joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb2bfce
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x6677f3f4
call fcn.00b58e26
sub esp, 0x1c
push esi
mov dword [ebp - 0x20], 0x6678ae00
mov byte [ebp - 0x14], 0x3f
mov dword [ebp - 0x28], 0x6678ae84
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
jbe 0xb2c02c
mov ecx, dword [ebp + 0x10]
push esi
call fcn.00b2772c
mov al, byte [eax]
mov byte [ebp - 0x10], al
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
call fcn.00b261bb
xor al, byte [ebp + 0x18]
mov ecx, dword [ebp + 8]
xor al, byte [ebp + 0x14]
mov byte [esi + ecx], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0xb2bff8
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0xb2e11c
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
push esi
mov esi, eax
je 0xb2e140
cmp esi, 8
jae 0xb2e140
test esi, esi
mov al, 0x56
jbe 0xb2e13a
xor byte [ecx], al
mov dl, 0x32
imul dl
inc ecx
add al, 0x34
dec esi
jne 0xb2e12e
mov ax, 1
pop esi
ret
xor ax, ax
pop esi
ret

Function at 0xb30f8e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6677fa98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00b30a5e
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x58], 0
call fcn.00b30ede
mov dword [esp + 0x14], 0x6678ae28
mov cl, byte [eax + 4]
mov byte [esp + 0x18], cl
mov dword [esp + 0x1c], 0x6678b13c
mov edx, dword [eax + 0xc]
mov dword [esp + 0x20], edx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x28], edx
mov al, byte [eax + 0x18]
mov byte [esp + 0x2c], al
lea ecx, [esp + 0x14]
push ecx
push esi
lea ecx, [esi + 0x10]
mov byte [esp + 0x5c], 2
call fcn.00b30b9e
mov ecx, dword [esp + 0x4c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret

Function at 0xb3108e
Capabilities:
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x6678115f
mov eax, dword fs:[0]
push eax
mov eax, 0x39c8
mov dword fs:[0], esp
call fcn.00b5801e
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0x18], esi
call fcn.00b30e2e
mov eax, dword [esp + 0x39e8]
mov dword [esi + 0x1c], eax
lea ecx, [esp + 0x3214]
push ecx
mov ecx, esi
mov dword [esp + 0x39e4], ebx
call fcn.00b30cfe
mov edx, dword [eax + 8]
push 0x74f7af24
lea ecx, [eax + 8]
push 0xcbf1307b
push 0x68baf93a
mov byte [esp + 0x39ec], 1
call dword [edx]
xor eax, 0xcb495fd8
mov ecx, eax
not eax
xor eax, ecx
and eax, 0x32884fd3
not ecx
xor eax, ecx
xor eax, 0x3a80048b
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xc00
call fcn.00b30e2e
mov ecx, esi
call fcn.00b30f0e
push 0x3741102
lea ecx, [esp + 0x2b50]
mov byte [esp + 0x39e4], bl
mov dword [esp + 0x3218], 0x6678ae28
mov dword [esp + 0x3220], 0x6678ab08
js 0xb311c1
Function at 0xb3117a
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
js 0xb311c1
call fcn.00b30d6e
lea eax, [esp + 0x2b4c]
push eax
mov ecx, esi
mov byte [esp + 0x39e4], 2
call fcn.00b3102e
mov ebp, 0x6678ae24
js 0xb311e2
mov edi, 0x6678aaf0
push 0x3671101
lea ecx, [esp + 0x54]
mov byte [esp + 0x39e4], bl
mov dword [esp + 0x2b50], ebp
mov dword [esp + 0x2b58], edi
call fcn.00b30d6e
lea ecx, [esp + 0x50]
push ecx
mov ecx, esi
mov byte [esp + 0x39e4], 3
call fcn.00b3102e
push 0x3681100
lea ecx, [esp + 0x3058]
mov byte [esp + 0x39e4], bl
xor byte [eax], al
add byte [eax + 0x39e4249c], cl
add byte [eax], al
mov dword [esp + 0x54], ebp
mov dword [esp + 0x5c], edi
call fcn.00b30d6e
lea edx, [esp + 0x3054]
mov byte [esp + 0x39e0], 4
push edx
mov ecx, esi
call fcn.00b3102e
push 0x6696800
lea ecx, [esp + 0x8c]
mov byte [esp + 0x39e4], bl
mov dword [esp + 0x3058], ebp
mov dword [esp + 0x3060], edi
call fcn.00b30d6e
lea eax, [esp + 0x88]
push eax
mov ecx, esi
mov byte [esp + 0x39e4], 5
call fcn.00b3102e
push 0x6016800
lea ecx, [esp + 0x1d34]
mov byte [esp + 0x39e4], bl
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x94], edi
call fcn.00b30d6e
lea ecx, [esp + 0x1d30]
push ecx
mov ecx, esi
mov byte [esp + 0x39e4], 6
invalid
Function at 0xb3be8e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66781388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov dword [esp + 4], 0x6678b394
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0
call dword [0x6678b394]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
sub edx, 0x406d68f9
sbb eax, 0
sub ecx, 0x729
sbb esi, 0
push esi
push ecx
push eax
push edx
call fcn.00b5901e
push 0
push 4
push edx
push eax
call fcn.00b587be
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8

