [0x105ef74c]
test eax, eax
je 0x100892f6
inc dword [eax + 0x374]
push dword [0x105ef750]
push ebx
call fcn.10088500
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x10089363
push esi
push ebx
push 1
push eax
call fcn.100df545
add esp, 0x10
push esi
cmp eax, ebx
je 0x1008934d
call fcn.100de4d6
mov eax, dword [0x105ef74c]
add esp, 4
test eax, eax
je 0x10089335
dec dword [eax + 0x374]
push dword [0x105ef750]
push dword [ebp + 8]
call fcn.10088510
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.100de4d6
add esp, 4
test edi, edi
je 0x1008935b
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.100de4d6
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret