joyce8/EMBER2024-capa huggingface dataset:
Function at 0x32039f52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x32039f61
pop dword [ebp - 0x40]
mov eax, 0xc9cf44be
add eax, 0x68345aa3
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x98ba0781
add dword [ebp - 0x50], 0xb5983dca
mov dword [ebp - 0x4c], 0xd8b8d369
sub dword [ebp - 0x4c], 0xa6858724
mov dword [ebp - 0x48], 0x2b2c9bc5
sub dword [ebp - 0x48], 0xdee05797
mov dword [ebp - 0x44], 0x4af13ea5
sub dword [ebp - 0x44], 0x4af13ea5
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc1d85927
add dword [ebp - 0x50], 0xb29a102f
mov dword [ebp - 0x4c], 0x22f1cd82
add dword [ebp - 0x4c], 0x1e7a93f3
mov dword [ebp - 0x48], 0xee76473f
add dword [ebp - 0x48], 0x74f9252d
mov dword [ebp - 0x44], 0x3d211347
add dword [ebp - 0x44], 0xc2deecb9
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x42d9f
push 0
call eax
mov ecx, 0xc6335141
add ecx, 0x39cce4b6
mov esi, eax
mov edi, 0x3207a200
add edi, dword [ebp - 0x40]
mov edx, 0x59d9dee4
add edx, 0xca9a770f
mov dword [ebp - 0x38], 0x6830173e
mov ebx, dword [edi]
mov dword [ebp - 0x18], 0x60542863
xor ebx, edx
mov dword [ebp - 0x1c], 0x591e4aea
mov dword [esi], ebx
add esi, 0x7122e274
add esi, 0x8edd1d90
add edi, 0x614248d8
sub edi, 0x614248d4
loop 0x3203a073
add eax, 0xac97bbd5
sub eax, 0xac96f126
xor ebx, ebx
add ebx, eax
add eax, 0x1e1c6f4e
add eax, 0xe1e390b7
mov ecx, 0x32000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4050f5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x443d70
push dword [ebp + 0x14]
push dword [ebp + 0x10]
hlt

Function at 0x40510d
Capabilities:
Read file on windows

Disassembly:
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042e8c4
add esp, 0x10
leave
ret 0x10

Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx

Function at 0x40bec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x18], ecx
or ebx, 0xffffffff
mov dword [esp + 0x20], ecx
mov eax, dword [edi + 4]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
movsx eax, word [eax + 8]
sub eax, ecx
je 0x40bf27
sub eax, 1
je 0x450474
sub eax, 0x32
jne 0x4503eb
push edi
mov ecx, esi
call fcn.0040dfd0
push dword [ebp + 0xc]
mov ecx, esi
push edi
and al, 0xf
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push edi
push ecx
mov ecx, esi
call fcn.0040bf58
jmp 0x45049f

Function at 0x40bf40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
Function at 0x40ec40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword fs:[0x2c]
mov dword [esp + 0x18], ecx
push ebx
push esi
Function at 0x41b731
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x124], ecx
mov ecx, dword [ecx]
push esi
mov esi, dword [eax]

Function at 0x41fe36
Capabilities:
Enumerate pe sections

Disassembly:
sub ecx, eax
mov eax, dword [ebp + 8]
ror eax, cl
xor eax, dword [0x4cc014]
ror byte [eax + eax + 0x5d], 0xc3
Function at 0x469696
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fe23
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00420e38
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x4696f1
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x4696e8
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x471f74
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4d06e0], 1
jne 0x471f82
call fcn.0047205e
mov eax, dword [0x4d2ff4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d2ff4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x471fba
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
sub dword [0x4d06e0], 1
jne 0x471fcd
call fcn.0047205e
mov eax, dword [0x4d2ff4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d2ff4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x472010
fadd qword [0x4c81c0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4c8190]
leave
ret

Function at 0x47201e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4d2630], ecx
inc esi
mov edx, esi
mov eax, dword [edx*4 + 0x4d262c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x4d2630], eax
inc edx
cmp edx, 0x270
jl 0x47202a
mov dword [0x4d06e0], esi
mov dword [0x4d2ff0], esi
pop esi
ret
Function at 0x47205e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x472081
push 0
call fcn.0042e500
pop ecx
mov ecx, eax
call fcn.0047201e
mov dword [0x4d06e0], 0x270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0x634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x472096
mov eax, dword [esi]
mov dword [ebp - 4], 0x7500018c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x4720d0
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret

Function at 0x472916
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
lea ecx, [ebp - 0xdc]
call fcn.00472766
push dword [ebp + 8]
lea ecx, [ebp - 0xdc]
call fcn.004727aa
xor esi, esi
test ebx, ebx
je 0x47295a
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.004728ea
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jb 0x472945
pop edi
pop esi
pop ebx
leave
ret
Function at 0x70032f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x7003303
pop dword [ebp - 4]
mov eax, 0x7003303
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x40c27a56
add dword [ebp - 0x14], 0xd8fcaf5
mov dword [ebp - 0x10], 0xc94a3762
add dword [ebp - 0x10], 0x68e914e3
mov dword [ebp - 0xc], 0x953218cc
add dword [ebp - 0xc], 0xb71a2b62
mov dword [ebp - 8], 0x59f21b
sub dword [ebp - 8], 0x59f21b
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x25d6778a
sub dword [ebp - 0x14], 0xb1640e34
mov dword [ebp - 0x10], 0xe2873d91
add dword [ebp - 0x10], 0x5ee523e4
mov dword [ebp - 0xc], 0x16bcf532
sub dword [ebp - 0xc], 0xb34d88c6
mov dword [ebp - 8], 0xd19938c9
sub dword [ebp - 8], 0xd19938c9
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac9e
push 0
call eax
mov ecx, 0x352fc95
sub ecx, 0x352b3f7
xor edx, edx
add edx, eax
mov esi, 0xc17fb5d3
add esi, 0x45822a2d
add esi, dword [ebp - 4]
mov ebx, 0xbb68cc08
sub ebx, 0x7070451
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
add edx, 4
add esi, 0x8ba6f6e9
add esi, 0x7459091b
loop 0x7003418
add eax, 0xc31257b3
sub eax, 0xc3114268
mov ebx, eax
add eax, 0x29241ff7
sub eax, 0x29241ff2
mov ecx, 0x7000000
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x700cd52
Capabilities:
Set current directory

Disassembly:
push 4
mov eax, 0x7010fd1
call fcn.07001bfd
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cf67
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d518
lea ecx, [ebp + 8]
call fcn.0700ccf6
mov eax, dword [edi + 0x14]
mov esi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call esi
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700cdc1
mov eax, dword [eax + 0x14]
jmp 0x700cdc6
mov eax, 0x701221a
push 0x7013b90
push eax
call dword [sym.imp.MSVCR120.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
jne 0x700cde6
push str.file_does_not_exist
push ebx
call fcn.070032f4
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 8]
mov dword [edi + 8], eax
mov byte [ebp - 4], 1
call esi
push dword [ebp + 8]
mov ecx, 0x701a094
call fcn.070032f4
mov eax, edi
call fcn.07001d82
ret 4
Function at 0x700d620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x700d684
cmp byte [esi + 0x10], 0
je 0x700d640
push dword [esi + 0xc]
call dword [sym.imp.MSVCR120.dll_fflush]
pop ecx
mov byte [esi + 0x10], 0
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.MSVCR120.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d672
push dword [esi + 0xc]
call dword [sym.imp.MSVCR120.dll_feof]
pop ecx
test eax, eax
je 0x700d68b
push dword [esi + 0xc]
call dword [sym.imp.MSVCR120.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d686
xor eax, eax
pop esi
pop ebp
ret 8
push str.stream_read_error
push 0
call fcn.070032f4
int3

Function at 0x700d8f2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
jne 0x700d945
cmp dword [esi + 0xc], 0
je 0x700d940
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.MSVCR120.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d933
push str.stream_write_error
jmp 0x700d94a
push dword [esi + 0xc]
call dword [sym.imp.MSVCR120.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8
push str.Attempt_to_write_read_only_stream
push 0
call fcn.070032f4
int3
Function at 0x13001c60
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1303db3b
mov eax, dword fs:[0]
push eax
sub esp, 0xa8c
mov eax, dword [0x1304c080]
xor eax, ebp
mov dword [ebp - 0x9c], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa50], ecx
mov dword [ebp - 0x9b0], 0
jmp fcn.130b7f81

Function at 0x13006ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1303ed58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1304c080]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.130260ec
mov dword [esp + 0x28], 0
mov edi, dword [0x1304d518]
mov ecx, 0x1304e0ec
mov dword [esp + 0xc], edi
call fcn.13002a50
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x13006f6b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x13006f6f
cmp byte [eax + 0x14], 0
je 0x13006f6f
call fcn.1302617a
cmp esi, dword [eax + 0xc]
jae 0x13006f75
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x13006f71
xor ecx, ecx
jmp 0x13006f53
mov esi, ecx
test esi, esi
jne 0x13006fc6
test edi, edi
je 0x13006f7d
mov esi, edi
jmp 0x13006fc6
lea eax, [esp + 0xc]
push eax
call fcn.13005e20
add esp, 4
cmp eax, 0xffffffff
jne 0x13006fac
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.13027466
push 0x13046d64
lea ecx, [esp + 0x18]
push ecx
call fcn.13027b84
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1304d518], esi
call fcn.13002ad0
push esi
call fcn.13026248
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.1302610d
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x130075b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1303ed58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1304c080]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.130260ec
mov dword [esp + 0x28], 0
mov edi, dword [0x1304d51c]
mov ecx, 0x1304d528
mov dword [esp + 0xc], edi
call fcn.13002a50
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1300762b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1300762f
cmp byte [eax + 0x14], 0
je 0x1300762f
call fcn.1302617a
cmp esi, dword [eax + 0xc]
jae 0x13007635
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x13007631
xor ecx, ecx
jmp 0x13007613
mov esi, ecx
test esi, esi
jne 0x13007686
test edi, edi
je 0x1300763d
mov esi, edi
jmp 0x13007686
lea eax, [esp + 0xc]
push eax
call fcn.13007120
add esp, 4
cmp eax, 0xffffffff
jne 0x1300766c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.13027466
push 0x13046d64
lea ecx, [esp + 0x18]
push ecx
call fcn.13027b84
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1304d51c], esi
call fcn.13002ad0
push esi
call fcn.13026248
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.1302610d
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x130076b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1303ed58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1304c080]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.130260ec
mov dword [esp + 0x28], 0
mov edi, dword [0x1304d520]
mov ecx, 0x1304d524
mov dword [esp + 0xc], edi
call fcn.13002a50
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1300772b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1300772f
cmp byte [eax + 0x14], 0
je 0x1300772f
call fcn.1302617a
cmp esi, dword [eax + 0xc]
jae 0x13007735
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x13007731
xor ecx, ecx
jmp 0x13007713
mov esi, ecx
test esi, esi
jne 0x13007786
test edi, edi
je 0x1300773d
mov esi, edi
jmp 0x13007786
lea eax, [esp + 0xc]
push eax
call fcn.130071a0
add esp, 4
cmp eax, 0xffffffff
jne 0x1300776c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.13027466
push 0x13046d64
lea ecx, [esp + 0x18]
push ecx
call fcn.13027b84
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1304d520], esi
call fcn.13002ad0
push esi
call fcn.13026248
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.1302610d
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x1300b200
Capabilities:
Execute anti-debugging instructions
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1303e541
mov eax, dword fs:[0]
push eax
sub esp, 0x75c
mov eax, dword [0x1304c080]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1304d52c], 0
jne 0x1300b5bf
mov eax, dword [ebp + 8]
mov dword [0x1304d534], eax
push 0x104
lea ecx, [ebp - 0x454]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1300b352
lea edx, [ebp - 0x454]
push edx
lea ecx, [ebp - 0x684]
call fcn.13004d50
mov dword [ebp - 4], 0
mov dword [ebp - 0x668], 0
push 0
push 0x130425f4
lea ecx, [ebp - 0x684]
call fcn.1300b160
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x664]
cmp eax, dword [0x1304263c]
je 0x1300b2d3
mov ecx, dword [ebp - 0x664]
mov dword [ebp - 0x668], ecx
mov edx, dword [ebp - 0x668]
add edx, 1
push edx
push 0x130425f8
lea ecx, [ebp - 0x684]
call fcn.1300b160
mov dword [ebp - 0x664], eax
jmp 0x1300b297
cmp dword [ebp - 0x668], 0
jbe 0x1300b340
mov eax, dword [ebp - 0x668]
push eax
push 0
lea ecx, [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x684]
call fcn.1300b190
mov dword [ebp - 0x764], eax
mov edx, dword [ebp - 0x764]
mov dword [ebp - 0x768], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x768]
push eax
lea ecx, [ebp - 0x684]
call fcn.130046f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x730]
call fcn.130039b0
lea ecx, [ebp - 0x684]
call fcn.130061b0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x684]
call fcn.130039b0
jmp 0x130be687
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1302732a
mov esp, ebp
pop ebp
ret
Function at 0x13010cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1303ed58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1304c080]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.130260ec
mov dword [esp + 0x28], 0
mov edi, dword [0x1304dbb4]
mov ecx, 0x1304e0e4
mov dword [esp + 0xc], edi
call fcn.13002a50
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x13010d2b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x13010d2f
cmp byte [eax + 0x14], 0
je 0x13010d2f
call fcn.1302617a
cmp esi, dword [eax + 0xc]
jae 0x13010d35
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x13010d31
xor ecx, ecx
jmp 0x13010d13
mov esi, ecx
test esi, esi
jne 0x13010d86
test edi, edi
je 0x13010d3d
mov esi, edi
jmp 0x13010d86
lea eax, [esp + 0xc]
push eax
call fcn.1300fd00
add esp, 4
cmp eax, 0xffffffff
jne 0x13010d6c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.13027466
push 0x13046d64
lea ecx, [esp + 0x18]
push ecx
call fcn.13027b84
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1304dbb4], esi
call fcn.13002ad0
push esi
call fcn.13026248
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.1302610d
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x13010fc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1303ed58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1304c080]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.130260ec
mov dword [esp + 0x28], 0
mov edi, dword [0x1304dbb8]
mov ecx, 0x1304dbcc
mov dword [esp + 0xc], edi
call fcn.13002a50
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1301103b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1301103f
cmp byte [eax + 0x14], 0
je 0x1301103f
call fcn.1302617a
cmp esi, dword [eax + 0xc]
jae 0x13011045
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x13011041
xor ecx, ecx
jmp 0x13011023
mov esi, ecx
test esi, esi
jne 0x13011096
test edi, edi
je 0x1301104d
mov esi, edi
jmp 0x13011096
lea eax, [esp + 0xc]
push eax
call fcn.13010e40
add esp, 4
cmp eax, 0xffffffff
jne 0x1301107c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.13027466
push 0x13046d64
lea ecx, [esp + 0x18]
push ecx
call fcn.13027b84
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1304dbb8], esi
call fcn.13002ad0
push esi
call fcn.13026248
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.1302610d
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x130110c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1303ed58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1304c080]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.130260ec
mov dword [esp + 0x28], 0
mov edi, dword [0x1304dbbc]
mov ecx, 0x1304dbc8
mov dword [esp + 0xc], edi
call fcn.13002a50
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1301113b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1301113f
cmp byte [eax + 0x14], 0
je 0x1301113f
call fcn.1302617a
cmp esi, dword [eax + 0xc]
jae 0x13011145
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x13011141
xor ecx, ecx
jmp 0x13011123
mov esi, ecx
test esi, esi
jne 0x13011196
test edi, edi
je 0x1301114d
mov esi, edi
jmp 0x13011196
lea eax, [esp + 0xc]
push eax
call fcn.13010ec0
add esp, 4
cmp eax, 0xffffffff
jne 0x1301117c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.13027466
push 0x13046d64
lea ecx, [esp + 0x18]
push ecx
call fcn.13027b84
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1304dbbc], esi
call fcn.13002ad0
push esi
call fcn.13026248
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.1302610d
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x130111c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1303ed58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1304c080]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.130260ec
mov dword [esp + 0x28], 0
mov edi, dword [0x1304dbc0]
mov ecx, 0x1304dbc4
mov dword [esp + 0xc], edi
call fcn.13002a50
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1301123b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1301123f
cmp byte [eax + 0x14], 0
je 0x1301123f
call fcn.1302617a
cmp esi, dword [eax + 0xc]
jae 0x13011245
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x13011241
xor ecx, ecx
jmp 0x13011223
mov esi, ecx
test esi, esi
jne 0x13011296
test edi, edi
je 0x1301124d
mov esi, edi
jmp 0x13011296
lea eax, [esp + 0xc]
push eax
call fcn.13010f40
add esp, 4
cmp eax, 0xffffffff
jne 0x1301127c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.13027466
push 0x13046d64
lea ecx, [esp + 0x18]
push ecx
call fcn.13027b84
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1304dbc0], esi
call fcn.13002ad0
push esi
call fcn.13026248
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.1302610d
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret