joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8c85e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dx
jmp 0x8c862b
pushal
mov bp, 0x27f0
mov bx, 0x569a
and ebp, esi
pop dword [esp + 0xd]
jmp 0x8c8776
mov edi, esp
sbb cx, bx
pop edi
mov byte [esp + 2], al
mov bx, 0x4bdb
xor ch, cl
jmp 0x8c8615
lea esp, [esp + 3]
mov ch, ah
mov byte [esp + 6], ch
setle ah
jmp 0x8c868c
inc ecx
setg cl
neg bh
add esp, 0x10
mov dword [esp + 8], ebp
cpuid
jmp 0x8c8665
push word [esp + 3]
push dword [esp + 5]
mov word [esp + 2], cx
mov si, di
rdtsc
mov ah, al
jmp 0x8c86ba
mov bh, 0x99
stc
mov edi, ebp
setnp al
mov bh, 0x4f
mov dword [esp + 0xc], ebx
jmp 0x8c867b
sub bp, cx
xchg bx, bp
mov word [esp + 9], cx
cld
lea esi, [eax + 0xa8]
push dword [esp + 0xf]
jmp 0x8c870c
xchg dword [esp + 0x15], ecx
pop dword [esp + 4]
lea ebp, reloc.MSVCRT.dll_strncpy
mov cx, ax
push word [esp + 0x1a]
mov al, 0xd
jmp 0x8c86aa
xchg word [esp + 8], dx
cpuid
xchg word [esp + 3], di
mov bx, di
jmp 0x8c8738
pop dword [esp + 2]
lea ebx, [eax + edi]
mov bp, bx
mov eax, ebx
pop word [esp + 5]
setge bl
jmp 0x8c86f6
xchg ebx, edx
mov word [esp + 6], bp
bsr ebx, esp
xchg edx, esi
bts edi, edx
jmp 0x8c874d
pop dword [esp + 5]
not ah
push dword [esp + 6]
push dword [esp + 8]
setg al
xchg dl, bl
jmp 0x8c8722
inc dx
mov dx, cx
mov dword [esp + 5], edi
shl ebp, cl
mov word [esp + 0xb], sp
mov word [esp + 0xf], sp
jmp 0x8c87a6
bts esi, ebp
mov bl, byte [esp + 0x10]
seto bh
pop word [esp + 6]
neg esi
bsr bp, dx
jmp 0x8c86dc
xchg word [esp + 0xa], di
cmc
setge bh
mov word [esp + 9], dx
jmp 0x8c87e7
xchg byte [esp + 0xd], bh
lea edx, [ebp*4]
mov ebx, edx
sub esp, 0xe
push word [esp + 0xc]
mov word [esp + 3], di
jmp 0x8c8790
push dword [esp + 0xa]
neg edi
mov cx, word [esp + 8]
mov si, 0x1362
cpuid
popal
jmp 0x8c87fb
mov di, dx
xchg byte [esp + 0x1e], cl
xchg cl, bl
pop ax
mov bx, word [esp + 0x1b]
pop ax
jmp 0x8c87c2
mov ecx, 0xb4fc2795
xchg word [esp], di
bsf ecx, edx
std
xchg byte [esp], ch
neg edx
jmp 0x8c884f
mov word [esp], dx
add eax, 0x2438189c
xchg ecx, ebp
mov word [esp], bp
jmp 0x8c8878
mov word [esp], cx
inc di
btc si, dx
xchg byte [esp], cl
cpuid
bswap esi
jmp 0x8c8839
lea esp, [esp + 0xf]
sub ecx, esi
add esp, 0xa
lea edx, reloc.MSVCRT.dll_strncpy
pushfd
jmp 0x8c8968
push word [esp + 1]
lea edx, reloc.MSVCRT.dll_strncpy
lea esp, [esp + 3]
sub esp, 0
bsr edi, esi
sub esp, 0x1a
jmp 0x8c8862
pop cx
mov ax, 0x6aa0
lea edi, [eax*4]
mov edi, dword [esp]
jmp 0x8c891d
bts bp, bx
xchg word [esp + 1], bp
xchg dx, si
bswap ecx
mov ch, cl
lea esp, [esp]
jmp 0x8c88b8
xchg word [esp + 1], ax
lea ecx, [esi*4]
cld
adc edi, 0x5c9750e5
mov ax, cx
xchg word [esp], bx
jmp 0x8c88ce
rdtsc
lea ebx, [eax + ecx]
mov word [esp + 0xc], cx
inc al
rdtsc
jmp 0x8c8948
mov word [esp], ax
sub esp, 0xf
xchg byte [esp + 0xc], dl
mov bp, ax
xchg di, bp
pop cx
jmp 0x8c8907
setge dh
mov dword [esp + 8], ebp
bsf dx, sp
and ecx, ebx
dec edi
call fcn.008c8994
pop edx
mov ch, 0xa4
