joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100074e6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x100c1cc4], 0x523
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x10007511
mov eax, dword [ebp - 0x30]
add esp, 0x50
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x10008246]
mov dl, byte [eax + 0x10008217]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x10007511
lea eax, [ebp - 0x20]
mov dword [0x100c1cc4], 0xfffff6c0
mov dword [ebp - 0x34], eax
call fcn.10007af7
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10006fc3
xor ecx, ecx
mov dword [0x100c1cc8], 0x4a3
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], ecx
je 0x10007509
mov eax, dword [ebp - 0x38]
mov dword [0x100c1cc8], 0x40c
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x100c1cc4], 0x1b54
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.100068fb
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x100c1cc8], 0x1ff0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x2c], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0xc], ecx
mov dword [0x100c1cc4], 0x1e21
cmp ecx, 0
mov dword [ebp - 0x30], eax
je 0x10007509
mov eax, dword [ebp - 0x3c]
add eax, 0x2111
mov dword [ebp - 0x40], eax
mov dword [0x100c1cc8], 0xff3
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
jmp 0x10007509
Function at 0x1000768c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x100c1cd0], 0
mov byte [0x100c1cd4], 0
mov dword [0x100c1cc4], 0x1b66
mov dword [0x100c1ccc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x100076ec
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x100c1ccc], 0
mov dword [ebp - 0x20], eax
jmp 0x10007714
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x100c1ccc]
add eax, 1
mov dword [0x100c1ccc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100076ec
jmp 0x100076db
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x100c1cd8], 0
mov edx, dword [0x100c1cd0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x100c1cd8], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x100c1cd0], edx
mov dword [0x100c1cc8], 0x1fd7
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x100c1cd4], cl
mov dword [0x100c1cc4], 0xc36
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x100c1cd4]
mov edx, dword [0x100c1cd0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x100c1cc4]
add edx, 0xfffffb75
mov dword [0x100c1cc8], edx
mov edx, dword [0x100c1ccc]
add edx, 1
mov dword [0x100c1ccc], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10007714
jmp 0x100076d3
Function at 0x100078f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x100c1ccc], 0
mov dword [0x100c1cd0], 0
mov dword [0x100c1cdc], 0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x10007958
mov dword [0x100c1cc8], 0x587
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x100c1cc4], 0x3ec
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x100c1ccc], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x100c1cd0], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x100c1cd4], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x100c1cd4]
mov edx, dword [0x100c1cd0]
mov byte [edi + edx], cl
mov edx, dword [0x100c1ccc]
movzx edx, byte [edi + edx]
mov ebx, dword [0x100c1cd0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x100c1cdc], ebx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov dword [0x100c1cc4], 0x135b
mov dword [0x100c1cc8], 0x690
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x10007946
mov eax, dword [0x100c1cd0]
mov ecx, dword [0x100c1ccc]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x10007958
Function at 0x99a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0099a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x99a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99a06a
add dl, dl
jne 0x99a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99a0dc
xor eax, eax
add dl, dl
jne 0x99a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99a17d
add dl, dl
jne 0x99a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x99a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x99a075
mov eax, 1
add dl, dl
jne 0x99a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99a0e1
sub eax, ebx
mov ebx, 1
jne 0x99a128
mov ecx, 1
add dl, dl
jne 0x99a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x99a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x99a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x99a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99a136
cmp eax, 0x7d00
jae 0x99a16d
cmp eax, 0x500
jb 0x99a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99a075
cmp eax, 0x7f
ja 0x99a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x99a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x99a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10002d30
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10002d7c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10002d5f
cmp edi, 2
jb 0x10002d5f
cmp byte [esi], cl
jne 0x10002d5f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100453a8]
test edi, edi
jne 0x10002d45
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10002dab
cmp cl, 0x23
jne 0x10002d92
cmp byte [esi], cl
jne 0x10002d92
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100453a8]
test cl, cl
jne 0x10002d83
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10002f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10002f65
push 0x5f7
push str.C:UsersGirlDesktopArteUIimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10002f72
mov dword [edi], 0
mov edx, 0x10045088
mov ecx, esi
call fcn.10002dc0
mov esi, eax
test esi, esi
je 0x10003070
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10003066
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10003066
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10003066
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10003066
mov eax, dword [0x101c8f48]
test eax, eax
je 0x10002ff0
inc dword [eax + 0x398]
push dword [0x101c8f40]
push ebx
call fcn.10002620
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10003066
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000304b
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x101c8f48]
add esp, 4
test eax, eax
je 0x10003033
dec dword [eax + 0x398]
push dword [0x101c8f40]
push ebx
call fcn.10002640
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x1000305d
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004c50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xc0]
test ecx, ecx
jg 0x10004c7f
push 0x68d
push str.C:UsersGirlDesktopArteUIimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [esi + 0xc0]
add esp, 0xc
mov eax, dword [esi + 0xc8]
mov edi, 4
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100453a8]
sub edi, 1
jne 0x10004c93
mov ecx, dword [0x101c8f48]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1adc], eax
jne 0x10004cc5
mov dword [ecx + 0x1ae0], eax
cmp dword [ecx + 0x1b14], eax
jne 0x10004cd4
mov byte [ecx + 0x1b18], 1
pop ebp
ret 4
Function at 0x100052c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10040de3
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x101c8f48]
push ebx
push esi
push edi
test eax, eax
je 0x100052ed
inc dword [eax + 0x398]
push dword [0x101c8f40]
push 0x3d78
call fcn.10002620
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xd]
add esp, 8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x10005327
push 0
mov ecx, eax
call fcn.10001450
mov edi, eax
mov dword [ebp - 0x14], eax
jmp 0x1000532c
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x101c8f48]
test eax, eax
cmove eax, edi
cmp byte [edi], 0
mov dword [0x101c8f48], eax
jne 0x10005350
cmp byte [edi + 0x2ef9], 0
je 0x10005368
push 0xf9e
push str.C:UsersGirlDesktopArteUIimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], 0
mov esi, 0x100428d9
mov dword [ebp - 0x40], str.Window
mov al, 0x57
or edi, 0xffffffff
nop word [eax + eax]
cmp al, 0x23
jne 0x1000539e
cmp byte [esi], al
jne 0x1000539e
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100453a8]
test al, al
jne 0x10005390
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x40]
not edx
mov dword [ebp - 0x38], 0x10015490
push eax
mov dword [ebp - 0x3c], edx
lea ecx, [ebx + 0x2f0c]
mov dword [ebp - 0x30], 0x10015540
mov dword [ebp - 0x2c], 0x100155d0
mov dword [ebp - 0x28], 0x10015680
mov dword [ebp - 0x24], 0x10015740
call fcn.10015d10
or edx, 0xffffffff
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], 0
mov esi, 0x10049355
mov dword [ebp - 0x40], str.Table
mov al, 0x54
or edi, 0xffffffff
cmp al, 0x23
jne 0x10005421
cmp byte [esi], al
jne 0x10005421
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100453a8]
test al, al
jne 0x10005413
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], 0x10025f20
not edx
mov dword [ebp - 0x30], 0x10026040
push eax
lea ecx, [ebx + 0x2f0c]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c], 0x10026100
mov dword [ebp - 0x28], 0x10025fd0
mov dword [ebp - 0x24], 0x10026320
call fcn.10015d10
mov edi, dword [ebp - 0x14]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov byte [edi], 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100095f0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x1000962d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x10009613
cmp byte [esi], bl
jne 0x10009613
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x100453a8]
test bl, bl
jne 0x10009604
pop edi
pop esi
not ecx
pop ebx
jmp fcn.10009580

Function at 0x10014b50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x101c8f48]
push edi
cmp byte [esi + 0x2f3c], 0
je 0x10014bef
cmp dword [esi + 0x2f44], 0
lea edi, [esi + 0x2f48]
je 0x10014be1
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10014b99
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100167c0
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.100034a0
mov edx, dword [edi]
mov ecx, 0x101c8f44
push dword [esi + 0x2f44]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2f50]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.100034a0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001df70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1001dfac
mov eax, dword [0x101c8f48]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1001df96
dec dword [eax + 0x398]
push dword [0x101c8f40]
push ecx
call fcn.10002640
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1001dfe6
mov eax, dword [0x101c8f48]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1001dfd0
dec dword [eax + 0x398]
push dword [0x101c8f40]
push ecx
call fcn.10002640
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1001e020
mov eax, dword [0x101c8f48]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1001e00a
dec dword [eax + 0x398]
push dword [0x101c8f40]
push ecx
call fcn.10002640
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1001e076
mov eax, dword [0x101c8f48]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1001e060
dec dword [eax + 0x398]
push dword [0x101c8f40]
push ecx
call fcn.10002640
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1001e0b0
mov eax, dword [0x101c8f48]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1001e09a
dec dword [eax + 0x398]
push dword [0x101c8f40]
push ecx
call fcn.10002640
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1001e0ea
mov eax, dword [0x101c8f48]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1001e0d4
dec dword [eax + 0x398]
push dword [0x101c8f40]
push ecx
call fcn.10002640
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10020590
Function at 0x10039200
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
push ebx
push esi
push edi
push str.ntdll
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
push esi
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add esp, 8
mov dword [ebp - 8], 8
nop dword [eax]
call ebx
movzx edi, al
call ebx
movzx ebx, al
or ebx, edi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [ebp - 8]
movzx eax, al
or eax, ebx
mov ebx, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
shl eax, cl
add ecx, 8
or esi, eax
mov dword [ebp - 8], ecx
cmp ecx, 0x20
jl 0x10039240
cmp esi, 0x7fffffff
jbe 0x1003928c
lea eax, [esi - 0x80000000]
shr eax, 0xc
inc eax
sub esi, 0x1000
sub eax, 1
jne 0x10039281
push 0
push 0x40
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.RtlCreateUserThread
push str.ntdll
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp - 0xc]
mov ebx, eax
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
lea ecx, [ebp - 4]
push ecx
push edi
push esi
push 0
push 0
push 0
push 1
push 0
push eax
call ebx
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x10003
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x2dc]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x2dc], 0x10003
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1003936e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10039372
cmp edx, esi
jne 0x10039357
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10039392
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10039396
cmp edx, esi
jne 0x1003937b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x100393b6
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100393ba
cmp edx, esi
jne 0x1003939f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003df90
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1003e11b
mov eax, dword fs:[0x30]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x1003e00a
cmp ecx, esi
jne 0x1003e001
mov edx, dword [eax + 4]
test edx, edx
je 0x1003dfcf
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
test edx, edx
je 0x1003dfcf
mov ecx, dword [eax]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x14]
test edx, edx
je 0x1003dfdb
mov ecx, dword [eax + 0x10]
mov dword [edx], ecx
mov edx, dword [eax + 0x10]
test edx, edx
je 0x1003dfe8
mov ecx, dword [eax + 0x14]
mov dword [edx + 4], ecx
mov edx, dword [eax + 8]
test edx, edx
je 0x1003e001
mov ecx, dword [eax + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x1003e001
mov ecx, dword [eax + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x1003dfb4
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
test esi, esi
je 0x1003e066
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp + 0xc]
push eax
push 4
push 0x40
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1003e03b
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x1003e065
lea eax, [ebp + 0xc]
push eax
push 4
push 0xf8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1003e065
push 0xf8
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
pop edi
mov ecx, esi
call fcn.10039330
push 0xc8
push 0xc8
call dword [sym.imp.KERNEL32.dll_Beep]
pop esi
test eax, eax
je 0x1003e11b
push 0x1004ba54
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1003e124
lea edx, [ebp + 8]
mov ecx, 0x1003bab0
call fcn.10039200
lea edx, [ebp + 8]
mov ecx, 0x100384f0
call fcn.10039200
lea edx, [ebp + 8]
mov ecx, 0x100393d0
call fcn.10039200
lea edx, [ebp + 8]
mov ecx, 0x10039420
call fcn.10039200
lea edx, [ebp + 8]
mov ecx, 0x100389b0
call fcn.10039200
lea edx, [ebp + 8]
mov ecx, 0x10038b80
call fcn.10039200
lea edx, [ebp + 8]
mov ecx, 0x10038d50
call fcn.10039200
lea edx, [ebp + 8]
mov ecx, 0x10038f70
call fcn.10039200
lea edx, [ebp + 8]
mov ecx, 0x10038fc0
call fcn.10039200
lea edx, [ebp + 8]
mov ecx, 0x1003ddd0
call fcn.10039200
mov eax, 1
pop ebp
ret 0xc
push 0x50031
push 0
push str.Ltfen_dll_ismini_degistirmeyi_denemeyiniz__Ezgi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x1003e15a
push eax
push 0x1004252a
push 0x1004252a
push str.https:__discord.gg_yujaVUr3Cx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]