joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006fa40
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
xor edi, edi
lea esi, [ebx + 4]
lea ebx, [ebx]
push 8
push edi
mov ecx, ebx
call fcn.1006f940
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov edx, eax
and edx, 0x80000000
neg edx
sbb edx, edx
and edx, 0x4c11db7
add eax, eax
xor edx, eax
mov ecx, edx
push 0x20
push ecx
mov ecx, ebx
call fcn.1006f940
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0xff
jle 0x1006fa50
pop edi
pop esi
pop ebx
ret
Function at 0x10070800
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, edx
add edi, 0xfffffffc
test edi, edi
jle 0x10070a3a
push ebx
add eax, 2
push esi
jmp 0x10070820
movzx edx, byte [eax - 1]
movzx edx, byte [edx + 0x101c3328]
movzx esi, byte [eax - 2]
movzx esi, byte [esi + 0x101c3328]
xor edx, esi
movzx ebx, byte [0x101c3328]
movzx esi, byte [eax]
xor esi, ebx
movzx esi, byte [esi + 0x101c3328]
add edx, esi
and edx, 0xff
inc dword [ecx + edx*4]
movzx edx, byte [eax - 2]
movzx esi, byte [eax - 1]
movzx esi, byte [esi + 0x101c3328]
inc edx
movzx ebx, byte [0x101c3329]
and edx, 0xff
movzx edx, byte [edx + 0x101c3328]
lea esi, [esi + esi*2]
xor edx, esi
movzx esi, byte [eax + 1]
xor esi, ebx
movzx esi, byte [esi + 0x101c3328]
add edx, esi
and edx, 0xff
inc dword [ecx + edx*4]
movzx edx, byte [eax - 2]
movzx esi, byte [eax]
movzx esi, byte [esi + 0x101c3328]
movzx ebx, byte [0x101c332a]
add edx, 2
and edx, 0xff
movzx edx, byte [edx + 0x101c3328]
lea esi, [esi + esi*4]
xor edx, esi
movzx esi, byte [eax + 1]
xor esi, ebx
movzx esi, byte [esi + 0x101c3328]
add edx, esi
and edx, 0xff
inc dword [ecx + edx*4]
movzx edx, byte [eax - 2]
movzx esi, byte [eax]
movzx esi, byte [esi + 0x101c3328]
add edx, 3
and edx, 0xff
movzx edx, byte [edx + 0x101c3328]
lea ebx, [esi*8]
sub ebx, esi
movzx esi, byte [eax + 2]
xor edx, ebx
movzx ebx, byte [0x101c332b]
xor esi, ebx
movzx esi, byte [esi + 0x101c3328]
add edx, esi
and edx, 0xff
inc dword [ecx + edx*4]
movzx edx, byte [eax - 1]
movzx esi, byte [eax]
movzx esi, byte [esi + 0x101c3328]
movzx ebx, byte [0x101c332c]
add edx, 4
and edx, 0xff
movzx edx, byte [edx + 0x101c3328]
lea esi, [esi + esi*8]
xor edx, esi
movzx esi, byte [eax + 1]
xor esi, ebx
movzx esi, byte [esi + 0x101c3328]
add edx, esi
and edx, 0xff
inc dword [ecx + edx*4]
movzx esi, byte [eax]
movzx esi, byte [esi + 0x101c3328]
movzx edx, byte [eax - 1]
imul esi, esi, 0xb
add edx, 5
and edx, 0xff
movzx edx, byte [edx + 0x101c3328]
xor edx, esi
movzx esi, byte [eax + 2]
movzx ebx, byte [0x101c332d]
xor esi, ebx
movzx esi, byte [esi + 0x101c3328]
add edx, esi
and edx, 0xff
inc dword [ecx + edx*4]
movzx esi, byte [eax + 1]
movzx esi, byte [esi + 0x101c3328]
movzx edx, byte [eax - 1]
imul esi, esi, 0xd
movzx ebx, byte [0x101c332e]
add edx, 6
and edx, 0xff
movzx edx, byte [edx + 0x101c3328]
xor edx, esi
movzx esi, byte [eax + 2]
xor esi, ebx
movzx esi, byte [esi + 0x101c3328]
add edx, esi
and edx, 0xff
inc dword [ecx + edx*4]
movzx esi, byte [eax + 1]
movzx esi, byte [esi + 0x101c3328]
movzx edx, byte [eax]
add edx, 7
and edx, 0xff
movzx edx, byte [edx + 0x101c3328]
mov ebx, esi
shl ebx, 4
sub ebx, esi
movzx esi, byte [eax + 2]
xor edx, ebx
movzx ebx, byte [0x101c332f]
xor esi, ebx
movzx esi, byte [esi + 0x101c3328]
add edx, esi
and edx, 0xff
inc dword [ecx + edx*4]
inc eax
sub edi, 1
jne 0x10070820
pop esi
pop ebx
pop edi
ret
Function at 0x10070c40
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x28
mov eax, dword [0x1017a974]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
mov ebp, ecx
mov edx, dword [ebp + 0x30]
sub edx, 6
push esi
push edi
test edx, edx
jle 0x10070c6a
mov esi, dword [esp + 0x3c]
mov ecx, edx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor ecx, ecx
xor eax, eax
test edx, edx
jle 0x10070ca3
cmp esi, dword [ebp + 0x30]
ja 0x10070dcc
cmp eax, edx
jge 0x10070c97
cmp ecx, 4
jge 0x10070c9a
mov ebx, dword [esp + eax*4 + 0x14]
lea edi, [ecx + esi*4]
inc eax
inc ecx
cmp eax, edx
mov dword [ebp + edi*4 + 0x34], ebx
jl 0x10070c81
cmp ecx, 4
jne 0x10070c9f
inc esi
xor ecx, ecx
cmp eax, edx
jl 0x10070c74
cmp esi, dword [ebp + 0x30]
ja 0x10070dcc
mov dword [esp + 0x10], 0x101796a0
jmp 0x10070cc0
movzx edi, byte [esp + edx*4 + 0x11]
mov al, byte [esp + 0x14]
xor al, byte [edi + 0x101764a0]
mov byte [esp + 0x14], al
movzx edi, byte [esp + edx*4 + 0x12]
movzx ebx, byte [edi + 0x101764a0]
xor byte [esp + 0x15], bl
movzx edi, byte [esp + edx*4 + 0x13]
movzx ebx, byte [edi + 0x101764a0]
xor byte [esp + 0x16], bl
movzx edi, byte [esp + edx*4 + 0x10]
movzx ebx, byte [edi + 0x101764a0]
mov edi, dword [esp + 0x10]
xor al, byte [edi]
xor byte [esp + 0x17], bl
add edi, 4
mov byte [esp + 0x14], al
mov dword [esp + 0x10], edi
mov eax, 1
cmp edx, 8
je 0x10070d31
cmp edx, eax
jle 0x10070d92
mov edi, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], edi
inc eax
cmp eax, edx
jl 0x10070d22
jmp 0x10070d92
mov edi, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], edi
inc eax
cmp eax, 4
jl 0x10070d31
movzx eax, byte [esp + 0x20]
movzx eax, byte [eax + 0x101764a0]
xor byte [esp + 0x24], al
movzx eax, byte [esp + 0x21]
movzx eax, byte [eax + 0x101764a0]
xor byte [esp + 0x25], al
movzx eax, byte [esp + 0x22]
movzx eax, byte [eax + 0x101764a0]
xor byte [esp + 0x26], al
movzx eax, byte [esp + 0x23]
movzx eax, byte [eax + 0x101764a0]
xor byte [esp + 0x27], al
mov eax, 5
mov edi, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], edi
inc eax
cmp eax, 8
jl 0x10070d84
xor eax, eax
test edx, edx
jle 0x10070dc3
cmp esi, dword [ebp + 0x30]
ja 0x10070dcc
cmp eax, edx
jge 0x10070db7
cmp ecx, 4
jge 0x10070dba
mov ebx, dword [esp + eax*4 + 0x14]
lea edi, [ecx + esi*4]
inc eax
inc ecx
cmp eax, edx
mov dword [ebp + edi*4 + 0x34], ebx
jl 0x10070da1
cmp ecx, 4
jne 0x10070dbf
inc esi
xor ecx, ecx
cmp eax, edx
jl 0x10070d98
cmp esi, dword [ebp + 0x30]
jbe 0x10070cc0
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d5eaf
add esp, 0x28
ret 4
Function at 0x10070df0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 1
cmp dword [ecx + 0x30], edx
jbe 0x10070eda
push esi
lea eax, [ecx + 0x46]
push edi
jmp 0x10070e10
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x101792a0]
movzx edi, byte [eax - 1]
xor esi, dword [edi*4 + 0x10178aa0]
movzx edi, byte [eax]
xor esi, dword [edi*4 + 0x10178ea0]
movzx edi, byte [eax - 2]
xor esi, dword [edi*4 + 0x101786a0]
inc edx
mov dword [eax - 2], esi
movzx esi, byte [eax + 5]
mov esi, dword [esi*4 + 0x101792a0]
movzx edi, byte [eax + 4]
xor esi, dword [edi*4 + 0x10178ea0]
movzx edi, byte [eax + 3]
xor esi, dword [edi*4 + 0x10178aa0]
movzx edi, byte [eax + 2]
xor esi, dword [edi*4 + 0x101786a0]
add eax, 0x10
mov dword [eax - 0xe], esi
movzx esi, byte [eax - 7]
mov esi, dword [esi*4 + 0x101792a0]
movzx edi, byte [eax - 8]
xor esi, dword [edi*4 + 0x10178ea0]
movzx edi, byte [eax - 9]
xor esi, dword [edi*4 + 0x10178aa0]
movzx edi, byte [eax - 0xa]
xor esi, dword [edi*4 + 0x101786a0]
mov dword [eax - 0xa], esi
movzx esi, byte [eax - 3]
movzx edi, byte [eax - 4]
mov esi, dword [esi*4 + 0x101792a0]
xor esi, dword [edi*4 + 0x10178ea0]
movzx edi, byte [eax - 5]
xor esi, dword [edi*4 + 0x10178aa0]
movzx edi, byte [eax - 6]
xor esi, dword [edi*4 + 0x101786a0]
mov dword [eax - 6], esi
cmp edx, dword [ecx + 0x30]
jb 0x10070e10
pop edi
pop esi
ret
Function at 0x100729a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