lea esi, [esi*4]
not edx
mov dword [esp + 1], edx
rdtsc
pop word [esp + 4]
mov word [esp + 6], ax
jmp 0x8c8932
mov ah, 0x2d
pop cx
bswap ebx
mov dx, 0xd516
lea ebp, [ecx + ebx]
bt bp, si
jmp 0x8c88eb
Function at 0x8c8994
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0xa]
pop ax
mov ecx, ebp
xchg word [esp + 3], ax
std
bswap ecx
jmp 0x8c89c4
shl ecx, cl
jmp 0x8c897e
mov ebx, 0xd6a1e571
push dword [esp + 0xf]
mov bp, 0x880e
clc
bt edi, ecx
bswap eax
jmp 0x8c89da
bswap eax
cpuid
mov dword [esp + 0x16], esp
pop cx
xchg di, dx
stc
jmp 0x8c8a53
push word [esp + 2]
bswap eax
mov ecx, 0x3e2969cd
mov dh, 0xb2
cpuid
mov dword [esp + 0xa], edx
jmp 0x8c8998
lea edx, [esi*4]
push word [esp + 0xf]
xchg dword [esp + 4], ebx
mov edi, dword [esp + 0x19]
mov di, 0x884d
or cx, sp
jmp 0x8c89ad
mov ah, byte [esp + 7]
not dl
mov bp, word [esp + 4]
add esp, 7
pop ax
jmp 0x8c8a80
mov dword [esp + 9], ebp
rcl bh, cl
cpuid
mov byte [esp + 5], bl
add esp, 0x10
inc al
jmp 0x8c8a1a
push word [esp + 0xd]
lea esp, [esp + 2]
bsr ebx, eax
mov dl, byte [esp + 0x17]
lea ebp, [edx + ebx]
xchg esi, eax
jmp 0x8c8a30
mov ecx, edx
or edi, edi
lea edx, [eax*4]
add ax, cx
jmp 0x8c8a91
add ch, 0x1f
neg cl
bt di, cx
dec eax
mov ebp, dword [esp]
cpuid
jmp 0x8c8a6a
mov edi, 0xb7674159
setp cl
push esp
lea edi, [ebp*4]
mov eax, 0x436aade3
mov word [esp + 1], si
jmp 0x8c8ce1
mov edx, 0xaf3500b0
lea edx, [ebx - 0x76]
mov bp, word [esp]
add esp, 0
jmp 0x8c8b6a
bswap ebx
mov dh, byte [esp]
bsf bp, di
mov esi, dword [esp]
jmp 0x8c8ab6
mov al, byte [esp]
not cl
mov ebp, eax
mov ah, 0xc3
mov eax, esi
rdtsc
jmp 0x8c8acc
mov ax, bx
xchg dx, si
std
rdtsc
mov bp, 0x4052
lea ecx, [edx + esi]
jmp 0x8c8b30
cld
lea edx, reloc.MSVCRT.dll_strncpy
cpuid
mov dh, 0x8e
not ax
not eax
jmp 0x8c8af2
xchg byte [esp], ah
add esp, 0
call fcn.008c8b43
and esp, dword [ebp + reloc.MSVCRT.dll_strncpy]
push esp
invalid
not di
add esp, 0
cpuid
xchg byte [esp], bh
xchg di, dx
mov ax, cx
jmp 0x8c8b1a
lea edi, reloc.MSVCRT.dll_strncpy
mov bh, byte [esp]
add bx, 0xb30a
mov ecx, dword [esp]
not dx
mov dx, 0x80d0
jmp 0x8c8b08
mov bp, dx
lea eax, [edx*4]
shr si, cl
rdtsc
rdtsc
xchg dh, bh
jmp 0x8c8ae3
xchg ebx, edx
mov di, dx
cmc
add esp, 3
mov bx, ax
inc cl
jmp 0x8c8bdf
Function at 0x8c8ab1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp + 0xa]
xchg bl, ah
push dword [esp + 0xa]
shr si, 6
xor bh, 0x46
dec dh
jmp 0x8c8465
mov cx, word [esp + 0x2f]
xchg bh, ah
xchg word [esp + 0x3a], dx
pop edi
jmp 0x8c8446
mov bx, 0xef3d
xchg bx, ax
push dword [esp + 4]
xchg dword [esp + 0xa], ebp
rdtsc
mov edx, esi
jmp 0x8c83f0
rdtsc
mov word [esp], dx
bsr cx, di
cld
mov byte [esp + 2], dh
jmp 0x8c848a
mov word [esp + 0x13], si
mov bh, 0x28
lea ebx, [esi*4]
popal
setl dl
cmc
jmp 0x8c8430
bsr ebx, edi
pop bp
sub esp, 0xc
cpuid
xchg esi, eax
pushal
jmp 0x8c8405
mov ax, bp
pop dword [esp + 0x15]
xchg ch, cl
lea ebx, [edi + edi]
mov cl, byte [esp + 0x11]
jmp 0x8c849f
inc dl
push dword [esp + 0xb]
