joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3bb7c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret

Function at 0x3bd630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
lea edi, [ebp + 8]
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [esp + 0x78], eax
lea esi, [esp + 0x1c]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.003bd7c0
mov ebx, dword [esi]
test ebx, ebx
je 0x3bd780
xor eax, eax
push eax
call fcn.002bc7dc
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], edx
mov esi, dword [edi]
lea eax, [esi + 0xc]
mov dword [esp + 0x14], eax
lea edi, [esp + 0x20]
mov ecx, edi
call fcn.003eabe0
mov dword [esp + 0x10], esi
movups xmm0, xmmword [esi + 0x34]
movaps xmmword [edi], xmm0
lea esi, [esp + 0x30]
mov ecx, esi
push dword [esp + 0x14]
call fcn.003477f0
mov eax, dword [esp + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x40], eax
lea ecx, [ebx + 0x28]
mov edx, edi
call fcn.0028f1f0
mov byte [ebx + 0x24], 1
cmp byte [esi + 0x17], 0
jns 0x3bd6dc
push dword [esp + 0x3c]
call fcn.002a5449
add esp, 4
mov ecx, esi
call fcn.003477d0
mov ebx, dword [esp + 0x10]
lea ecx, [ebx + 8]
push edi
call fcn.003be0a0
mov ecx, edi
call fcn.003477d0
mov esi, dword [ebx + 0x1c]
mov ebx, dword [ebx + 0x20]
jmp 0x3bd709
mov ecx, dword [esi]
call fcn.003ec530
add esi, 4
cmp esi, ebx
jne 0x3bd6ff
mov eax, dword [esp + 0x10]
lea ecx, [eax + 0x34]
mov dword [esp + 0xc], ecx
mov ebx, dword [eax + 0x28]
mov esi, dword [eax + 0x2c]
jmp 0x3bd732
mov ecx, ebx
push edi
call fcn.003be0a0
mov ecx, edi
call fcn.003477d0
add ebx, 0x14
cmp ebx, esi
jne 0x3bd720
mov eax, dword [esp + 0xc]
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 0xc]
movups xmmword [eax], xmm0
xor eax, eax
push eax
call fcn.003ec5f0
add esp, 4
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea ebx, [eax + ecx + 4]
mov eax, dword [ebx]
mov edi, dword [eax]
mov ecx, edi
call dword [0x10391000]
mov ecx, ebx
xor ebx, ebx
push 2
push ebx
push ebx
call edi
push edx
push eax
call fcn.003ec650
add esp, 8
jmp 0x3bd787
mov esi, dword [edi]
mov ebx, 3
lea ecx, [esp + 0x1c]
call fcn.003be100
test esi, esi
je 0x3bd7a4
mov ecx, esi
call fcn.003eaca0
push esi
call fcn.002a5449
add esp, 4
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.002a5ceb
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x3e36a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov edi, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
jne 0x3e36c7
call fcn.00357e40
mov ebx, eax
test edi, edi
cmove edi, ebx
push ebx
call fcn.00357b90
add esp, 4
lea ecx, [eax*2 + 2]
cmp ecx, esi
ja 0x3e3711
mov dword [ebp - 0x68], edi
lea edx, [eax + eax]
mov edi, esi
mov esi, edx
not esi
lea ecx, [edi + esi]
dec ecx
cmp ecx, dword [ebp + 0x14]
jb 0x3e3706
lea ecx, [edi - 1]
or edx, 1
mov dword [ebp - 0x60], ecx
cmp ecx, edx
jae 0x3e374b
push 0x6d
jmp 0x3e3713
push 0x68
push 0x10362843
push 0x72
jmp 0x3e371a
push 0x62
push 0x10362843
push 0x7e
push 0
push 4
call fcn.0039f2d0
add esp, 0x14
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.002a5ceb
mov eax, edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
xor edi, edi
push ebx
call fcn.0038abe0
add esp, 4
jmp 0x3e3728
mov edx, dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov dword [ebp - 0x5c], eax
add eax, edi
inc eax
xor ecx, ecx
push ecx
push ebx
push ecx
mov dword [ebp - 0x58], eax
push eax
push edx
push dword [ebp + 0x18]
call fcn.00357ba0
add esp, 0x18
test eax, eax
je 0x3e373c
mov ebx, dword [ebp - 0x60]
mov ecx, dword [ebp + 0x14]
sub ebx, ecx
add esi, ebx
mov edx, dword [ebp - 0x5c]
je 0x3e379a
mov eax, dword [ebp - 0x58]
add eax, edx
push esi
push 0
push eax
mov esi, edx
call fcn.002a95c0
mov edx, esi
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov eax, edx
not eax
add ebx, dword [ebp - 0x58]
mov byte [eax + ebx], 1
lea eax, [edi + 1]
mov dword [ebp - 0x54], eax
test ecx, ecx
mov esi, edx
je 0x3e37cc
mov eax, edi
add eax, esi
add eax, dword [ebp + 0xc]
sub eax, ecx
sub eax, esi
push ecx
push dword [ebp + 0x10]
push eax
call fcn.002a9040
mov esi, dword [ebp - 0x5c]
add esp, 0xc
push esi
push dword [ebp - 0x54]
call fcn.00356a50
add esp, 8
test eax, eax
je 0x3e373c
mov edi, dword [ebp - 0x60]
sub edi, esi
push edi
call fcn.0038ab10
add esp, 4
test eax, eax
je 0x3e373c
mov ebx, eax
push dword [ebp - 0x68]
push esi
push dword [ebp - 0x54]
mov dword [ebp - 0x64], edi
push edi
push eax
call fcn.00360100
add esp, 0x14
test eax, eax
je 0x3e373e
cmp dword [ebp - 0x60], esi
mov esi, dword [ebp - 0x58]
je 0x3e3832
mov eax, dword [ebp - 0x64]
cmp eax, 1
adc eax, 0
xor ecx, ecx
mov dl, byte [ebx + ecx]
xor byte [esi + ecx], dl
inc ecx
cmp eax, ecx
jne 0x3e3827
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x50]
movdqu xmmword [eax + 0x30], xmm0
movdqu xmmword [eax + 0x20], xmm0
movdqu xmmword [eax + 0x10], xmm0
movdqu xmmword [eax], xmm0
push dword [ebp - 0x68]
push dword [ebp - 0x64]
push esi
mov esi, dword [ebp - 0x5c]
push esi
push eax
call fcn.00360100
add esp, 0x14
test eax, eax
je 0x3e373e
xor edi, edi
inc edi
test esi, esi
je 0x3e3740
mov edx, esi
xor eax, eax
mov esi, dword [ebp - 0x54]
mov cl, byte [ebp + eax - 0x50]
xor byte [esi + eax], cl
inc eax
cmp edx, eax
jne 0x3e387a
jmp 0x3e3740
Function at 0x3eddf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [esp + 0x78], eax
xor eax, eax
dec eax
lea ebx, [esp + 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
add ecx, 0x48
push ebx
call fcn.003edfb0
mov edi, dword [ebx]
mov ebx, dword [ebx + 4]
cmp edi, ebx
jne 0x3edf01
cmp byte [esi + 0xb], 0
je 0x3ede69
xor eax, eax
lea edi, [esp + 0x20]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, dword [esi + 0x58]
push edi
call fcn.003be990
test eax, eax
jne 0x3ede5e
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
cmp eax, ebx
jne 0x3edebf
lea ecx, [esp + 0x1c]
mov dword [ecx], edi
call fcn.0037ce00
lea ecx, [esp + 0x20]
lea eax, [esp + 0x10]
mov dword [ecx], eax
call fcn.003ee1c0
mov eax, dword [esi + 0x1c]
cmp byte [eax + 8], 0
je 0x3ede94
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.002a5ceb
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esi + 0x18]
add esi, 0x10
call dword [0x10391000]
push esi
call ecx
add esp, 4
jmp 0x3ede81
mov eax, dword [esp + 4]
cmp eax, dword [esp + 0xc]
je 0x3edf7b
mov eax, dword [esp + 8]
add eax, 0x50
jmp 0x3ede5a
mov dword [esp + 8], eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
cmp edx, ecx
je 0x3edeac
mov ecx, dword [esp + 4]
push dword [esp + 8]
call fcn.003bcef0
test al, al
jne 0x3edea8
mov eax, dword [esp + 4]
add eax, 0x10
mov dword [esp + 4], eax
cmp eax, dword [esp + 0xc]
jne 0x3eded9
mov eax, dword [esp + 0xc]
jmp 0x3edeac
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea ecx, [esp + 0x20]
call fcn.003eabe0
mov ecx, dword [esi + 0x58]
lea eax, [esp + 0x20]
push eax
push edi
call fcn.003be840
mov byte [esp + 4], 3
test eax, eax
je 0x3edf99
cmp byte [esp + 0x47], 0
jns 0x3edf56
push dword [esp + 0x3c]
call fcn.002a5449
add esp, 4
lea ecx, [esp + 0x30]
call fcn.003477d0
cmp byte [esp + 4], 3
je 0x3edf73
movzx eax, byte [esp + 4]
test eax, eax
jne 0x3ede69
add edi, 0x10
jmp 0x3ede29
mov ecx, esi
push dword [esp + 8]
call fcn.003ee000
mov eax, dword [esp + 8]
cmp byte [esi + 0x40], 0
je 0x3ede5e
jmp 0x3edeba
mov ecx, esi
lea eax, [esp + 0x20]
push eax
call fcn.003ee000
mov al, byte [esi + 0x40]
xor al, 1
mov byte [esp + 4], al
jmp 0x3edf43
Function at 0x3f2d30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [esp + 8], eax
xor eax, eax
mov byte [ecx], al
mov ecx, dword [0x1037aac8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
lea ecx, [ecx + 0x148]
mov dword [esi + 4], ecx
mov edx, dword [ecx]
mov dword [ecx], esi
mov dword [esi + 8], edx
mov edi, dword [ebp + 8]
mov dword [esi + 0xc], edi
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x38], eax
test byte [0x103795e4], 9
jne 0x3f2db3
mov byte [esi + 0x20], 0
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.002a5ceb
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov byte [esi + 0x20], 1
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x10391000]
mov eax, esp
mov ecx, edi
push eax
mov edi, eax
call ebx
movsd xmm0, qword [edi]
movsd qword [esi + 0x10], xmm0
jmp 0x3f2d9c
Function at 0x3fe0e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x50]
movdqu xmmword [esi + 0x30], xmm0
movdqu xmmword [esi + 0x20], xmm0
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
push esi
push 0x20
push dword [ebp + 0x10]
call fcn.003583a0
add esp, 0xc
and byte [esi], 0xf8
mov al, byte [esi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea edi, [ebp - 0xf0]
push 0xa0
push 0xff
push edi
call fcn.002a95c0
add esp, 0xc
push 0x10364218
push esi
push edi
call fcn.003fbce0
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, edi
call fcn.00401810
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [ebx + 0x10], xmm1
movups xmmword [ebx], xmm0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.002a5ceb
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402a90
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x10376020]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movdqu xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
lea esi, [ebp - 0x30]
movdqu xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm1
and byte [esi], 0xf8
mov al, byte [esi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea edi, [ebp - 0xd0]
push 0xa0
push 0xff
push edi
call fcn.002a95c0
add esp, 0xc
push 0x10364218
push esi
push edi
call fcn.003fbce0
add esp, 0xc
xor eax, eax
dec eax
lea ebx, [ebp - 0x120]
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x20], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
lea edi, [ebp - 0x148]
mov dword [edi + 0x24], eax
mov dword [edi + 0x20], eax
movdqu xmmword [edi + 0x10], xmm0
lea edx, [ebp - 0x80]
mov eax, dword [edx - 0x28]
add eax, dword [edx]
movdqu xmmword [edi], xmm0
lea esi, [ebp - 0xf8]
mov dword [esi], eax
mov eax, dword [edx - 0x24]
add eax, dword [edx + 4]
mov dword [esi + 4], eax
mov eax, dword [edx - 0x20]
add eax, dword [edx + 8]
mov dword [esi + 8], eax
mov eax, dword [edx - 0x1c]
add eax, dword [edx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edx - 0x18]
add eax, dword [edx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edx - 0x14]
add eax, dword [edx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edx - 0x10]
add eax, dword [edx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edx - 0xc]
add eax, dword [edx + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edx - 8]
add eax, dword [edx + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edx - 4]
add eax, dword [edx + 0x24]
mov dword [esi + 0x24], eax
lea eax, [ebp - 0xa8]
mov ecx, ebx
push eax
call fcn.003fb620
add esp, 4
mov ecx, edi
mov edx, ebx
call fcn.004038b0
mov ecx, edi
mov edx, esi
push edi
call fcn.00403c30
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, edi
call fcn.003fad10
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.002a5ceb
add esp, 0x13c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4199c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
mov ebx, ecx
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x50]
movdqu xmmword [esi + 0x30], xmm0
movdqu xmmword [esi + 0x20], xmm0
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.002d83f0
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.0041dca0
test al, al
jne 0x419a3b
push 1
call fcn.00344430
add esp, 4
test al, al
jne 0x419b44
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.002a5ceb
mov eax, ebx
add esp, 0xe8
pop esi
pop edi
pop ebx
pop ebp
ret 8
movzx eax, word [ebp - 0x50]
cmp eax, 0x5a4d
je 0x419a7f
push 1
call fcn.00344430
add esp, 4
test al, al
je 0x419a20
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x15a
push 0x103664e2
call fcn.00344530
lea eax, [ebp - 0xec]
push 0x21
push 0x10366770
jmp 0x419b6a
mov ecx, edi
call fcn.002d83f0
mov edi, eax
mov eax, dword [ebp - 0x14]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0x108
push esi
push edi
call fcn.0041dca0
test al, al
jne 0x419ae8
push 1
call fcn.00344430
add esp, 4
test al, al
je 0x419a20
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x162
push 0x103664e2
call fcn.00344530
lea eax, [ebp - 0xec]
push 0x1f
push 0x10366792
jmp 0x419b6a
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
je 0x419b2d
push 1
call fcn.00344430
add esp, 4
test al, al
je 0x419a20
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x168
push 0x103664e2
call fcn.00344530
lea eax, [ebp - 0xec]
push 0x23
push 0x103667b2
jmp 0x419b6a
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x419a22
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x419a22
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x154
push 0x103664e2
call fcn.00344530
lea eax, [ebp - 0xec]
push 0x1f
push 0x10366750
push eax
call fcn.002d8830
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
js 0x419b80
and ecx, 0x7f
jmp 0x419b85
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
push ecx
push ebx
push eax
call fcn.002d8830
add esp, 0xc
mov ecx, edi
call fcn.003448e0
jmp 0x419a20
Function at 0x419ba0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
mov ebx, ecx
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x50]
movdqu xmmword [esi + 0x30], xmm0
movdqu xmmword [esi + 0x20], xmm0
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.002d83f0
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.0041dca0
test al, al
jne 0x419c1b
push 1
call fcn.00344430
add esp, 4
test al, al
jne 0x419d24
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.002a5ceb
mov eax, ebx
add esp, 0xe8
pop esi
pop edi
pop ebx
pop ebp
ret 8
movzx eax, word [ebp - 0x50]
cmp eax, 0x5a4d
je 0x419c5f
push 1
call fcn.00344430
add esp, 4
test al, al
je 0x419c00
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x15a
push 0x103664e2
call fcn.00344530
lea eax, [ebp - 0xec]
push 0x21
push 0x10366770
jmp 0x419d4a
mov ecx, edi
call fcn.002d83f0
mov edi, eax
mov eax, dword [ebp - 0x14]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0xf8
push esi
push edi
call fcn.0041dca0
test al, al
jne 0x419cc8
push 1
call fcn.00344430
add esp, 4
test al, al
je 0x419c00
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x162
push 0x103664e2
call fcn.00344530
lea eax, [ebp - 0xec]
push 0x1f
push 0x10366792
jmp 0x419d4a
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
je 0x419d0d
push 1
call fcn.00344430
add esp, 4
test al, al
je 0x419c00
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x168
push 0x103664e2
call fcn.00344530
lea eax, [ebp - 0xec]
push 0x23
push 0x103667b2
jmp 0x419d4a
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x419c02
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x419c02
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x154
push 0x103664e2
call fcn.00344530
lea eax, [ebp - 0xec]
push 0x1f
push 0x10366750
push eax
call fcn.002d8830
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
js 0x419d60
and ecx, 0x7f
jmp 0x419d65
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
push ecx
push ebx
push eax
call fcn.002d8830
add esp, 0xc
mov ecx, edi
call fcn.003448e0
jmp 0x419c00
Function at 0x10001100
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000b708
push 0x100089b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov esi, dword [0x1000eb8c]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
push 4
push esi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
call edi
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x10001185
push 4
lea eax, [esi + ebx]
push eax
call edi
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x10001185
mov esi, dword [esi]
add esi, ebx
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 4
push esi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
test esi, esi
je 0x10001175
mov eax, dword [ebp + 8]
mov dword [esi], eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push esi
call edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100011d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
call edi
push 0x1000
push 0
push esi
call sub.ntdll.dll_memset
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
push 0
push ecx
push edx
push eax
call edi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10001240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp + 8]
jne 0x10001279
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000127d
cmp edx, esi
jne 0x10001262
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp + 8]
jne 0x1000129d
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100012a1
cmp edx, esi
jne 0x10001286
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 8]
jne 0x100012c1
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100012c5
cmp edx, esi
jne 0x100012aa
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003d60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x1000f408]
mov eax, dword [0x1000f548]
push esi
push edi
mov edi, dword [0x1000f518]
mov esi, 0xb7a7c5ac
cmp ecx, 1
jne 0x10003d9e
mov ecx, dword [0x1000eb8c]
fld dword [0x1000d210]
mov ecx, dword [ecx]
mov edx, dword [ecx + edi]
lea edx, [edx + edx*8]
lea ecx, [ecx + edx*8]
fstp dword [ecx + eax + 0xc]
jmp 0x10003db7
test ecx, ecx
jne 0x10003db7
mov edx, dword [0x1000eb8c]
mov ecx, dword [edx]
mov edx, dword [ecx + edi]
lea edx, [edx + edx*8]
lea ecx, [ecx + edx*8]
mov dword [ecx + eax + 0xc], esi
mov ecx, dword [0x1000f5e4]
cmp ecx, 1
jne 0x10003ddb
mov edx, dword [0x1000eb8c]
mov ecx, dword [edx]
mov ecx, dword [edi + ecx]
lea edx, [ecx + ecx*8]
push 0x3f4ce1c6
lea ecx, [eax + edx*8 + 0x30]
jmp 0x10003df2
test ecx, ecx
jne 0x10003dfc
mov ecx, dword [0x1000eb8c]
mov edx, dword [ecx]
mov ecx, dword [edi + edx]
lea ecx, [ecx + ecx*8]
push esi
lea ecx, [eax + ecx*8 + 0x30]
call fcn.10001100
mov eax, dword [0x1000f548]
mov ecx, dword [0x1000eb34]
cmp ecx, 1
jne 0x10003e2a
mov edx, dword [0x1000eb8c]
fld dword [0x1000d210]
mov ecx, dword [edx]
mov edx, dword [0x1000f518]
mov edx, dword [ecx + edx]
lea edx, [edx + edx*8]
lea ecx, [ecx + edx*8]
fstp dword [ecx + eax + 0x10]
jmp 0x10003e49
test ecx, ecx
jne 0x10003e49
mov edx, dword [0x1000eb8c]
mov ecx, dword [edx]
mov edx, dword [0x1000f518]
mov edx, dword [ecx + edx]
lea edx, [edx + edx*8]
lea ecx, [ecx + edx*8]
mov dword [ecx + eax + 0x10], esi
cmp dword [0x1000ebc0], 0
je 0x10003e70
push 1
call fcn.100015d0
test ax, ax
je 0x10003e70
mov edx, dword [0x1000f5ec]
mov eax, dword [edx]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx + 0x2c]
mov byte [edx + 0x5c], 3
cmp dword [0x1000f498], 0
je 0x10003eb5
push 0x79
call fcn.100015d0
test ax, ax
je 0x10003eb5
mov eax, dword [0x1000f470]
mov esi, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
add esi, 0x3c
push esi
call edi
mov ecx, dword [ebp - 4]
mov dl, byte [0x1000abac]
lea eax, [ebp - 4]
push eax
push ecx
push 1
push esi
mov byte [esi], dl
call edi
cmp dword [0x1000f3fc], 0
je 0x10003ee1
cmp dword [0x1000f5ec], 0
mov eax, dword [0x1000f4c0]
jbe 0x10003ed7
mov edx, dword [eax]
fld dword [0x1000b0f4]
fstp dword [edx + 4]
mov eax, dword [eax]
fld dword [0x1000b0f0]
fstp dword [eax]
mov ecx, dword [0x1000e514]
test ecx, ecx
je 0x10003f50
mov edx, dword [0x1000eb8c]
mov eax, dword [edx]
mov edx, dword [0x1000f518]
mov edx, dword [eax + edx]
lea eax, [eax + edx*4]
mov edx, dword [0x1000f580]
mov edx, dword [eax + edx]
add edx, 8
cmp ecx, 1
jne 0x10003f35
mov eax, 0x1000abb0
mov esi, edx
sub esi, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x10003f20
mov ecx, dword [0x1000e514]
cmp ecx, 2
jne 0x10003f50
mov eax, 0x1000abb4
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10003f41
pop edi
pop esi
mov esp, ebp
pop ebp
ret