joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10110850
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011f8a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [ebp - 0x24]
push 0
call fcn.100dffc0
add esp, 4
mov dword [ebp - 4], 0
lea edi, [ebp - 0x24]
mov ecx, dword [ebx + 0x30]
mov eax, dword [ebp - 0x14]
add ecx, 0x30
cmp dword [ebp - 0x10], 0x10
mov esi, eax
mov dword [ebp + 8], eax
cmovae edi, dword [ebp - 0x24]
test eax, eax
jne 0x101108b9
mov esi, edi
cmp byte [edi], al
je 0x101108b6
nop word [eax + eax]
inc esi
cmp byte [esi], 0
jne 0x101108b0
sub esi, edi
inc esi
push esi
call fcn.1004a780
mov edx, eax
test edi, edi
je 0x101108de
test esi, esi
je 0x101108de
mov ecx, edx
sub edi, edx
nop dword [eax]
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub esi, 1
jne 0x101108d0
test edx, edx
je 0x1011093a
mov ecx, dword [ebx + 0x30]
push 0
push dword [ebp + 8]
add ecx, 0x30
push 0
push edx
push 1
call fcn.10048c90
mov esi, eax
test esi, esi
je 0x1011093a
mov ecx, dword [ebx + 0x30]
cmp dword [ecx + 0x18], 0
je 0x10110921
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x28], eax
mov eax, dword [ecx + 0x1c]
mov dword [eax + 0x2c], esi
mov dword [ecx + 0x1c], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x2c], 0
jmp 0x1011093c
mov dword [esi + 0x28], 0
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x1c], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x2c], 0
jmp 0x1011093c
xor esi, esi
mov edx, dword [ebp - 0x10]
cmp edx, 0x10
jb 0x1011096c
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10110962
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10110981
push edx
push ecx
call fcn.1006fca3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.1007d9e8
int3
Function at 0x10111e50
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1011f969
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
cmp esi, eax
je 0x10111e8d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x10111e84
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.1001a860
cmp dword [esi + 0x10], 0
je 0x10111ece
mov dword [ebp - 0x20], vtable.JJFe::GMFile.0
mov dword [ebp - 0x1c], 0xffffffff
push ecx
push 3
push 1
push 0xc0000000
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.10104630
test al, al
jne 0x10111ee2
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
je 0x10111ece
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x1c]
push ebx
cmp esi, 0xffffffff
je 0x10111f97
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10111f17
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10111f17
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10111f97
mov ecx, dword [ebp + 8]
xor eax, eax
add eax, ebx
mov dword [ebp - 0x10], eax
adc ecx, 0
mov dword [ebp - 0x18], ecx
lea ecx, [edi + 0x20]
lea esi, [eax + 1]
push esi
call fcn.1001bc00
push esi
push 0
push dword [edi + 0x28]
call fcn.10074090
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
push esi
push dword [edi + 0x28]
call fcn.10104500
test al, al
je 0x10111f8f
xor eax, eax
cmp dword [ebp - 0x14], esi
jne 0x10111f8f
cmp eax, dword [ebp - 0x18]
jne 0x10111f8f
mov eax, dword [edi]
mov ecx, edi
push dword [edi + 0x28]
mov eax, dword [eax + 8]
call eax
lea ecx, [ebp - 0x20]
mov bl, al
call fcn.10104720
mov al, bl
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x20]
call fcn.10104720
mov ecx, dword [ebp - 0xc]
xor al, al
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x1000eca7
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, str.system.ini
mov esi, 0xffff
push edi
push esi
push str.TemporalQuality
mov ebx, 0x10013890
push ebx
call dword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntA]
movzx eax, ax
mov ecx, 0x2710
mov word [0x10013c50], ax
cmp ax, si
je 0x1000ecec
imul eax, eax, 0x3ff
xor edx, edx
div ecx
mov word [0x10013c50], ax
push edi
push esi
push str.SpatialQuality
push ebx
call dword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntA]
movzx eax, ax
mov word [0x10013c4e], ax
cmp ax, si
je 0x1000ed1d
imul eax, eax, 0x3ff
xor edx, edx
mov ecx, 0x2710
div ecx
mov word [0x10013c4e], ax
push edi
push 1
push str.FractionInterCodeBook
push ebx
call dword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntA]
xor ecx, ecx
mov edx, 0xfffe
test eax, eax
mov ax, word [0x10013c4a]
push edi
setne cl
and ax, dx
push 0
push str.LogRequested
or cx, ax
push ebx
mov word [0x10013c4a], cx
call dword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntA]
mov cx, word [0x10013c4a]
neg eax
push edi
push 0x15
pop esi
sbb eax, eax
mov edx, 0xfffd
push esi
and eax, 2
and cx, dx
push 0x10003bc8
or cx, ax
push ebx
mov word [0x10013c4a], cx
call dword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntA]
movzx eax, ax
mov ecx, 0x7fff
cmp ax, cx
ja 0x1000eda3
test ax, ax
jne 0x1000eda0
xor eax, eax
inc eax
movzx esi, ax
push edi
push 0xa
mov word [0x10013c4c], si
pop esi
push esi
push 0x10003be0
push ebx
call dword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntA]
movzx eax, ax
mov ecx, 0x7fff
cmp ax, cx
ja 0x1000edd3
test ax, ax
jne 0x1000edd0
xor eax, eax
inc eax
movzx esi, ax
pop edi
mov word [0x10013c48], si
xor eax, eax
pop esi
inc eax
pop ebx
ret
Function at 0x1000ee9c
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10013084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, 0x104
mov dword [ebp - 0x110], ecx
push edi
lea eax, [ebp - 0x108]
mov ebx, edx
push 0
push eax
mov dword [ebp - 0x11c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [ebx], 0
lea eax, [ebp - 0x108]
push edi
push eax
push dword [0x10013c54]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_core_versionansi_l1_1_1.dll_GetFileVersionInfoSizeA]
mov ebx, eax
test ebx, ebx
je 0x1000f046
push esi
push ebx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1000f045
push esi
push ebx
push dword [ebp - 0x118]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_core_versionansi_l1_1_1.dll_GetFileVersionInfoA]
test eax, eax
je 0x1000f03e
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x10003c00
push esi
call dword [sym.imp.api_ms_win_core_versionansi_l1_1_0.dll_VerQueryValueA]
mov ebx, dword [ebp - 0x110]
test eax, eax
je 0x1000efb9
cmp dword [ebp - 0x10c], 4
jb 0x1000efb9
mov ecx, dword [ebp - 0x114]
push ebx
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x10003c1c
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.1000ebc1
add esp, 0x18
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.api_ms_win_core_versionansi_l1_1_0.dll_VerQueryValueA]
test eax, eax
je 0x1000efb9
cmp dword [ebp - 0x10c], 0
jne 0x1000f02a
push ecx
push 0x10003c38
push ecx
mov edx, edi
lea ecx, [ebp - 0x108]
call fcn.1000ec60
lea eax, [ebp - 0x110]
mov edx, edi
push eax
lea ecx, [ebp - 0x108]
call fcn.1000ec24
test eax, eax
js 0x1000f001
sub edi, dword [ebp - 0x110]
push ecx
push ebx
push ecx
lea ecx, [ebp - 0x108]
mov edx, edi
add ecx, dword [ebp - 0x110]
call fcn.1000ec60
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.api_ms_win_core_versionansi_l1_1_0.dll_VerQueryValueA]
test eax, eax
je 0x1000f03e
cmp dword [ebp - 0x10c], 0
je 0x1000f03e
push dword [ebp - 0x114]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x11c]
call fcn.1000eb8e
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100129d0
mov esp, ebp
pop ebp
ret 4
Function at 0x100129f0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10012a2e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10012a26
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10012a30
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10012a16
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10012b00
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10012b16
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10012b31
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x10017519
Capabilities:
Encode data using xor

Disassembly:
call 0x10017492
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x100174c2
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x100174de
xor edx, 0
jmp 0x100174e9
xor edx, edx
jmp 0x10017500
jmp 0x1001750c
xor eax, eax
push 0x8427d7c0
call 0x10017519
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x10017555
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1001752e
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1001756c
add eax, 0
jno 0x10017571
add esi, 0
ret 0x10
Function at 0x100182da
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x100182fc
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1001849e
cmp edi, dword [ebp + 0x10]
jb 0x1001849e
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10017dc6
inc edi
jmp 0x10018385
jmp 0x10018392
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10017dc6
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10017dc6
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x100183e6
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x100183ca
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.10018414
add dword [eax], 0x39
jle 0x100183f0
sub al, 0xf5
mov ch, al
call fcn.10018429
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x1001a101
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x1001a117
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x1001a128
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.1001a169
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx
Function at 0x1001c4d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x1001c41e
add ebx, 0
push ecx
call 0x1001c433
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x6c0a9121
sub ebx, dword [0x6c0c8960]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x6c0c8950
call fcn.10017efd
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.1001740b
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x1001c591
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x1001c591
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x1001c548
mov eax, 1
lock xchg dword [0x6c0c895c], eax
push 0x3dd1fc71
call 0x1001c4d5
push esi
add esp, 8
cmp eax, 0
jne 0x1001c4be
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x1001c4e4
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x1001c4f9
cmp ecx, edx
cmp eax, 0
je 0x1001c51e
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x1001c508
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.1001c537
dec eax
loope 0x1001c53a
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x6c0c895c], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x1001c56e
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x1001c583
jmp 0x1001c58e
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x1001c47c
Function at 0x100235f6
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x100238cc
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x6c0b55d4
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x6c0ac59a
push 0xffffffffffffffff
call fcn.1001a7f6
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x10023660
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.10023678
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x100238c0
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x10023894
Function at 0x100330c6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x100330e8
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x100330e8
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x100330e8
ret
cmp word [ebx + 4], 0x14c
jne 0x100330e8
test word [ebx + 0x16], 2
je 0x100330e8
test word [ebx + 0x16], 0x100
je 0x100330e8
cmp word [ebx + 0x18], 0x10b
jne 0x100330e8
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x100330e8
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10033174
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10033108
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1001a053
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x100330e8
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x10033174
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x100330e8
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x100330e8
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x100330e8
ret
cmp word [ebx + 4], 0x14c
jne 0x100330e8
test word [ebx + 0x16], 2
je 0x100330e8
test word [ebx + 0x16], 0x100
je 0x100330e8
cmp word [ebx + 0x18], 0x10b
jne 0x100330e8
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x100330e8
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10033174
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10033108
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1001a053
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x100330e8
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x1003322b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10033284
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1003322b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1003323a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10438edd
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1003328b
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001a101
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1003332a
add edi, 4
add eax, 2
dec ecx
jne 0x10033270
call 0x100332d7
loope 0x100332cd
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10033327
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10033338
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100332eb
cmp eax, ecx
ja 0x100332eb
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10033375
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1003336b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1001a5e0
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]