xchg di, bx
neg ebp
seto dh
mov eax, 0xafd99dfd
jmp 0x8c8474
push word [esp + 4]
xchg dword [esp + 2], edx
mov ah, byte [esp + 2]
sub esp, 0x1d
cmc
jmp 0x8c85cd
cld
pop dx
mov word [esp + 5], sp
push word [esp + 8]
or di, bp
lea edi, [esi*4]
jmp 0x8c841c
pushal
mov ebx, ecx
lea ecx, [esi*4]
pop esi
popal
bsf edi, edi
jmp 0x8c8529
push esi
cpuid
mov ecx, 0xe087d6e2
mov di, ax
xchg dword [esp], edx
adc al, 0xec
jmp 0x8c84d5
mov si, word [esp]
cpuid
lea edx, [ebp*4]
seto bh
xchg di, ax
mov di, word [esp]
jmp 0x8c84eb
btc ebp, edi
inc eax
lea ebp, reloc.MSVCRT.dll_strncpy
mov si, bp
sub esp, 5
std
jmp 0x8c8581
mov ch, bh
std
mov ecx, dword [esp]
mov bx, word [esp]
mov bp, word [esp]
lea esp, [esp]
jmp 0x8c856b
mov ebx, dword [esp]
lea ebp, [ebx*4]
setae bh
xchg ebp, ecx
bts edi, ecx
xchg ebx, ebp
jmp 0x8c8510
bsf bx, cx
xchg esi, eax
mov dh, byte [esp]
dec ebx
bsf ecx, ecx
jmp 0x8c85a5
bswap eax
lea esi, [eax - 0x56]
pop esi
bsr edx, ebp
std
bswap esi
jmp 0x8c853c
lea ebp, reloc.MSVCRT.dll_strncpy
sub esp, 6
xchg si, cx
xchg ecx, eax
jmp 0x8c85ff
lea edx, [ebp*4]
rcl ax, 0
mov al, 0xf5
lea ebx, [eax + esi]
std
xchg al, dl
jmp 0x8c858f
push dword [esp + 1]
push word [esp + 0x11]
sub esp, 0x14
lea esp, [esp + 0x54]
mov bp, si
mov dx, word [esp]
jmp 0x8c8555
mov bp, bx
mov edx, dword [esp + 1]
mov dx, 0x9c1b
mov edi, dword [esp + 2]
xchg dh, cl
call fcn.008c85e9
sub esp, 9
mov byte [esp + 3], al
bswap ebx
mov cl, byte [esp + 2]
mov ecx, dword [esp + 0xc]
xchg dword [esp + 2], eax
jmp 0x8c84b9
lea edx, [eax + edx]
push word [esp + 1]
cmc
mov cx, word [esp + 1]
add esi, 0x3401ce81
lea edx, [eax + edx]
jmp 0x8c864b
mov byte [esp], dh
lea eax, [ecx*4]
mov dx, ax
mov bx, sp
cmc
adc ebp, eax
jmp 0x8c881d
pop word [esp]
std
lea esp, [esp + 2]
pushal
bswap edi
sub esp, 2
jmp 0x8c88a0
jmp 0x8c8a06

Function at 0x8c9b4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
push dword [esp + 4]
pushal
mov byte [esp + 0x18], dh
jmp 0x8c9b5e
Function at 0x8c9dcf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [esp + 1]
sub esp, 0x19
not cx
push word [esp + 0x10]
jmp 0x8c9de1
mov dword [esp], ecx
lea ebx, [edx - 0xd1]
mov edi, esp
xchg dword [esp], ecx
cpuid
jmp 0x8c9db9
xchg byte [esp + 0x15], dl
add esp, 0x1f
cpuid
bsf ecx, edi
and cx, cx
pushal
jmp 0x8c9e74
xor edi, 0x35131241
lea esp, [esp + 2]
sub esp, 0x11
xchg ecx, ebp
pop word [esp + 0x12]
mov ebx, 0x9e833c2a
jmp 0x8c9e10
cpuid
sets ch
not edi
dec cx
xchg edx, ecx
xchg word [esp + 0xc], si
jmp 0x8c9e26

Function at 0x8ca34c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 1]
pop word [esp + 1]
jmp 0x8ca336

Function at 0x8ca8a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push si
neg dx
sub esp, 0x12
jmp 0x8ca8dc

Function at 0x8cacf8
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x8cacc6
mov dword [esp], edi
mov word [esp + 1], dx
mov dword [esp + 0x20], esp
call 0x8cacef
adc byte [eax + 0x71906106], dl
lea ebx, [edi + ebp*2]
jbe 0x8cad43
