joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489920
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push edi
mov edi, dword [eax + 0x14]
test edi, edi
je 0x489980
mov edx, dword [eax + 0x10]
mov ecx, dword [eax]
push ebp
push esi
mov esi, dword [eax + 0x1c]
mov ebp, dword [ecx + edx*4]
cmp esi, edi
jae 0x489978
push ebx
mov ebx, dword [eax + 0x18]
mov ecx, 0x18
mov edx, ebp
sub ecx, esi
add esi, 8
shr edx, cl
mov ecx, ebx
shr ecx, 8
movzx edx, dl
xor edx, ecx
movzx ebx, bl
shl ebx, 8
xor ebx, dword [edx*4 + 0x508fb0]
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], esi
cmp esi, edi
jb 0x489941
mov ax, bx
pop ebx
pop esi
pop ebp
pop edi
ret
mov ax, word [eax + 0x18]
pop esi
pop ebp
pop edi
ret
mov ax, word [eax + 0x18]
pop edi
ret

Function at 0x48a740
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
je 0x48a770
push edi
mov edi, dword [esp + 0xc]
movzx ecx, byte [edi]
lea edi, [edi + 1]
mov edx, eax
shl eax, 8
shr edx, 8
xor edx, ecx
xor eax, dword [edx*4 + 0x508fb0]
movzx eax, ax
sub esi, 1
jne 0x48a750
pop edi
pop esi
ret

Function at 0x48a780
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor al, al
test edx, edx
je 0x48a7a7
push esi
mov esi, dword [esp + 8]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx eax, al
xor ecx, eax
mov al, byte [ecx + 0x508eb0]
sub edx, 1
jne 0x48a790
pop esi
ret
Function at 0x494160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x54
push ebx
push ebp
push esi
mov esi, dword [esp + 0x64]
xor ebx, ebx
test eax, eax
push edi
sete bl
cmp dword [esi + 0x180], 0
je 0x49436f
xor ecx, ecx
xorps xmm0, xmm0
add eax, dword [esi + 0x188]
movups xmmword [esp + 0x20], xmm0
adc ecx, dword [esi + 0x18c]
cmp dword [esi + 0x184], 0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
je 0x494229
cmp dword [esp + 0x70], 0x26
jne 0x4943b8
movzx eax, byte [0x509f34]
mov byte [esp + 0x30], al
mov eax, dword [str.FLAC]
push 0x26
push dword [esp + 0x70]
mov eax, dword [eax]
mov dword [esp + 0x39], eax
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esp + 0x3f], al
movzx eax, byte [esi + 4]
mov byte [esp + 0x40], al
mov eax, dword [str.fLaCCaLf]
mov dword [esp + 0x41], eax
lea eax, [esp + 0x45]
push eax
mov word [esp + 0x41], 1
call fcn.004bf500
lea eax, [esp + 0x3c]
mov dword [esp + 0x20], 0x33
add esp, 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 1
mov dword [esi + 0x184], 0
jmp 0x494239
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
cmp dword [esp + 0x7c], 0
lea edi, [esi + 8]
mov ebp, 1
push ecx
cmovne eax, ebp
push edi
mov dword [esp + 0x24], eax
call fcn.004b8c10
add esp, 8
test eax, eax
je 0x49426d
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x54
ret
test ebx, ebx
lea ebx, [esi + 0x170]
push ebx
push edi
je 0x4942f6
call fcn.004b86b0
add esp, 8
test eax, eax
je 0x49439d
mov ebp, dword [esp + 0x88]
push ebp
push dword [esp + 0x7c]
push 0
push dword [esi + 0x174]
push dword [ebx]
push dword [esp + 0x98]
call dword [esp + 0x98]
add esp, 0x18
test eax, eax
jne 0x4943b8
push ebp
push dword [esp + 0x7c]
push eax
push dword [esi + 0x17c]
push dword [esi + 0x178]
push dword [esp + 0x98]
call dword [esp + 0x98]
add esp, 0x18
test eax, eax
jne 0x4943b8
push ebx
push edi
call fcn.004b86b0
add esp, 8
test eax, eax
jne 0x494290
jmp 0x49439d
call fcn.004b8f90
add esp, 8
test eax, eax
je 0x49439d
mov ebp, dword [esp + 0x88]
nop dword [eax]
push ebp
push dword [esp + 0x7c]
push 0
push dword [esi + 0x174]
push dword [ebx]
push dword [esp + 0x98]
call dword [esp + 0x98]
add esp, 0x18
test eax, eax
jne 0x4943b8
push ebp
push dword [esp + 0x7c]
push eax
push dword [esi + 0x17c]
push dword [esi + 0x178]
push dword [esp + 0x98]
call dword [esp + 0x98]
add esp, 0x18
test eax, eax
jne 0x4943b8
push ebx
push edi
call fcn.004b8f90
add esp, 8
test eax, eax
jne 0x494310
jmp 0x49439d
test ebx, ebx
je 0x4943b8
cmp dword [esp + 0x78], 0
jne 0x4943b8
test eax, eax
jne 0x4943b8
cmp dword [esp + 0x70], 4
jne 0x4943b8
mov eax, dword [esp + 0x6c]
mov eax, dword [eax]
cmp eax, dword [str.fLaCCaLf]
jne 0x4943b8
mov dword [esi + 0x180], 1
mov eax, dword [esp + 0x74]
add dword [esi + 0x188], eax
pop edi
adc dword [esi + 0x18c], 0
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x54
