joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b619
Capabilities:
Get geographical location

Disassembly:
push 0xb0
mov eax, 0x100888d9
call fcn.100705c6
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0xb8], eax
call fcn.1000b80f
test al, al
jne 0x1000b660
call dword [0x1008f08c]
push 0x50
xor edx, edx
pop ecx
div ecx
inc edx
mov dword [0x100c97a0], edx
xor ebx, ebx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x9d], bl
call fcn.1000b837
test al, al
jne 0x1000b6bc
push 0x28
call fcn.1006f447
pop ecx
mov edi, eax
mov esi, ebx
call fcn.10070af8
add eax, dword [0x100c97a0]
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0xa
jl 0x1000b68d
mov eax, dword [edi + 0x24]
push edi
mov dword [0x100c97a0], eax
call fcn.10070c4d
mov esi, dword [ebp - 0xa4]
mov edi, dword [ebp - 0xbc]
pop ecx
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 1
call fcn.10011cc3
push ebx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 2
call fcn.1001423b
push 1
lea eax, [ebp - 0xb4]
push eax
push esi
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 3
call fcn.10012fec
test al, al
jne 0x1000b72d
mov esi, str.error_parse
push esi
call fcn.10070400
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.1000130e
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 2
call fcn.10014361
lea ecx, [ebp - 0x9c]
call fcn.1000324f
jmp 0x1000b7ff
mov esi, str.country_name
push esi
lea ecx, [ebp - 0xb4]
call fcn.10014ba0
test al, al
je 0x1000b7e9
push esi
lea ecx, [ebp - 0xb4]
call fcn.10014502
mov ecx, eax
call fcn.10014bcb
test al, al
je 0x1000b7e9
push str.country_code
lea ecx, [ebp - 0xb4]
call fcn.10014502
mov ecx, eax
call fcn.10014745
push 0x100c9784
lea ecx, [ebp - 0xa4]
mov dword [edi], eax
call fcn.10001561
push esi
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
call fcn.10014502
mov ecx, eax
call fcn.10014742
push eax
lea ecx, [ebp - 0xa4]
call fcn.1000207b
lea ecx, [ebp - 0xa4]
call fcn.100037f3
mov esi, dword [eax]
push esi
call fcn.100014b2
pop ecx
mov ecx, dword [ebp - 0xb8]
push eax
push esi
call fcn.1000130e
mov ecx, dword [ebp - 0xa4]
mov bl, 1
lea ecx, [ecx - 0x10]
mov byte [ebp - 0x9d], bl
call fcn.10002036
jmp 0x1000b70e
mov esi, str.error_json_not_valid_update_from_version
jmp 0x1000b6fd
lea ecx, [ebp - 0x2c]
call fcn.1000102f
mov al, bl
call fcn.10070518
ret
Function at 0x1000e343
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c8
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov dword [ebp - 0x7c8], ebx
call fcn.100714b0
pop ecx
pop ecx
test eax, eax
jne 0x1000e37d
push 4
pop eax
jmp 0x1000e57f
and dword [ebp - 0x7c0], 0
push 0x100907d4
lea eax, [ebp - 0x7c0]
push esi
push eax
call fcn.100735d0
add esp, 0xc
test eax, eax
jne 0x1000e57c
cmp dword [ebp - 0x7c0], eax
je 0x1000e57c
and dword [ebp - 0x7c4], eax
push 0x100907d8
lea eax, [ebp - 0x7c4]
push edi
push eax
call fcn.100735d0
mov edx, dword [0x100c97a0]
mov edi, eax
lea eax, [edx + 2]
lea ecx, [edx + 1]
imul eax, ecx
imul eax, edx
add esp, 0xc
cdq
push 3
pop esi
idiv esi
cmp edx, 1
jne 0x1000e44f
xor esi, esi
call fcn.10070af8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0x7c4], xmm0
cmp esi, 0xf7
jb 0x1000e3e9
xor eax, eax
mov edx, 0xf6
mov ecx, edx
cmp eax, edx
jge 0x1000e444
movsd xmm0, qword [ebp + ecx*8 - 0x7bc]
movsd xmm1, qword [ebp + ecx*8 - 0x7c4]
comisd xmm0, xmm1
jbe 0x1000e43f
movsd qword [ebp + ecx*8 - 0x7bc], xmm1
movsd qword [ebp + ecx*8 - 0x7c4], xmm0
dec ecx
cmp ecx, eax
jg 0x1000e415
inc eax
cmp eax, 0xf7