mov dword [esp + 1], edx
mov dword [esp + 0x1c], edx
call fcn.008cacb6
mov dword [esp], esp
call 0x8cacf8
mov al, byte [0x5244488]
mov dword [esp + 0x24], ebp
jmp 0x8cad2f
push word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x8cad72
pushfd
push dword [esp + 1]
mov dword [esp + 2], eax
mov dword [esp + 3], esp
mov dword [esp + 0x28], esi
pushfd
jmp 0x8cad11
mov eax, dword fs:[0x30]
Function at 0x10001480
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
push 0x7d7dffff
push 0x1fffffff
call fcn.10007830
mov dword [0x10047bcc], eax
movsx eax, byte [0x10047ba6]
push eax
push 0xe949ffff
call fcn.100078b0
mov ecx, dword [esp + 0x1c]
push 3
push ecx
mov dword [0x10047bc0], eax
mov byte [0x10047ba1], 1
call dword [sym.imp.MSVCRT.dll_div]
push 0x55c9ffff
push 0xbce7ffff
mov esi, eax
mov edi, edx
call fcn.10007700
movsx dx, byte [0x10047ba7]
mov word [0x10047bb4], ax
mov ax, word [0x10047bae]
sub ax, dx
add esp, 0x20
add word [0x10047bb0], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov byte [0x10047ba5], al
call dword [sym.imp.USER32.dll_GetInputState]
mov cl, byte [0x10047ba8]
mov edx, dword [0x10047be0]
add cl, al
mov byte [0x10047ba8], cl
movsx ecx, word [0x10047bb6]
push ecx
push edx
call fcn.10007830
mov ecx, dword [0x10047bc0]
add esp, 8
add ecx, eax
test edi, edi
mov dword [0x10047bc0], ecx
jne 0x100015d4
movsx eax, word [0x10047bae]
mov ecx, dword [0x10047bd4]
push eax
push ecx
call fcn.10007650
movsx edx, byte [0x10047ba4]
mov cl, byte [0x10047ba8]
push edx
add cl, al
push 0xc4b7ffff
mov byte [0x10047ba8], cl
call fcn.100077d0
movsx ecx, byte [0x10047ba4]
mov word [0x10047bb0], ax
mov eax, dword [0x10047bc8]
push eax
push ecx
call fcn.100077d0
movsx edx, word [0x10047baa]
add word [0x10047bac], ax
mov ecx, dword [0x10047bd4]
mov al, byte [0x10047ba7]
or edx, 0xe0cbffff
add esp, 0x18
add ecx, edx
dec al
mov word [0x10047bb4], 0xfffe
mov byte [0x10047ba7], al
lea eax, [esi*4 + 1]
pop edi
mov dword [0x10047bd4], ecx
pop esi
ret 4
movsx eax, byte [0x10047ba4]
push 0x9199ffff
push eax
call fcn.100077d0
mov ecx, dword [0x10047bd8]
add word [0x10047bb6], ax
push 0x4639ffff
push ecx
call fcn.100075f0
mov ecx, dword [0x10047bdc]
xor edx, edx
add ecx, eax
cmp word [0x10047bba], dx
push 0x999dffff
push 0x2c9dffff
setne dl
mov dword [0x10047bdc], ecx
mov word [0x10047bbc], dx
call fcn.100076b0
mov edi, dword [0x10047be0]
add esp, 0x18
movsx edx, word [0x10047bb8]
add edi, eax
mov eax, dword [0x10047bdc]
and edx, 0x6f0dffff
mov cl, al
add eax, edx
mov dword [0x10047be0], edi
inc cl
mov dword [0x10047bdc], eax
lea eax, [esi*4 + 5]
pop edi
mov byte [0x10047ba0], cl
mov dword [0x10047bd0], 0x7a900000
pop esi
ret 4
Function at 0x10001680
Capabilities:
Identify system language via api

Disassembly:
movsx eax, byte [0x10047ba0]
mov ecx, dword [0x10047bc0]
sub esp, 8
push ebp
push esi
push edi
push eax
push ecx
call fcn.100078b0
push 0x5b2bffff
push 0x694bffff
mov word [0x10047bba], ax
call fcn.10007830