Function at 0xb3c5be
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x6678141c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov esi, ecx
push 0x1111
mov dword [esp + 0xc], esi
call fcn.00b26416
push 0xff000000
lea ecx, [esi + 0x1c]
mov dword [esp + 0x34], 0
call fcn.00b2b84a
push 0
lea ecx, [esi + 0x38]
mov byte [esp + 0x34], 1
call fcn.00b3c53e
mov eax, dword [esp + 0x40]
lea edi, [esi + 0x54]
push eax
mov ecx, edi
mov byte [esp + 0x34], 2
call fcn.00b2b84a
mov dword [esi + 0x78], 0x6678b3b4
mov dword [esi + 0x84], 0xf7424533
mov dword [esi + 0x70], 0x6678b3dc
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov byte [esp + 0x30], 4
mov dword [esi + 0x8c], ecx
mov dword [esi + 0x90], edx
call fcn.00b3f6ee
add eax, 0x1c
push eax
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00b3c4ce
mov edi, eax
mov edx, dword [edi + 8]
push 0x38322ca1
lea ecx, [edi + 8]
push 0x8734b3fe
push 0x247f7abf
mov byte [esp + 0x3c], 5
call dword [edx]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x40]
push eax
lea ecx, [edi + 0x18]
call fcn.00b3bf1e
mov edi, eax
call fcn.00b3ee9e
mov edx, dword [esi + 0x78]
add edi, eax
lea ecx, [esi + 0x78]
xor edi, 0xd9875cdd
push edi
call dword [edx + 4]
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0xb3e05e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x667816ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], 0x6678b1f8
mov esi, dword [edi + 0x44]
mov eax, dword [edi + 0x48]
cmp esi, eax
mov dword [esp + 0x1c], 2
je 0xb3e0ee
mov ebx, 0x6678b0b0
mov ebp, 0x66789950
mov eax, dword [esi]
test eax, eax
je 0xb3e0e4
mov dword [eax + 0x70], 0x6678b3d4
mov dword [eax + 0x78], 0x6678b35c
mov dword [eax + 0x54], ebx
mov dword [eax + 0x5c], ebp
mov dword [eax + 0x38], 0x6678b3d0
mov dword [eax + 0x40], 0x6678b344
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x24], ebp
mov dword [eax], 0x6678ae3c
push eax
mov dword [eax + 8], 0x6678ab68
call fcn.00b5879b
add esp, 4
mov eax, dword [edi + 0x48]
add esi, 4
cmp esi, eax
jne 0xb3e0a0
mov eax, dword [edi + 0x44]
test eax, eax
je 0xb3e0fe
push eax
call fcn.00b5879b
add esp, 4
xor eax, eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov esi, dword [edi + 0x3c]
cmp esi, eax
mov ebx, 0x10
mov ebp, 0xf
je 0xb3e174
mov ecx, 0x6678ae2c
mov dword [esi + 0x70], ecx
mov eax, 0x6678ab20
mov dword [esi + 0x78], eax
mov dword [esi + 0x54], 0x6678a560
mov dword [esi + 0x5c], 0x6678a530
mov dword [esi + 0x38], 0x6678b3cc
mov dword [esi + 0x40], 0x6678b32c
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], eax
cmp dword [esi + 0x18], ebx
jb 0xb3e15d
mov eax, dword [esi + 4]
push eax
call fcn.00b5879b
add esp, 4
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], 0
push esi
mov byte [esi + 4], 0
call fcn.00b5879b
add esp, 4
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0xb3e181
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [edi + 0x44]
test eax, eax
je 0xb3e191
push eax
call fcn.00b5879b
add esp, 4
xor eax, eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
cmp dword [edi + 0x34], ebx
jb 0xb3e1ad
mov eax, dword [edi + 0x20]
push eax
call fcn.00b5879b
add esp, 4
mov dword [edi + 0x34], ebp
mov dword [edi + 0x30], 0
mov ecx, edi
mov byte [edi + 0x20], 0
mov dword [esp + 0x1c], 0xffffffff
call fcn.00b3a6de
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0xb3e35e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667816f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x6678b25c
mov edi, dword [esi + 0x34]
test edi, edi
mov dword [esp + 0x14], 1
je 0xb3e3a1
mov ecx, edi
call fcn.00b40dae
push edi
call fcn.00b5879b
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0xb3e3b3
mov eax, dword [esi + 0x1c]
push eax
call fcn.00b5879b
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov dword [esi], 0x6678b180
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0xb3f0fe
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66781818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
mov dword [esp + 8], 0x6678b478
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
lea eax, [esp + 8]
push ecx
push edi
mov ecx, eax
mov dword [esp + 0x30], 0
mov dword [esi], eax
call dword [0x6678b478]
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
add edx, ecx
mov ecx, dword [eax + 0x14]
adc ecx, esi
push 0
sub edx, 0x6fd260e2
push 2
sbb ecx, 0
push ecx
push edx
call fcn.00b587be
mov edx, dword [edi + 8]
mov esi, eax
not eax
xor eax, esi
and eax, 0x69ecbc6e
lea ecx, [edi + 8]
xor eax, esi
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8