or eax, 0xffffffff
test edx, edx
je 0x100729cf
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
movzx ebx, byte [esi]
mov edi, eax
and edi, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [ecx + edi*4 + 4]
dec edx
inc esi
test edx, edx
jne 0x100729b2
pop edi
pop esi
pop ebx
not eax
ret 8

Function at 0x10072ab0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
je 0x10072adb
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
movzx ebx, byte [esi]
mov edi, eax
shl eax, 8
shr edi, 0x18
or eax, ebx
xor eax, dword [ecx + edi*4 + 4]
dec edx
inc esi
test edx, edx
jne 0x10072ac1
pop edi
pop esi
pop ebx
ret 8
Function at 0x10077a40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1012ea43
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
call fcn.10077300
mov dword [esp + 0x18], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x101c3538
mov byte [esp + 0x18], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push ebx
push 0x10157e11
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.10075f60
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x10078fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1012eda9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 5
call fcn.10077300
mov dword [esp + 0x14], 0
mov eax, 0x101c3538
mov dword [esi], vtable.TiXmlDeclaration.0
mov dword [esi + 0x2c], eax
mov byte [esp + 0x14], 1
mov dword [esi + 0x30], eax
mov byte [esp + 0x14], 2
mov dword [esi + 0x34], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x1008cdd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101312ba
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CSlxSelfSafeCheck.0
mov dword [esp + 0x18], 9
lea ecx, [esi + 0x140]
call fcn.1004a280
mov al, 8
mov byte [esp + 0x18], al
lea ecx, [esi + 0x120]
mov dword [esp + 0xc], ecx
mov byte [esp + 0x18], al
call fcn.10037ee0
mov byte [esp + 0x18], 7
lea ecx, [esi + 0x108]
call fcn.1008b710
mov byte [esp + 0x18], 6
lea ecx, [esi + 0xf0]
call fcn.1006efb0
mov byte [esp + 0x18], 5
lea ecx, [esi + 0x50]
call fcn.10087db0
mov byte [esp + 0x18], 4
lea ecx, [esi + 0x40]
call fcn.1006efb0
mov byte [esp + 0x18], 3
lea ecx, [esi + 0x38]
call fcn.1006efb0
mov byte [esp + 0x18], 2
lea ecx, [esi + 0x30]
call fcn.1006efb0
mov byte [esp + 0x18], 1
lea ecx, [esi + 0x28]
call fcn.1006efb0
mov byte [esp + 0x18], 0
lea ecx, [esi + 0x10]
call fcn.1004a280
mov dword [esp + 0x18], 0xffffffff
mov ecx, esi
call fcn.10036510
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x10093e50
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x10132026
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
push 0x34
call fcn.100d59cb
add esp, 4
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [esp + 0x20], esi
cmp eax, esi
je 0x10093e98
mov ecx, eax
call fcn.10093c40
mov esi, eax
or ebx, 0xffffffff
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x28]
push 0x64
mov dword [esi], ebp
call fcn.100d59cb
add esp, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
test eax, eax
je 0x10093ed4
mov ecx, dword [ebp + 0x30]
mov edx, dword [ebp + 0x2c]
push 0
push 0
push ecx
push edx
mov ecx, eax
call fcn.10093680
jmp 0x10093ed6
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esi + 4], eax
mov byte [esi + 8], 0
mov eax, dword [edi + 0x14]
sub eax, dword [edi + 0x10]
sar eax, 2
mov dword [ebp + 0x28], eax
mov ebp, dword [esi + 4]
cmp dword [ebp + 0x20], 0
jbe 0x10093f11
mov ecx, dword [ebp + 0x34]
sub ecx, dword [ebp + 0x30]
mov ebx, dword [ebp + 0x60]
sar ecx, 2
cmp ebx, ecx
jb 0x10093f0b
call fcn.100d63f7
mov edx, dword [ebp + 0x30]
mov ebp, dword [edx + ebx*4]
mov dword [esi + 0xc], ebp
mov eax, dword [ebp]
push esi
mov ecx, edi
mov dword [esi + 0x10], eax