ret
Function at 0x4b84b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4b8550
mov ecx, dword [esi]
xor eax, eax
push ebx
push edi
xor edi, edi
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ecx, dword [esi]
mov byte [ecx + 0x18], al
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
mov ebx, dword [esi + 4]
test ebx, ebx
jle 0x4b8500
mov esi, dword [esi]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x58fe50]
cmp edi, ebx
jl 0x4b84e3
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x4b852d
mov esi, dword [esi + 8]
nop dword [eax]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x58fe50]
cmp edi, ebx
jl 0x4b8510
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, eax
shr edx, 8
pop edi
pop ebx
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], dl
mov edx, eax
mov ecx, dword [esi]
shr edx, 0x10
shr eax, 0x18
mov byte [ecx + 0x18], dl
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d650d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d6383
Function at 0x405745
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405a03
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405784
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7a2fe8], eax
jmp 0x40590e
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x40579e
test eax, eax
je 0x4058bc
test bl, 2
je 0x4058bc
mov esi, 0x7a0548
push edi
push esi
call fcn.00405f7d
cmp dword [ebp + 8], 0
je 0x4057bd
push 0x40a3ac
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4057c3
push edi
call fcn.0040595c
cmp byte [edi], 0
jne 0x4057d1
cmp byte [0x7a0548], 0x5c
jne 0x4057dc
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4058b2
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405940
cmp byte [eax], 0
je 0x405822
cmp byte [ebp - 0x1c], 0
je 0x405822
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405838
mov al, byte [esi + 1]
test al, al
je 0x405891
cmp al, 0x2e
jne 0x405838
cmp byte [esi + 2], 0
je 0x405891
push esi
push ebx
call fcn.00405f7d
test byte [ebp - 0x14c], 0x10
je 0x40585d
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405891
push dword [ebp + 0xc]
push edi
call fcn.00405745
jmp 0x405891
push dword [ebp - 4]
push edi
call fcn.004056fd
test eax, eax
jne 0x405889
cmp dword [ebp - 4], eax
je 0x405881
push edi
push 0xfffffffffffffff1
call fcn.004050a4
push 0
push edi
call fcn.00405d5c
jmp 0x405891
inc dword [0x7a2fe8]
jmp 0x405891
push edi
push 0xfffffffffffffff2
call fcn.004050a4
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405800
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4058bc
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40590e
cmp dword [ebp - 0xc], esi
jne 0x4058d0
inc dword [0x7a2fe8]
jmp 0x40590e
push edi
call fcn.00406280
test eax, eax
je 0x40590e
push edi
call fcn.00405915
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004056fd
test eax, eax
jne 0x405906
cmp dword [ebp - 4], esi
je 0x4058c8
push edi
push 0xfffffffffffffff1
call fcn.004050a4
push esi
push edi
call fcn.00405d5c
jmp 0x40590e
push edi
push 0xffffffffffffffe5
call fcn.004050a4
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40e0b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e0dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e0dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x100041e0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x10035627
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.101793f0
mov eax, dword [0x102514b8]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
je 0x1003578a
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 4]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 5]
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 8
mov byte [edi], dl
mov byte [ebp], al
call fcn.10016100
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.10016180
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.10014800
push ebp
call fcn.10016100
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.10016180
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.10014800
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ebx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, dword [esp + 0x44]
shr ebx, 0x18
mov byte [eax + 3], bl
mov ebx, edx
add esp, 0x30
mov byte [eax + 4], dl
shr ebx, 8
mov byte [eax + 5], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax + 6], bl
mov byte [eax + 7], dl
mov eax, ebp
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 0x18
dec dword [esp + 0x18]
mov byte [eax + 6], dl
mov byte [eax + 7], cl
jne 0x10035643
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.1016198b
add esp, 0xa0
ret
Function at 0x10056230
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x10056249
mov esi, edi
mov edi, eax
jmp 0x1005624b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x1005625b
mov eax, ebx
jmp 0x10056265
push eax
push ebx
call fcn.10007580
add esp, 8
test eax, eax
jne 0x1005626d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x10056289
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x10056274
cmp eax, dword [esi + 4]
jge 0x100562a0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x10056290
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x100562c1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x100562be
dec eax
test eax, eax
jg 0x100562b0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x1008391b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x1008392b
mov edx, dword [eax]
jmp 0x1008392d
mov edx, eax
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
lea ecx, [edx + ecx*2]
jb 0x1008393b
mov eax, dword [eax]
push ebx
push esi
mov esi, ecx
xor edx, edx
sub esi, eax
push edi
xor edi, edi
inc esi
shr esi, 1
mov ebx, edi
cmp eax, ecx
cmova esi, edx
test esi, esi
je 0x10083975
mov edx, edi
mov ecx, edi
shr ecx, 2
shl edx, 6
add edx, ecx
movzx ecx, word [eax]
add ecx, 0x9e3779b9
lea eax, [eax + 2]
add ecx, edx
xor edi, ecx
inc ebx
cmp ebx, esi
jne 0x10083954
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100a1e12
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10192f22
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x102514b8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.100a1eab
and dword [esp + 0x30], 0
mov edi, 0x1025c98c
push eax
mov ecx, edi
call fcn.100afd7e
or dword [esp + 0x30], 0xffffffff
xor esi, esi
push 0
inc esi
lea ecx, [esp + 0x10]
push esi
call fcn.1007ade9
lea eax, [esp + 0xc]
push eax
call fcn.100a1eab
mov dword [esp + 0x30], esi
mov ecx, edi
push 0x3e8
push eax
call fcn.100afddb
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
push 0
push esi
call fcn.1007ade9
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100a1f59
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10192f22
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x102514b8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.100a1eab
and dword [esp + 0x30], 0
mov ebx, 0x1025c98c
push eax
mov ecx, ebx
call fcn.100afd31
test eax, eax
je 0x100a1fab
push eax
call dword [0x101a12f8]
or dword [esp + 0x30], 0xffffffff
xor esi, esi
push 0
inc esi
lea ecx, [esp + 0x10]
push esi
call fcn.1007ade9
lea eax, [esp + 0xc]
push eax
call fcn.100a1eab
mov dword [esp + 0x30], esi
mov ecx, ebx
push eax
call fcn.100afe1e
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
push 0
push esi
call fcn.1007ade9
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b09c6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10195b3f
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x102514b8]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x102514b8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
push 0x10228cfc
mov edi, 0x3e8
call fcn.1007a7bf
and dword [esp + 0x38], 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.100bc510
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push 0
push 1
call fcn.1007ade9
mov ecx, dword [esi]
call fcn.1009993d
mov ecx, dword [esp + 0xc]
cmp ecx, eax
je 0x100b0a59
mov ecx, dword [ecx]
mov eax, dword [ecx]
cmp byte [eax], 2
jne 0x100b0a59
call fcn.1009d730
mov edi, eax
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1016198b
mov esp, ebp
pop ebp
ret 4
Function at 0x100db785
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1019aa1b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x102514b8]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x102514b8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea edx, [esi + 0xc]
lea ecx, [esp + 0x10]
call fcn.100cbb1d
and dword [esp + 0x38], 0
mov ecx, edi
push eax
call fcn.10091e94
or dword [esp + 0x38], 0xffffffff
xor ebx, ebx
push 0
inc ebx
lea ecx, [esp + 0x14]
push ebx
call fcn.1007ade9
lea edx, [esi + 0x10]
lea ecx, [esp + 0x10]
call fcn.100d625b
mov dword [esp + 0x38], ebx
mov ecx, edi
push eax
call fcn.10091e94
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push 0
push ebx
call fcn.1007ade9
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1016198b
mov esp, ebp
pop ebp
ret 4

Function at 0x100e2aa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x100e2acd
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x1021f820]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x100e2ab0
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x100e2b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov ecx, 0x80
mov dword [ebp - 4], ebx
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebx]
jne 0x100e2b81
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1025c830]
test eax, eax
je 0x100e2b8c
call eax
lea eax, [esi*8]
push eax
call fcn.100df2a0
mov ecx, dword [0x1025c834]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
test ecx, ecx
je 0x100e2bad
call ecx
test esi, esi
je 0x100e2b78
push dword [ebx + 0xc]
call fcn.100df5a0
add esp, 4
mov dword [ebx + 0xc], esi
push esi
call dword [0x1025453c]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebx], eax
lea ecx, [eax*8]
push ecx
push 0
push esi
call fcn.10166d90
mov ecx, dword [ebx + 8]
add esp, 0xc
mov dword [ebx + 8], 0
test ecx, ecx
je 0x100e2c90
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x100e2c1f
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x1021f820]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x100e2c02
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x100e2c6a
mov eax, dword [esi]
test eax, eax
je 0x100e2c3d
mov edx, dword [esi + 4]
jmp 0x100e2c3f
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x100e2c6a
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x100e2c5f
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x100e2c86
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x100e2c86
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x100e2c7c
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x100e2bf6
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e2db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x100e2e04
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x100e2df4
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x1021f820]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x100e2dd4
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x100e2e06
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.100e2ca0
add esp, 8
test eax, eax
je 0x100e2e20
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100e2e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
cmp dword [esi], 0
je 0x100e2e85
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x100e2e75
mov esi, edx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x1021f820]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x100e2e55
mov esi, dword [ebp - 0xc]
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [ebp - 8]
mov ebx, edx
mov dword [ebp - 4], edx
jmp 0x100e2e8a
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.100e2ca0
add esp, 8
test eax, eax
je 0x100e2ed2
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x100e2ec2
push ebx
mov edx, eax
mov ecx, esi
call fcn.100e2d50
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x100e2f70
push 0x14
call fcn.100df2a0
mov edi, eax
add esp, 4
test edi, edi
jne 0x100e2ef6
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x100e2f36
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x100e2f36
add edx, edx
mov ecx, esi
call fcn.100e2b50
test eax, eax
je 0x100e2f36
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.100e2aa0
xor edx, edx
div dword [esi]
jmp 0x100e2f39
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x100e2f57
push edi
lea edx, [eax + edx*8]
mov ecx, esi
call fcn.100e2ae0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x100e2f66
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret