joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69a220
Capabilities:
Encode data using xor

Disassembly:
pop ebx
pop edx
pop edi
pop eax
add byte [ecx], al
add al, 0x83
ret
xor bl, dh
insd dword es:[edi], dx
sbb dh, byte [edx]
inc ebx
xor eax, 0x5f2ca45c
xor byte [eax + 0x70], bl
scasb al, byte es:[edi]
cmp esp, ebp
and eax, 0x338b1275
push ebp
cmc
jp 0x69a26f
cmp byte [ebp + edi + 0x97b2580], ah
int1
cld
jno 0x69a29a
jae 0x69a2a1
add dword [edi + 0xca6ac49], 0x953ab676
inc ebx
dec esi
xchg esi, eax
pop eax
ret
cmp esi, ebp
jno 0x69a1f5
push ecx
push esp
bound ebp, qword [edx - 0x72]
sub byte [0x2679ade2], bh
fisttp dword [eax]
in eax, 1
xor al, 0xab
adc dh, ah
jae 0x69a282
daa
mov eax, dword [0xa509c008]
pop edx
adc byte [edi + 0xa], ah
xlatb
cli
mov al, 0x38
push ss
jle 0x69a2de
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
dec esp
jno 0x69a2ce
fcomp dword [edx + 0x53998187]
aaa
in eax, dx
xchg dword [ecx - 0x12c8ac67], eax
cmp edi, 0xc9e5d749
cmp eax, 0xf213d242
rcl byte [edi + 0x6613e95a]
jae 0x69a32b
sbb byte [eax + 0x70], 0xf0
xlatb
cmp byte [ecx + 0x582519ab], cl
adc ebp, dword [edi]
jae 0x69a2fb
fstp dword [ecx + 0x35]
outsd dx, dword [esi]
and eax, 0x8df5416f
jecxz 0x69a32a
das
cmp dword [di + 0x5554], 0xae8fbfcf
scasb al, byte es:[edi]
cmp eax, ebp
insb byte es:[edi], dx
adc byte [edx], dl
sar byte [ecx], cl
ret 0x57a
add eax, 0x4cd68bc0
inc esi
clc
clc
xchg esp, eax
lahf
dec esi
jnp 0x69a289
mov ebp, 0x3939596c
sti
mov byte [0x9d2eee3b], al
sbb byte [edi], bh
les ebx, [ecx - 0x273a0cf6]
cmpsd dword [esi], dword es:[edi]
retf
movsb byte es:[edi], byte [esi]
push ecx
in al, 0x34
jle 0x69a354
je 0x69a2c6
std
dec eax
in eax, dx
fnstenv [eax - 0x7e891dd5]
mov eax, dword [0x5a2dcb38]
mov dl, 0x2b
pushal
invalid
salc
mov al, 0x2c
push es
test byte [eax + 0x54], 0x2d
inc eax
int1
outsd dx, dword [esi]
cmp ebp, esp
js 0x69a2e4
adc byte [ebx - 0x1cb7124d], bl
rcr dword [ecx - 0x45c5345f], 0x3c
clc
sbb dword [ecx - 0x759905a1], 0x775f48f3
push 0xeea9ebf9
cmp bl, byte [ecx - 0x12506cf0]
inc eax
out dx, eax
dec ebp
aam 0xad
inc eax
jo 0x69a3be
dec eax
pop edi
ja 0x69a3e5
stc
jmp 0x69a329
clc
clc
sbb dword [ecx - 0x7e0181a9], 0x605d68b1
fdiv st(3), st(0)
in al, 0x1d
out dx, al
sub al, byte [ebp + 0x66bbde9c]
or dh, byte [edx - 0x77]
aam 0xad
inc eax
jo 0x69a3d6
mov ebp, 0x5739c4f1
jbe 0x69a379
and dword [esi + 0x5a64494], 0xffffff9c
sub edi, ecx
adc dword [edx + 0xa], edx
aam 0x2e
mov esi, 0xc3d07eaf
cdq
invalid
cmp dh, bl
dec eax
pop ebp
push eax
mov al, byte [0x3479e1fd]
adc al, byte [ecx - 0x694ff19a]
mov al, 0x96
add dword [esi - 0x34d4c054], 0xd
dec esi
mov dl, 0x10
pushfd
or eax, 0x9c10b24e
mov dl, 0x50
in eax, dx
sti
jecxz 0x69a3ed
jp 0x69a3ff
and byte [ebp + eax - 0x11ba2774], ah
inc ebp
out dx, al
sub al, 4
adc dword [ecx + edi - 0x12], edx
push cs
std
ret
Function at 0x76f1e8
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xd51a42e5
inc edx
sbb dl, ch
cmp ebx, dword [edx + 0x33]
sbb ah, byte [edx - 0x170450b0]
out 0xb8, al
and byte [edx - 0x12], dl
push eax
scasd eax, dword es:[edi]
sti
call 0x5497aae0
loop 0x76f1ea
sbb al, 0x18
sub dword [edi + edx], ebp
outsb dx, byte [esi]
mov eax, 0x16478a38
xor esp, eax
imul edi, edi, 0x3c
pop edi
bound esp, qword [ecx]
nop
cwde
add dword [0xa4c620cc], 0x53b31a81
aad 0x6c
push 0x14
jl 0x76f1f2
jo 0x76f248
cmovle ecx, dword [eax - 0x10]
push edi
wait
pop esi
jl 0x76f28a
cmp bl, ch
dec edx
cmp byte [esi - 0x103e5c75], dh
mov ebx, 0x6e19c295
push cs
lcall 0x6cb8, 0x6e54c47b
or byte [ebx], ch
jmp 0x76f280
mov dh, 0x8b
mov dword [0x95bbefc1], eax
ret 0x6e19
salc
cdq
test dword [ebp + 0x3721fff9], edi
pop edx
fbld tbyte [ecx - 0x1123fa14]
mov ebx, 0x8c06d61c
cmp ch, byte [ecx]
add dl, byte [ecx - 0x27926c24]
push ebx
xchg ebx, eax
in eax, dx
loop 0x76f27e
pushfd
jb 0x76f230
mov ebp, 0x78193687
imul edx, esp, 0x3baaac5b
sub cl, byte [eax - 0x249d6a66]
out dx, eax
insb byte es:[edi], dx
shl byte [edi + 0x58eb5048], cl
and ebx, esi
push 0xffffffffffffffe6
xor bl, al
cmp dword [edx + 0x49ad2c16], edx
inc edx
and byte [edx], bh
cld
jp 0x76f2d3
popfd
add eax, 0xff026d8e
imul ebx, edi, 0xf93a90e
mov gs, word [ebp - 0x5b]
out 9, al
aas
fld dword [eax - 0x1b]
adc ah, byte [ebx]
jl 0x76f2ce
bound ebp, qword [eax + 0xb]
mov bl, byte [eax - 0x1c4b83d1]
fld st(5)
jp 0x76f25e
scasd eax, dword es:[edi]
mov ah, 0x9a
inc eax
stosb byte es:[edi], al
and ecx, dword [eax]
lodsb al, byte [esi]
jnp 0x76f250
test al, 0x45
inc ebp
or al, 0xce
push cs
sal byte [ebx + 0x44], 1
jl 0x76f324
invalid
pop eax
int3
Function at 0x10001580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push esi
call fcn.100032ba
mov esi, eax
test esi, esi
je 0x10001801
mov ecx, esi
call fcn.10001ec0
test eax, eax
je 0x10001801
mov dword [esi + 0x6c4], 1
mov edx, 2
mov word [ebp - 4], 0xbb01
movzx eax, word [ebp - 4]
mov dword [esi + 0x6c0], 0
mov word [esi + 0x622], ax
mov word [esi + 0x620], dx
mov dword [esi + 0x624], 0xbd9e548b
mov eax, dword [esi + 0x6c4]
mov word [ebp - 4], 0xbb01
lea ecx, [eax + 0x62]
inc eax
add ecx, ecx
mov dword [esi + 0x6c4], eax
movzx eax, word [ebp - 4]
xor edi, edi
mov word [esi + ecx*8 + 2], ax
lea ebx, [esi + 0xd4]
mov dword [esi + ecx*8 + 4], 0xbd9e548b
lea eax, [esi + 0xe4]
mov word [esi + ecx*8], dx
nop dword [eax]
mov dword [esi + 0x4f8], eax
xor edx, edx
nop dword [eax + eax]
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [edx + eax], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [eax + edx + 1], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [eax + edx + 2], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [eax + edx + 3], cl
add edx, 4
cmp edx, 0x100
jl 0x10001630
mov eax, dword [esi + 0x4f8]
mov byte [eax + 0x110], 0
mov eax, dword [esi + 0x4f8]
add eax, 0x100
push eax
push 0x10
push ebx
call fcn.100032f8
add esp, 0xc
lea eax, [esi + 0x500]
push eax
mov eax, dword [esi + 0x4f8]
add eax, 0x111
push eax
mov eax, dword [esi + 0x48]
call eax
mov eax, dword [esi + 0x600]
xor ebx, ebx
add eax, 0x111
mov dword [esi + 0x4fc], eax
add eax, 0xffffff00
je 0x10001739
mov ecx, dword [esi + 0x4f8]
movzx eax, bl
lea edx, [ecx + ebx]
inc ebx
mov al, byte [eax + ecx]
xor byte [edx + 0x100], al
mov eax, dword [esi + 0x4fc]
sub eax, 0x100
cmp ebx, eax
jb 0x10001714
mov ecx, esi
call fcn.10002090
test eax, eax
je 0x1000175f
mov ecx, esi
call fcn.10001060
test eax, eax
lea ebx, [esi + 0xd4]
lea eax, [esi + 0xe4]
jne 0x10001620
mov eax, dword [esi + 0x6c0]
add eax, 1
mov dword [esi + 0x6c0], eax
js 0x10001778
cmp eax, dword [esi + 0x6c4]
jl 0x10001782
mov dword [esi + 0x6c0], 0
mov eax, dword [esi + 0x18]
push 0xafc8
call eax
add edi, 0x2d
lea eax, [esi + 0xe4]
lea ebx, [esi + 0xd4]
cmp edi, 0x708
jl 0x10001620
mov dword [esi + 0x6c4], 1
xor edi, edi
mov word [ebp - 4], 0xbb01
mov edx, 2
movzx eax, word [ebp - 4]
mov dword [esi + 0x6c0], edi
mov word [esi + 0x622], ax
mov word [esi + 0x620], dx
mov dword [esi + 0x624], 0xbd9e548b
mov eax, dword [esi + 0x6c4]
mov word [ebp - 8], 0xbb01
lea ecx, [eax + 0x62]
add ecx, ecx
inc eax
mov dword [esi + 0x6c4], eax
movzx eax, word [ebp - 8]
jmp 0x10001600
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x28], eax
mov edi, ecx
call fcn.10001990
push 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0x775c3a63
push ecx
lea eax, [esi + 0x10]
mov dword [ebp - 0x15], 0x32336d65
push eax
lea eax, [esi + 4]
mov dword [ebp - 0xf], 0x652e646d
push eax
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x1a], 0x7379735c
mov dword [ebp - 0x1f], 0x776f646e
mov word [ebp - 0xb], 0x6578
mov word [ebp - 0x11], 0x635c
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 9], 0
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x1b], 0x73
mov dword [ebp - 0x34], 0xc
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
call eax
test eax, eax
jne 0x10001afc
mov dword [ebp - 0x28], 0x92
jmp 0x10001bd4
push 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0xc
push eax
lea eax, [esi + 8]
mov dword [ebp - 0x3c], 0
push eax
mov eax, dword [edi + 0x2c]
lea ebx, [esi + 0xc]
push ebx
mov dword [ebp - 0x38], 1
call eax
test eax, eax
jne 0x10001b34
mov dword [ebp - 0x28], 0x9b
jmp 0x10001bd4
lea eax, [ebp - 0x9c]
push 0x44
push eax
call fcn.100032d1
xor eax, eax
mov dword [ebp - 0x9c], 0x44
mov word [ebp - 0x6c], ax
mov eax, dword [ebx]
mov dword [ebp - 0x64], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x50]
push 0x10
push eax
mov dword [ebp - 0x70], 0x101
call fcn.100032d1
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x50]
add esp, 0x10
test ecx, ecx
push eax
lea eax, [ebp - 0x9c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x24]
cmovne eax, ecx
push 0
push eax
mov eax, dword [edi + 0x30]
call eax
test eax, eax
jne 0x10001bac
mov dword [ebp - 0x28], 0xb5
jmp 0x10001bd4
mov eax, dword [ebp - 0x4c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x50]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x48]
push 8
push edi
mov dword [esi + 0x24], eax
call fcn.10003362
add esp, 8
test eax, eax
jne 0x10001c07
mov dword [ebp - 0x28], 0xc3
push 2
lea eax, [ebp - 0x28]
mov edx, 6
push eax
movzx eax, byte [esi]
mov ecx, edi
push eax
call fcn.100024e0
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.10001990
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100055a9
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
mov dword [eax], edi
mov dword [eax + 4], esi
push 0x10001810
mov dword [esi + 0x14], 1
call fcn.100033c0
add esp, 4
push eax
mov eax, dword [edi + 0x20]
push 0
push 0
call eax
mov dword [esi + 0x18], eax
test eax, eax
jne 0x10001c3c
mov dword [eax], 1
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100055a9
mov esp, ebp
pop ebp
ret
Function at 0x10001d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov word [ebp - 0x13], 0x7365
push ebx
push 0x80
push 3
push ebx
push 1
mov esi, ecx
mov dword [ebp - 0x23], 0x73755c3a
push 0x80000000
lea eax, [ebp - 0x24]
mov dword [ebp - 8], 0x696e69
push eax
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x1f], 0x5c737265
mov word [ebp - 0x1b], 0x7570
mov dword [ebp - 0xc], 0x2e6e6f69
mov dword [ebp - 0x18], 0x5c63696c
mov dword [ebp - 0x11], 0x70697263
mov byte [ebp - 0x19], 0x62
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0xd], 0x74
call eax
mov dword [ebp - 0x28], eax
lea edi, [esi + 0xd4]
cmp eax, 0xffffffff
je 0x10001e12
push ebx
lea ecx, [ebp - 0x2c]
push ecx
push 0x10
push edi
push eax
mov eax, dword [esi + 0x38]
call eax
test eax, eax
je 0x10001e02
cmp dword [ebp - 0x2c], 0x10
mov eax, 1
cmove ebx, eax
push dword [ebp - 0x28]
mov eax, dword [esi + 0x1c]
call eax
test ebx, ebx
jne 0x10001ea3
mov eax, dword [esi + 0xb8]
push edi
call eax
test eax, eax
je 0x10001e63
xor edx, edx
nop dword [eax]
nop word [eax + eax]
imul ecx, dword [esi + 0x604], 0x343fd
add ecx, 0x269ec3
imul eax, ecx, 0x343fd
movsx ecx, cl
add eax, 0x269ec3
mov dword [esi + 0x604], eax
movsx eax, al
imul ecx, eax
mov byte [edx + edi], cl
inc edx
cmp edx, 0x10
jb 0x10001e30
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi + 0x44]
call eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi + 0x40]
call eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001ea3
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 0x3c]
push 0x10
push edi
push ebx
call eax
mov eax, dword [esi + 0x1c]
push ebx
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100055a9
mov esp, ebp
pop ebp
ret
Function at 0x10002290
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
push edi
xor edi, edi
mov dword [ebp - 0x220], ebx
mov edx, dword [ebx + 0x6e4]
xor esi, esi
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], ecx
nop dword [eax]
mov eax, dword [ebx + 0x94]
test ecx, ecx
je 0x100023b6
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x10c], edx
push ecx
push 0
push 0
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x110], 1
push ecx
push 0
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x230], 0
call eax
test eax, eax
js 0x100024c7
jne 0x10002328
inc edi
jmp 0x10002446
push 0
mov eax, 5
sub eax, esi
push eax
lea eax, [ebp - 0xc]
add eax, esi
push eax
push dword [ebp - 0x224]
mov eax, dword [ebx + 0x9c]
call eax
test eax, eax
jle 0x100024c7
add esi, eax
inc edi
cmp esi, 5
jne 0x10002446
cmp byte [ebp - 0xc], 0x17
jne 0x100024c7
cmp byte [ebp - 0xb], 3
jne 0x100024c7
cmp byte [ebp - 0xa], 3
jne 0x100024c7
movzx eax, byte [ebp - 9]
mov byte [ebp - 0x217], al
movzx eax, byte [ebp - 8]
mov byte [ebp - 0x218], al
movzx ebx, word [ebp - 0x218]
mov dword [ebp - 0x228], ebx
test ebx, ebx
je 0x100024c7
mov ebx, dword [ebp - 0x220]
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
xor esi, esi
jmp 0x1000244c
mov ebx, dword [ebp - 0x228]
mov ecx, ebx
sub ecx, esi
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x23c]
push ecx
push 0
push 0
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], 1
push ecx
push 0
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x238], 0
call eax
test eax, eax
js 0x100024c7
jne 0x1000240d
inc edi
jmp 0x10002440
mov ecx, dword [ebp - 0x220]
push 0
push dword [ebp - 0x22c]
lea eax, [ecx + 0x6ec]
add eax, esi
push eax
push dword [ebp - 0x224]
mov eax, dword [ecx + 0x9c]
call eax
test eax, eax
jle 0x100024c7
add esi, eax
cmp esi, ebx
je 0x1000245c
mov ebx, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x21c]
cmp edi, 0x5a
jge 0x100024c7
mov edx, dword [ebp - 0x224]
jmp 0x100022d0
mov esi, dword [ebp - 0x228]
xor ebx, ebx
test esi, esi
je 0x100024c7
mov edi, dword [ebp - 0x220]
nop
mov eax, dword [edi + 0x6c8]
lea edx, [edi + ebx]
movzx ecx, bl
inc ebx
mov al, byte [ecx + eax]
xor byte [edx + 0x6ec], al
cmp ebx, esi
jb 0x10002470
cmp esi, 2
jb 0x100024c7
lea eax, [esi - 2]
mov dword [edi + 0x618], eax
movsx eax, byte [edi + 0x6ec]
mov dword [edi + 0x610], eax
mov al, byte [edi + 0x6ed]
mov byte [edi + 0x614], al
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100055a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100055a9
mov esp, ebp
pop ebp
ret
Function at 0x100024e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
add eax, 7
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x58]
lea ebx, [esi + 0x6cc]
push ebx
call eax
cmp dword [esi + 0x6e8], 0
je 0x10002519
mov eax, dword [esi + 0x5c]
push ebx
call eax
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
push edi
lea edi, [edx + 2]
cmp edi, 0xffff
ja 0x1000254c
movzx ecx, di
mov eax, ecx
mov word [esi + 0x106eb], 0x317
shr eax, 8
mov byte [esi + 0x106ed], 3
mov byte [esi + 0x106ee], al
mov byte [esi + 0x106ef], cl
mov eax, dword [ebp - 4]
mov byte [esi + 0x106f0], al
mov al, byte [ebp + 8]
mov byte [esi + 0x106f1], al
test edx, edx
je 0x10002575
lea eax, [esi + 0x106f2]
push eax
push edx
push dword [ebp + 0xc]
call fcn.100032f8
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x1000259a
nop dword [eax + eax]
mov eax, dword [esi + 0x6c8]
lea edx, [esi + ebx]
movzx ecx, bl
inc ebx
mov al, byte [ecx + eax]
xor byte [edx + 0x106f0], al
cmp ebx, edi
jb 0x10002580
push dword [ebp - 8]
mov edx, dword [esi + 0x6e4]
lea eax, [esi + 0x106eb]
push eax
push ecx
mov ecx, esi
call fcn.10003400
mov ecx, dword [esi + 0x5c]
add esp, 0xc
test eax, eax
lea eax, [esi + 0x6cc]
pop edi
push eax
jne 0x100025d8
mov dword [esi + 0x6e8], 1
call ecx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call ecx
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002680
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword fs:[0x30]
push ebx
mov dword [ebp - 0x20], edx
xor ebx, ebx
push esi
mov eax, dword [eax + 0xc]
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 0x14]
mov dword [ebp - 4], eax
mov edx, dword [eax + 4]
mov dword [ebp - 0xc], edx
cmp eax, edx
je 0x1000271e
nop word [eax + eax]
cmp word [eax + 0x24], 0x30
ja 0x10002713
mov esi, dword [eax + 0x28]
xor edi, edi
movzx ecx, word [esi]
mov dword [ebp - 8], ecx
test cx, cx
je 0x10002700
mov eax, ecx
nop dword [eax]
lea ecx, [eax + 0x20]
lea ebx, [eax - 0x41]
movzx edx, cl
movzx ecx, al
lea esi, [esi + 2]
cmp bl, 0x19
cmova edx, ecx
movzx ecx, word [esi]
imul edi, edi, 0xc85e31
mov al, cl
movsx edx, dl
add edi, edx
test cx, cx
jne 0x100026d0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp edi, dword [ebp - 0x10]
je 0x100027c6
cmp dword [eax + 0x10], 0
je 0x100027b4
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp eax, edx
jne 0x100026b0
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
test ebx, ebx
je 0x100027bd
mov eax, dword [ebx + 0x3c]
xor edi, edi
mov ecx, dword [eax + ebx + 0x78]
mov edx, dword [eax + ebx + 0x50]
add ecx, ebx
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], edx
mov esi, dword [ecx + 0x20]
mov eax, dword [ecx + 0x14]
add esi, ebx
mov dword [ebp - 0x10], esi
mov esi, dword [ecx + 0x24]
add esi, ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x1c]
add esi, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], esi
xor esi, esi
test eax, eax
je 0x100027e0
nop dword [eax]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + esi*4]
add ecx, ebx
lea eax, [ecx + 0xdc]
cmp edx, eax
jbe 0x100027ac
mov al, byte [ecx]
xor edx, edx
test al, al
je 0x100027a4
nop word [eax + eax]
imul edx, edx, 0xc85e31
lea ecx, [ecx + 1]
movsx eax, al
add edx, eax
mov al, byte [ecx]
test al, al
jne 0x10002790
cmp edx, dword [ebp + 8]
je 0x100027ce
mov edx, dword [ebp - 0xc]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10002770
jmp 0x100027dd
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x10]
jmp 0x1000271e
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
movzx eax, word [eax + esi*2]
mov edi, dword [edi + eax*4]
add edi, ebx
mov ecx, dword [ebp - 4]
cmp edi, ecx
jb 0x100027ff
mov eax, dword [ebp - 0x1c]
add eax, ecx
cmp edi, eax
jae 0x100027ff
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
test edi, edi
je 0x100027bd
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x20]
push edi
mov ecx, dword [eax]
call fcn.100025f0
mov ecx, dword [ebp + 0x10]
add esp, 4
mov edx, eax
xor eax, eax
test edx, edx
pop edi
pop esi
mov dword [ecx], edx
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b7c1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000b85e
push ebx
push esi
call fcn.1000b78a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000b6d3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000b80b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b85d
push edi
push eax
call fcn.1000a188
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000b82b
call fcn.1000a1d6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b85c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000b6d3
add esp, 0x20
test eax, eax
jne 0x1000b84a
push edi
call fcn.1000a1d6
jmp 0x1000b852
push ebx
call fcn.1000a1d6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000bac9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100139c8
push 0x100139c0
push str.FlsAlloc
push 0x1e
call fcn.1000b9e7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000bafd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10012138]
call esi
jmp 0x1000bb03
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000bb47
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100139d8
push 0x100139d0
push str.FlsGetValue
push 0x20
call fcn.1000b9e7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000bb7e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10012138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100110b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100110dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100110dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403d93
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42d980]
cmp dword [ebp + 8], 0
je 0x403dbe
test eax, eax
je 0x403db2
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x42d980], 0
jmp 0x403e28
test eax, eax
je 0x403dd1
mov dword [esp], 0
call fcn.00409056
push edx
jmp 0x403e28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x419920]
jbe 0x403e28
mov eax, dword [0x437588]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403cd8
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
sub esp, 0x14
mov dword [0x42d980], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
leave
ret