call fcn.100933e0
test al, al
jne 0x10093fae
push 4
call fcn.100d59cb
mov ecx, dword [edi + 0x14]
sub ecx, dword [edi + 0x10]
add esp, 4
sar ecx, 2
dec ecx
lea edx, [esp + 0x28]
mov dword [eax], ecx
lea ebx, [edi + 0x1c]
push edx
mov ecx, ebx
mov dword [esp + 0x2c], eax
call fcn.10093320
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 8]
push ecx
call fcn.100d3c3c
mov edx, dword [esi + 0xc]
mov ebp, eax
xor eax, eax
add esp, 4
cmp dword [edx + 8], eax
jle 0x10093f8c
mov edi, edi
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x10]
mov dl, byte [edx + eax]
xor dl, byte [ecx + eax]
inc eax
mov byte [eax + ebp - 1], dl
mov ecx, dword [esi + 0xc]
cmp eax, dword [ecx + 8]
jl 0x10093f70
mov edx, dword [ebx + 0x10]
sub edx, dword [ebx + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 8]
sar edx, 2
push edx
push ecx
mov ecx, dword [edi]
push ebp
call fcn.1006f330
push ebp
call fcn.100d6d2c
add esp, 4
mov edx, dword [esi + 4]
mov eax, dword [edi + 0x3c]
mov ecx, dword [edx + 8]
cmp eax, ecx
jle 0x10093fc0
mov dword [edi + 0x3c], eax
jmp 0x10093fc3
mov dword [edi + 0x3c], ecx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x10097f20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x10132590
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x24], 0
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x2c]
lea esi, [ebx + ebx + 2]
cmp esi, ebp
mov dword [esp + 0x30], ebx
jge 0x10097fe6
mov eax, esi
shl eax, 4
sub esp, 0x10
lea ebp, [eax + edi]
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.100972a0
mov byte [esp + 0x34], 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x38], esp
push ebp
call fcn.100972a0
mov byte [esp + 0x44], 2
mov byte [esp + 0x44], 0
call dword [esp + 0x68]
add esp, 0x20
test al, al
je 0x10097fab
dec esi
mov eax, esi
shl eax, 4
mov edx, dword [eax + edi]
add eax, edi
mov ecx, ebx
shl ecx, 4
add ecx, edi
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push edx
add ecx, 8
push eax
call fcn.10095ac0
mov ebx, esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x34]
jl 0x10097f67
mov ebp, dword [esp + 0x34]
cmp esi, ebp
jne 0x10098015
mov ecx, ebp
shl ecx, 4
mov edx, dword [ecx + edi - 0x10]
lea eax, [ecx + edi - 0x10]
shl ebx, 4
add ebx, edi
mov dword [ebx], edx
mov ecx, dword [eax + 4]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push edx
lea ecx, [ebx + 8]
push eax
call fcn.10095ac0
lea ebx, [ebp - 1]
mov ecx, dword [esp + 0x48]
push ecx
sub esp, 0x10
lea edx, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call fcn.100972a0
mov byte [esp + 0x38], 3
mov eax, dword [esp + 0x44]
push eax
push ebx
push edi
mov byte [esp + 0x44], 0
call fcn.100974e0
add esp, 0x20
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x38]
call fcn.10096b50
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x100980c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101325c0
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
lea ecx, [eax + 8]
mov eax, dword [esi + 0xc]
push eax
push edx
call fcn.10095ac0
mov eax, dword [esp + 0x34]
push eax
sub esp, 0x10
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.100972a0
mov byte [esp + 0x24], 1
mov eax, dword [esp + 0x30]
sub eax, esi
sar eax, 4
push eax
push 0
push esi
mov byte [esp + 0x30], 0
call fcn.10097f20
add esp, 0x20
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.10096b50
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret
Function at 0x1009df10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10132f38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x30]
push eax
call fcn.10001a00
mov dword [esp + 0x24], 0
lea ecx, [esp + 0xc]
push ecx
mov dword [esi], vtable.std::ctype_wchar_t_.0
call fcn.100d48f5
mov edx, dword [eax]
mov dword [esi + 8], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov edx, dword [eax + 8]
mov dword [esi + 0x10], edx
mov eax, dword [eax + 0xc]
add esp, 4
mov dword [esi + 0x14], eax
call fcn.100d49dc
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
mov dword [esp + 0x24], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x100ab830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10135223
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
cmp dword [esi + 0x30], 0x10
jb 0x100ab872
mov eax, dword [esi + 0x1c]
push eax
call fcn.100d59a5
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.100aad20
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x100b29c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10135db3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], vtable.ContentFetcher.0
xor ebx, ebx
mov dword [esp + 0x20], ebx
push 0x101c3868
mov dword [esi], vtable.CDriverFetcher.0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov byte [esi + 0x18], 1
cmp edi, ebx
jne 0x100b2a30
mov edi, 0x10157e11
lea ecx, [esi + 0x1c]
mov eax, edi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
lea ebp, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100b2a45
sub eax, ebp
push eax
push edi
call fcn.100069f0
mov dword [esp + 0x20], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x100b4cf0
Capabilities:
Get file size
Read file on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xa0], 0
je 0x100b4b00
mov al, 1
pop esi
ret
cmp dword [esi + 0x78], 0xffffffff
jne 0x100b4b46
cmp dword [esi + 0x98], 0x10
jb 0x100b4b17
mov eax, dword [esi + 0x84]
jmp 0x100b4b1d
lea eax, [esi + 0x84]
push 0
push 0x80
push 3
push 0
push 7
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x78], eax
cmp eax, 0xffffffff
jne 0x100b4b42
xor al, al
pop esi
ret
mov byte [esi + 0x7c], 1
mov eax, dword [esi + 0x78]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x100b4b73
push 4
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0xa0], eax
test eax, eax
jne 0x100b4b78
pop ebx
xor al, al
pop esi
ret
mov ecx, dword [esi + 0x78]
push edi
push 0
lea edi, [esi + 0xa4]
push edi
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b4b9d
cmp dword [edi], 0
je 0x100b4b9d
pop edi
pop ebx
mov al, 1
pop esi
ret
mov edx, dword [esi + 0xa0]
push 0x8000
push 0
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [edi], 0
pop edi
pop ebx
mov dword [esi + 0xa0], 0
xor al, al
pop esi
ret
push 0xffffffffffffffff
push 0x1013621b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1017a974]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xa0], 0
je 0x100b4c12
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
cmp dword [esi + 0xd0], 0
jne 0x100b4c95
push 0x20
call fcn.100d59cb
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0
test eax, eax
je 0x100b4c40
mov ecx, eax
call fcn.100579a0
mov ecx, eax
jmp 0x100b4c42
xor ecx, ecx
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esi + 0x78]
mov dword [esi + 0xd0], ecx
cmp eax, 0xffffffff
je 0x100b4c60
push eax
call fcn.1005f620
jmp 0x100b4c7d
cmp dword [esi + 0x98], 0x10
jb 0x100b4c71
mov eax, dword [esi + 0x84]
jmp 0x100b4c77
lea eax, [esi + 0x84]
push eax
call fcn.1005fca0
test eax, eax
jne 0x100b4c95
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
mov ecx, dword [esi + 0xd0]
call fcn.10057a00
mov ecx, dword [esi + 0xd0]
mov dword [esi + 0xa0], eax
call fcn.10057a20
mov ecx, dword [esi + 0xd0]
mov edi, eax
call fcn.10057a30
add edi, eax
xor eax, eax
cmp dword [esi + 0xa0], eax
mov dword [esi + 0xa4], edi
setne al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
cmp byte [ecx + 0xcf], 0
jne 0x100b4cfe
jmp 0x100b4af0
jmp 0x100b4bd0