Function at 0xb3f406
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66781848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00b3efee
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x58], 0
call fcn.00b3f20e
mov dword [esp + 0x14], 0x6678a560
mov cl, byte [eax + 4]
mov byte [esp + 0x18], cl
mov dword [esp + 0x1c], 0x6678a548
mov edx, dword [eax + 0xc]
mov dword [esp + 0x20], edx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x28], edx
mov al, byte [eax + 0x18]
mov byte [esp + 0x2c], al
lea ecx, [esp + 0x14]
push ecx
push esi
lea ecx, [esi + 0x10]
mov byte [esp + 0x5c], 2
call fcn.00b3f0fe
mov ecx, dword [esp + 0x4c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret

Function at 0xb41b5e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66781cf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
mov dword [esp + 8], 0x6678b5b0
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
lea eax, [esp + 8]
push ecx
push edi
mov ecx, eax
mov dword [esp + 0x30], 0
mov dword [esi], eax
call dword [0x6678b5b0]
mov esi, dword [esi]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push 0
push 2
push edx
push eax
call fcn.00b5901e
add eax, dword [esi + 0x10]
adc edx, dword [esi + 0x14]
push 0
sub eax, 0x4c327bff
push 4
sbb edx, 0
push edx
push eax
call fcn.00b587be
lea ecx, [esp + 0x34]
mov esi, eax
push ecx
mov ecx, edi
mov dword [esp + 0x38], esi
call fcn.00b25c55
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0xb4276e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66781ac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00b41a7e
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x58], 0
call fcn.00b424de
mov dword [esp + 0x14], 0x6678ae24
mov cl, byte [eax + 4]
mov byte [esp + 0x18], cl
mov dword [esp + 0x1c], 0x6678acf0
mov edx, dword [eax + 0xc]
mov dword [esp + 0x20], edx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x28], edx
mov al, byte [eax + 0x18]
mov byte [esp + 0x2c], al
lea ecx, [esp + 0x14]
push ecx
push esi
lea ecx, [esi + 0x10]
mov byte [esp + 0x5c], 2
call fcn.00b41b5e
mov ecx, dword [esp + 0x4c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret

Function at 0xb4334e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x66781b40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
mov esi, dword [esp + 0x48]
mov edx, dword [esi + 0xc]
push edi
mov edi, ecx
mov cl, byte [esi + 4]
mov byte [esp + 0x20], cl
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0x14]
mov dword [esp + 0x2c], ecx
mov cl, byte [esi + 0x18]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x24], 0x6678acf0
mov dword [esp + 0x30], edx
mov byte [esp + 0x34], cl
mov dword [esp + 0x1c], 0x6678ae70
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], eax
call fcn.00b4341e
lea edx, [esp + 0x4c]
push edx
push esi
push edi
lea eax, [esp + 0x28]
push eax
lea ecx, [edi + 0x10]
mov byte [esp + 0x50], 1
mov dword [esp + 0x5c], 0x1bac707f
call fcn.00b4349e
mov eax, dword [esp + 0x48]
mov cl, byte [esp + 0x20]
mov edx, dword [esp + 0x28]
mov byte [eax + 4], cl
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 8], 0x6678acf0
mov dword [eax + 0x10], ecx
mov cl, byte [esp + 0x34]
mov byte [eax + 0x18], cl
mov ecx, dword [esp + 0x38]
pop edi
mov dword [eax + 0x14], edx
mov dword [eax], 0x6678ae70
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret 8
Function at 0xb45fae
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x66781d7e
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov cl, byte [0x667eba60]
mov eax, 1
test al, cl
push edi
jne 0xb45fee
or dword [0x667eba60], eax
mov ecx, 0x667eb980
mov dword [esp + 0x10], 0
call fcn.00b4597e
xor eax, eax
mov edi, esi
mov ecx, 0x100
rep stosd dword es:[edi], eax
mov dword [esi + 4], 0x667eb980
mov dword [esi + 8], 0x667eb988
mov dword [esi + 0xc], 0x667eb990
mov dword [esi + 0x18], 0x667eb998
mov dword [esi + 0x1c], 0x667eb9a0
mov dword [esi + 0x20], 0x667eb9a8
mov dword [esi + 0x24], 0x667eb9b0
mov dword [esi + 0x28], 0x667eb9b8
mov dword [esi + 0x2c], 0x667eb9c8
mov dword [esi + 0x30], 0x667eb9c0
mov dword [esi + 0x10], 0x667eb9d0
mov dword [esi + 0x14], 0x667eb9d8
mov ecx, dword [esp + 8]
mov dword [esi + 0x38], 0x667eb9e0
mov dword [esi + 0x3c], 0x667eb9e8
mov dword [esi + 0x40], 0x667eb9f0
mov dword [esi + 0x44], 0x667eb9f8
mov dword [esi + 0x48], 0x667eba00
mov dword [esi + 0x4c], 0x667eba08
mov dword [esi + 0x50], 0x667eba10
mov dword [esi + 0x54], 0x667eba20
mov dword [esi + 0x58], 0x667eba18
mov dword [esi + 0x68], 0x667eba40
mov dword [esi + 0x5c], 0x667eba30
mov dword [esi + 0x60], 0x667eba28
mov dword [esi + 0x64], 0x667eba38
mov dword [esi + 0x6c], 0x667eba48
mov dword [esi + 0x70], 0x667eba50
mov dword [esi + 0x74], 0x667eba58
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret

Function at 0xb465ee
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x66781e68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00b30d6e
mov eax, dword [esi]
and eax, 1
shl eax, 0x18
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.00b4630e
mov ecx, dword [esi + 4]
and ecx, 0xff
shl ecx, 0x10
push ecx
lea ecx, [esp + 0xc]
call fcn.00b4630e
xor edx, edx
mov dh, byte [esi + 8]
lea ecx, [esp + 8]
push edx
call fcn.00b4630e
mov eax, dword [esi + 0xc]
and eax, 0xff
push eax
lea ecx, [esp + 0xc]
call fcn.00b4630e
mov eax, dword [esp + 0x34]
mov cl, byte [esp + 0xc]
mov edx, dword [esp + 0x14]
mov byte [eax + 4], cl
mov ecx, dword [esp + 0x18]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], 0x6678acf0
mov dword [eax + 0x10], ecx
mov cl, byte [esp + 0x20]
mov byte [eax + 0x18], cl
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x14], edx
mov dword [eax], 0x6678ae70
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0xb4deee
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x66782b28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov dword [esi], edi
call fcn.00b4e57e
lea eax, [esp + 0x28]
push eax
push 0x40
push 0x10
add esi, 0x20
push esi
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
call dword [0x667890b0]
push 0x10
push esi
lea ecx, [esp + 0x10]
call fcn.00b4e49e
push 0
push 0xbc
lea ecx, [esp + 0x10]
call fcn.00b4e5fe
push 1
push edi
lea ecx, [esp + 0x10]
call fcn.00b4e66e
push 5
push 0x61
lea ecx, [esp + 0x10]
call fcn.00b4e5fe
push 6
push 0x9d
lea ecx, [esp + 0x10]
call fcn.00b4e5fe
push 7
push 0x5c
lea ecx, [esp + 0x10]
call fcn.00b4e5fe
push 8
push 0xc3
lea ecx, [esp + 0x10]
call fcn.00b4e5fe
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.00b4e45e
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0xb55c7e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66783200
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, dword [esp + 0x44]
mov dl, byte [esi + 0xc]
push edi
mov edi, ecx
mov cl, byte [esi + 4]
mov byte [esp + 0x20], cl
mov ecx, dword [esi + 0x10]
mov byte [esp + 0x28], dl
mov dl, byte [esi + 0x14]
mov dword [esp + 0x2c], ecx
mov cl, byte [esi + 0x15]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x24], 0x6678d0d8
mov byte [esp + 0x30], dl
mov byte [esp + 0x31], cl
mov dword [esp + 0x1c], 0x6678d100
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], eax
call fcn.00b5579e
lea edx, [esp + 0x48]
push edx
push esi
push edi
lea eax, [esp + 0x28]
push eax
lea ecx, [edi + 0x10]
mov byte [esp + 0x4c], 1
mov byte [esp + 0x58], 0x4d
call fcn.00b5589e
mov eax, dword [esp + 0x44]
mov cl, byte [esp + 0x20]
mov dl, byte [esp + 0x28]
mov byte [eax + 4], cl
mov ecx, dword [esp + 0x2c]
mov byte [eax + 0xc], dl
mov dl, byte [esp + 0x30]
mov dword [eax + 8], 0x6678d0d8
mov dword [eax + 0x10], ecx
mov cl, byte [esp + 0x31]
mov byte [eax + 0x15], cl
mov ecx, dword [esp + 0x34]
pop edi
mov byte [eax + 0x14], dl
mov dword [eax], 0x6678d100
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8

Function at 0xb55dfe
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x66783248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, dword [esp + 0x54]
mov al, byte [esi + 4]
mov edx, dword [esi + 0x10]
push edi
mov edi, ecx
mov cl, byte [esi + 0xc]
mov byte [esp + 0x1c], al
mov al, byte [esi + 0x14]
mov byte [esp + 0x24], cl
mov cl, byte [esi + 0x15]
mov dword [esp + 0x20], 0x6678d0d8
mov dword [esp + 0x28], edx
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], cl
mov dword [esp + 0x18], 0x6678d100
lea ecx, [esp + 8]
mov dword [esp + 0x50], 0
call fcn.00b5579e
mov dl, byte [esi + 4]
mov al, byte [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov byte [esp + 0x34], dl
mov dl, byte [esi + 0x14]
mov byte [esp + 0x3c], al
mov al, byte [esi + 0x15]
mov dword [esp + 0x38], 0x6678d0d8
mov dword [esp + 0x40], ecx
mov byte [esp + 0x44], dl
mov byte [esp + 0x45], al
mov dword [esp + 0x30], 0x6678d100
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [edi + 0x10]
mov byte [esp + 0x60], 2
mov byte [esp + 0x68], 0x4d
call fcn.00b5589e
mov edx, dword [esp + 0x20]
push 0x22
push 0x7d
push 0x3c
lea ecx, [esp + 0x2c]
call dword [edx]
mov byte [esp + 0x58], al
mov edx, dword [esp + 0x58]
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
push edx
call dword [eax + 4]
mov ecx, dword [esp + 0x48]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x4c
ret 4
Function at 0xb55f9e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66783268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
push 0xaa
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
call fcn.00b55c0e
mov dword [esp + 0x30], esi
pushal
mov eax, 1
cpuid
xor eax, ebp
mov dword [esp + 0x2c], eax
popal
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.00b55eee
mov eax, dword [esp + 0x38]
mov cl, byte [esp + 0x14]
mov dl, byte [esp + 0x1c]
mov byte [eax + 4], cl
mov ecx, dword [esp + 0x20]
mov dword [eax + 8], 0x6678d0d8
mov byte [eax + 0xc], dl
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x24]
pop edi
mov byte [eax + 0x14], cl
mov byte [eax + 0x15], ch
mov ecx, dword [esp + 0x24]
pop esi
mov dword [eax], 0x6678d100
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 4

Function at 0xb561fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x66783360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x154
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebp, 0x667899b8
mov ebx, 0x9769613f
mov eax, 0x66789a30
mov dword [esp + 0x16c], 0
mov dword [esp + 0x94], ebp
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x60], ebp
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x44], ebp
mov dword [esp + 0x50], ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], eax
push 0xff
lea ecx, [esp + 0x14c]
mov byte [esp + 0x170], 4
call fcn.00b07dfe
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x178]
call fcn.00b55b3e
mov edx, 0x6678d0d8
mov cl, 0xbe
mov eax, 0x6678d100
mov dword [esp + 0x7c], edx
mov byte [esp + 0x88], cl
mov dword [esp + 0x74], eax
mov dword [esp + 0xb0], edx
mov byte [esp + 0xbc], cl
mov dword [esp + 0xa8], eax
mov edx, dword [esp + 0x100]
push 0x22
push 0x7d
push 0x3c
lea ecx, [esp + 0x10c]
mov byte [esp + 0x178], 8
call dword [edx]
xor al, 0xda
mov cl, al
xor eax, eax
mov al, cl
not al
xor al, cl
and al, 0x2c
xor al, cl
xor al, 0x8b
lea ecx, [esp + 0xb0]
push eax
mov eax, dword [esp + 0xb4]