jl 0x1000e40f
push 3
pop esi
test edi, edi
jne 0x1000e575
cmp dword [ebp - 0x7c4], edi
je 0x1000e575
push ebx
call fcn.10070400
lea ebx, [eax - 1]
pop ecx
cmp ebx, 0x1f
ja 0x1000e571
push 2
push edi
push dword [ebp - 0x7c0]
call fcn.10073913
mov ecx, dword [0x100c97a0]
add esp, 0xc
lea eax, [ecx + 1]
imul eax, ecx
push 0xe
cdq
pop ecx
idiv ecx
cmp edx, 0xb
jne 0x1000e4b7
xor esi, esi
xor eax, eax
push 0x51
inc esi
inc eax
pop edx
dec edx
lea ecx, [eax + esi]
lea esi, [eax]
mov eax, ecx
jns 0x1000e4a7
mov dword [0x100c97a0], ecx
push dword [ebp - 0x7c0]
call fcn.10073ceb
push 0
push 0
push dword [ebp - 0x7c0]
mov esi, eax
call fcn.10073913
push esi
call fcn.10071045
push dword [ebp - 0x7c0]
mov edi, eax
push 1
push esi
push edi
call fcn.100737d8
push dword [ebp - 0x7c0]
call fcn.10073480
add esp, 0x28
xor edx, edx
xor ecx, ecx
test esi, esi
je 0x1000e51a
mov eax, dword [ebp - 0x7c8]
mov al, byte [eax + ecx]
xor byte [edx + edi], al
cmp ecx, ebx
jne 0x1000e514
xor ecx, ecx
jmp 0x1000e515
inc ecx
inc edx
cmp edx, esi
jne 0x1000e500
push dword [ebp - 0x7c4]
push 1
push esi
push edi
call fcn.10073eaa
push dword [ebp - 0x7c4]
call fcn.10073480
push edi
call fcn.1007157a
mov ecx, dword [0x100c97a0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
add esp, 0x18
cdq
push 0x15
pop ecx
idiv ecx
cmp edx, 0x13
jne 0x1000e56d
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [0x1008f098]
push ebx
push ebx
call dword [0x1008f09c]
xor eax, eax
jmp 0x1000e57f
mov eax, esi
jmp 0x1000e57f
push 2
jmp 0x1000e377
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007048b
leave
ret
Function at 0x100115c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11814
call fcn.10070d20
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [0x100c97a0]
mov dword [ebp - 0x11810], eax
lea ecx, [ebx + 2]
lea eax, [ebx + 1]
imul eax, ecx
imul eax, ebx
push esi
push edi
push 0x11
cdq
pop ecx
idiv ecx
and dword [ebp - 0x11814], 0
mov word [ebp - 0x54], 0x475c
mov byte [ebp - 0x52], 0xa
mov dword [ebp - 0x50], 0x670a6f0a
mov byte [ebp - 0x4c], 0xa
mov word [ebp - 0x4a], 0x650a
mov byte [ebp - 0x48], 0xa
mov dword [ebp - 0x46], 0xa68430a
mov dword [ebp - 0x41], 0x6d0a6f0a
mov word [ebp - 0x3c], 0x5c0a
mov byte [ebp - 0x3a], 0xa
mov word [ebp - 0x38], 0xa73
mov dword [ebp - 0x35], 0x200a720a
mov word [ebp - 0x31], 0xa44
mov word [ebp - 0x2e], 0xa74
mov dword [ebp - 0x2b], 0xa0a0a0a
mov dword [ebp - 0x27], 0xa0a0a0a
mov dword [ebp - 0x23], 0xa0a0a0a
mov dword [ebp - 0x1f], 0xa0a0a0a
mov dword [ebp - 0x1b], 0xa0a0a0a
mov dword [ebp - 0x17], 0xa0a0a0a
mov dword [ebp - 0x13], 0xa0a0a0a
mov dword [ebp - 0xf], 0xa0a0a0a
mov dword [ebp - 0xb], 0xa0a0a0a
mov word [ebp - 7], 0xa
cmp edx, 0xe
jne 0x100116fd
xor eax, eax
mov dword [ebp - 0x11800], eax
lea esi, [ebp - 0x117f8]
xor edi, edi
and dword [ebp - 0x1180c], 0
mov eax, ebx
inc edi
cdq
idiv edi
mov dword [ebp - 0x11804], edi
mov edi, dword [ebp - 0x1180c]
mov dword [ebp - 0x11808], edx
lea ecx, [edi + 1]
mov edi, ecx
cmp edi, 0xe
jl 0x100116d3
mov edi, dword [ebp - 0x11804]
add esi, 0xe
cmp edi, 0xe
jl 0x100116b4
mov eax, dword [ebp - 0x11800]
inc eax
mov dword [ebp - 0x11800], eax
cmp eax, 0x10
jl 0x100116b2
mov byte [ebp - 0x42], 0x72
mov byte [ebp - 0x51], 0x6f
mov byte [ebp - 0x39], 0x55
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x2f], 0x61
call fcn.10011831
test al, al
jne 0x10011785
xor eax, eax
push 0x10b60
push eax
mov word [ebp - 0x10bb8], ax
lea eax, [ebp - 0x10bb6]
push eax