mov ebp, dword [esp + 0x28]
add word [0x10047bb0], ax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
movsx edx, byte [0x10047ba6]
not ecx
dec ecx
mov edi, ecx
mov ecx, dword [0x10047be4]
and edx, ecx
cmp word [0x10047bae], ax
mov dword [0x10047bc4], edx
jne 0x100016fc
mov eax, dword [0x10047bc8]
mov dword [0x10047bc8], 0
test eax, eax
je 0x10001706
mov dword [0x10047bc8], 1
push 4
push edi
call dword [sym.imp.MSVCRT.dll_div]
mov esi, eax
mov eax, dword [0x10047bc4]
push 0xbf3ffff
push eax
mov dword [esp + 0x20], edx
call fcn.10007780
push 0xacf9ffff
push 0xed91ffff
mov dword [0x10047bc4], eax
call fcn.10007830
mov cx, word [0x10047bcc]
add word [0x10047bba], ax
sub word [0x10047bb8], cx
mov al, byte [edi + ebp - 1]
add esp, 0x18
cmp al, 0x3d
je 0x100017b1
push 0xc6b3ffff
push 0x2393ffff
call fcn.100078b0
movsx edx, byte [0x10047ba5]
mov cl, byte [0x10047ba6]
push edx
add cl, al
push 0xc28fffff
mov byte [0x10047ba6], cl
call fcn.100076b0
mov ecx, dword [0x10047be4]
add esp, 0x10
add ecx, eax
lea eax, [esi + esi*2]
mov dword [0x10047be4], ecx
imul ecx, ecx, 0x54d3ffff
pop edi
pop esi
mov dword [0x10047bcc], ecx
pop ebp
add esp, 8
ret 4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [0x10047bb2], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add word [0x10047baa], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x10047bc8], eax
mov al, byte [edi + ebp - 2]
cmp al, 0x3d
jne 0x10001821
movsx ax, byte [0x10047ba6]
and ax, word [0x10047bb8]
push 0x1307ffff
push 0x9fa1ffff
add word [0x10047bbc], ax
call fcn.10007780
add esp, 8
mov byte [0x10047ba7], al
lea eax, [esi + esi*2 - 2]
mov dword [0x10047be4], 0xc7960001
pop edi
pop esi
pop ebp
add esp, 8
ret 4
mov ecx, dword [0x10047bcc]
push ecx
push 0x1561ffff
call fcn.10007740
mov cl, byte [0x10047ba8]
push 0x3d9ffff
add cl, al
push 0x595bffff
mov byte [0x10047ba8], cl
call fcn.10007700
mov dl, byte [0x10047ba0]
add esp, 0x10
add dl, al
mov byte [0x10047ba0], dl
call dword [sym.imp.USER32.dll_GetCapture]
add word [0x10047bae], ax
lea eax, [esi + esi*2 - 1]
pop edi
pop esi
pop ebp
add esp, 8
ret 4
Function at 0x1001d580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003ef39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x28]
push ebx
xor ebx, ebx
push esi
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], ebx
mov ecx, dword [eax + 4]
cmp ecx, ebx
jne 0x1001d5c6
xor eax, eax
jmp 0x1001d5cb
mov eax, dword [eax + 8]
add eax, ecx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push edx
push eax
push ecx
lea eax, [esp + 0x20]
lea ecx, [esp + 0x44]
push eax
push ecx
call fcn.1001e5c0
mov esi, dword [esp + 0x48]
mov dl, byte [esp + 0x28]
add esp, 0x1c
mov byte [esi], dl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea edx, [esp + 0xc]
mov ecx, dword [eax]
push ecx
push ebx
push edx
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x1001d64c
mov al, byte [ecx - 1]
cmp al, bl
je 0x1001d642
cmp al, 0xff
je 0x1001d642
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.1002cda0
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x10023ac0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1003f1eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.10023be0
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x10047afc
call dword [sym.imp.MSVCRT.dll_public:_void___thiscall_exception::constructor_char_const__const_const__]
mov al, byte [esi]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov byte [esp + 0x24], al
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov edx, dword [ecx]
lea ecx, [esp + 0x24]
push edx
push ebx
push esi
mov byte [esp + 0x48], 1
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov eax, dword [sym.imp.MSVCP60.dll_const_std::runtime_error::vftable]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x10023b6b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x10023b62
cmp al, 0xff
je 0x10023b62
dec al
mov byte [ecx], al
jmp 0x10023b6b
push ecx
call fcn.1002cda0
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.1003c9f0
mov eax, dword [esp + 0x28]
mov ecx, dword [sym.imp.MSVCP60.dll_const_std::runtime_error::vftable]
cmp eax, ebx
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x18], ecx
je 0x10023bb7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x10023bae
cmp al, 0xff
je 0x10023bae
dec al
mov byte [ecx], al
jmp 0x10023bb7
push ecx
call fcn.1002cda0
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.MSVCRT.dll_public_virtual:_void___thiscall_exception::destructor_void_]
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x10026770
Capabilities:
Hash data with md5

Disassembly:
movsx eax, byte [0x10047ba1]
push esi
mov esi, ecx
mov ecx, dword [0x10047bcc]
push eax
push ecx
call fcn.10007700
mov cl, byte [0x10047ba8]
mov edx, dword [0x10047bd8]
add cl, al
mov eax, dword [0x10047bdc]
push edx
push eax
mov byte [0x10047ba8], cl
call fcn.100078b0
mov cl, byte [0x10047ba1]
lea edx, [esi + 0x10]
add cl, al
add esp, 0x10
mov byte [0x10047ba1], cl
xor ecx, ecx
mov dword [edx], ecx
push 0x5451ffff
mov dword [edx + 4], ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov word [0x10047bb6], ax
mov eax, dword [0x10047be0]
push eax
push 0x6fabffff
call fcn.100076b0
mov word [0x10047bb4], ax
mov dword [esi], 0x67452301
movsx ecx, word [0x10047bba]
push ecx
push 0xb9d5ffff
call fcn.10007740
movsx edx, byte [0x10047ba1]
push edx
push 0xfd5fffff
mov dword [0x10047bd4], eax
call fcn.10007700
mov cl, byte [0x10047ba9]
add esp, 0x18
add cl, al
mov al, byte [0x10047ba0]
test al, al
mov byte [0x10047ba9], cl
je 0x10026846
cmp word [0x10047baa], 0
mov dword [0x10047be4], 1
jne 0x10026850
mov dword [0x10047be4], 0
push 0xe365ffff
mov dword [esi + 4], 0xefcdab89
call dword [sym.imp.USER32.dll_IsWindow]
push 0xffffffffffffffff
mov byte [0x10047ba4], al
call dword [sym.imp.USER32.dll_IsCharUpperA]
mov cl, byte [0x10047ba5]
push 0x8ebfffff
add cl, al
mov byte [0x10047ba5], cl
mov dword [esi + 8], 0x98badcfe
mov eax, dword [0x10047bdc]
push eax
call fcn.100076b0
add word [0x10047bba], ax
mov al, byte [0x10047bb8]
imul byte [0x10047bd4]
mov byte [0x10047ba2], al
mov dword [esi + 0xc], 0x10325476
mov cl, byte [0x10047bd0]
mov al, byte [0x10047baa]
mov dl, byte [0x10047ba5]
sub cl, al
movsx eax, word [0x10047bb6]
add dl, cl
add esp, 8
mov byte [0x10047ba5], dl
movsx edx, byte [0x10047ba6]
sub edx, eax
mov dword [0x10047bd0], edx
call dword [sym.imp.USER32.dll_GetCursor]
mov word [0x10047bac], ax
pop esi
ret
Function at 0x10026b80
Capabilities:
Identify system language via api

Disassembly:
movsx eax, word [0x10047bb4]
sub esp, 8
mov byte [0x10047ba8], 0xff
push ebx
push esi
push edi
push 0x8e71ffff
mov esi, ecx
push eax
call fcn.10007830
push 0x9769ffff
push 0xeb3dffff
mov dword [0x10047bc0], eax
call fcn.10007700
mov ecx, dword [0x10047be4]
add esp, 0x10
add ecx, eax
lea edi, [esi + 0x10]
mov dword [0x10047be4], ecx
push 8
lea ecx, [esp + 0x10]
push edi
push ecx
mov ecx, esi
call fcn.10028190
movsx edx, word [0x10047bba]
push 0x8377ffff
push edx
call fcn.100075f0
mov word [0x10047bb4], ax
mov eax, dword [edi]
shr eax, 3
and eax, 0x3f
add esp, 8
cmp eax, 0x38
mov ebx, 0x38
jb 0x10026c0a
mov ebx, 0x78
push 0x5f3ffff
push 0xfe51ffff
sub ebx, eax
call fcn.10007700
mov ecx, dword [0x10047bdc]
add esp, 8
add ecx, eax
mov dword [0x10047be0], 0x6f97ffff
mov dword [0x10047bdc], ecx
push ebx
push 0x10047214
mov ecx, esi
call fcn.10026900
movsx eax, word [0x10047bb0]
mov ecx, dword [0x10047be4]
lea edx, [ecx + eax - 0x1639ffff]
mov dword [0x10047be4], edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add word [0x10047bba], ax
mov eax, dword [0x10047bc0]
push eax
push 0xe321ffff
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, dword [0x10047bd0]
push 8
add ebx, eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [0x10047bd0], ebx
call fcn.10026900
movsx ecx, byte [0x10047ba2]
push ecx
push 0xee71ffff
call fcn.10007830
movsx edx, word [0x10047bbc]
mov word [0x10047bac], ax
push edx
movsx eax, word [0x10047bba]
push eax
call fcn.100078b0
movsx ecx, word [0x10047bb4]
imul ecx, dword [0x10047bc8]
add word [0x10047bb2], ax
add esp, 0x10
lea edx, [esi + 0x58]
mov dword [0x10047be0], ecx
push 0x10
push esi
push edx
mov ecx, esi
call fcn.10028190
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov ecx, dword [0x10047bd4]
push ecx
push 0xb9a9ffff
call fcn.10007740
mov byte [0x10047ba8], al
movsx eax, word [0x10047bba]
push eax
push eax
call fcn.10007700
add word [0x10047bba], ax
mov eax, esi
xor edx, edx
mov ecx, 0x10
mov dword [eax], edx
lea edi, [esi + 0x18]
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
xor eax, eax
rep stosd dword es:[edi], eax
movsx ecx, word [0x10047bb4]
push ecx
push 0xad4fffff
call fcn.100075f0
mov dword [0x10047bcc], eax
movsx edx, byte [0x10047ba7]
push 0x9755ffff
push edx
call fcn.100075f0
add esp, 0x20
mov dword [0x10047be4], eax
pop edi
pop esi
pop ebx
add esp, 8
ret