call fcn.10070e80
add esp, 0xc
xor edi, edi
xor esi, esi
mov ebx, 0xb9
xor edx, edx
test edi, edi
je 0x1001176b
test edx, edx
je 0x1001176b
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0x10d2a]
inc ax
add ax, word [ebp + ecx*2 - 0x10bba]
mov word [ebp + ecx*2 - 0x10bb8], ax
inc edx
cmp edx, ebx
jl 0x10011743
add esi, ebx
inc edi
cmp esi, 0x85b1
jl 0x10011741
movsx ebx, word [ebp - 0x58]
mov dword [0x100c97a0], ebx
mov byte [ebp - 0x3d], 0x65
call fcn.10011855
test al, al
jne 0x100117dd
movsd xmm3, qword [0x10090118]
movd xmm4, ebx
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x100117c3
subsd xmm2, xmm3
divsd xmm3, qword [0x10090120]
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x10090110]
ja 0x100117a5
mov ecx, dword [ebp - 0x11810]
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 0x2c], 0x61
mov byte [ebp - 0x4b], 0x6c
mov byte [ebp - 0x47], 0x5c
call fcn.1000158a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11810]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007048b
leave
ret
Function at 0x100167f9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x100907d4
push dword [ebp + 0xc]
call fcn.100735bb
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x1001681a
push 2
pop eax
jmp 0x100168d9
push ebx
push esi
push 2
push 0
push edi
call fcn.10073913
push edi
call fcn.10073ceb
mov esi, eax
push esi
call fcn.10071045
push 0
push 0
push edi
mov ebx, eax
call fcn.10073913
push edi
push esi
push 1
push ebx
call fcn.100737d8
push edi
call fcn.10073480
push esi
push ebx
push dword [ebp + 8]
call fcn.100168dc
add esp, 0x40
push ebx
call fcn.10017467
mov edi, eax
pop ecx
test edi, edi
jne 0x1001687a
test ebx, ebx
je 0x10016875
push ebx
call fcn.1007157a
pop ecx
push 8
pop eax
jmp 0x100168d7
push str.Install
push edi
call fcn.10017231
pop ecx
pop ecx
test eax, eax
je 0x1001689b
push dword [ebp + 0x10]
call eax
push edi
mov esi, eax
call fcn.100170df
pop ecx
jmp 0x100168d5
mov edx, dword [0x100c97a0]
push 0xc
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
pop esi
idiv esi
mov ecx, dword [0x100ca4f0]
mov eax, 0x26487f8f
cmp edx, 1
cmove ecx, eax
mov dword [0x100ca4f0], ecx
call dword [0x1008f0b8]
test eax, eax
cmovne esi, eax
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x10018784
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.10018c2f
test al, al
jne 0x100187c2
lea eax, [ebp - 0xc0]
push eax
call dword [0x1008f0ac]
lea eax, [ebp - 0xc4]
push eax
push 0x20
mov dword [ebp - 0xc4], ebx
call dword [0x1008f0fc]
push eax
call dword [0x1008f008]
test eax, eax
je 0x10018837
lea eax, [ebp - 0xcc]
push eax
push str.SeDebugPrivilege
push ebx
call dword [0x1008f048]
test eax, eax
je 0x10018837
mov eax, dword [ebp - 0xcc]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc8]
push ebx
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0xc4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [0x1008f004]
test eax, eax
jne 0x10018837
call dword [0x1008f0b8]
push dword [ebp - 0xc4]
call dword [0x1008f0c4]
mov ebx, dword [0x1008f0c8]
push str.Kernel32
call ebx
mov edi, dword [0x1008f0b4]
mov dword [esi + 4], eax
test eax, eax
je 0x10018882
push str.CreateToolhelp32Snapshot
push eax
call edi
push str.Process32First
push dword [esi + 4]
mov dword [esi + 8], eax
call edi
push str.Process32Next
push dword [esi + 4]
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
xor eax, eax
cmp dword [esi + 8], eax
je 0x10018893
cmp dword [esi + 0xc], eax
je 0x10018893
cmp dword [esi + 0x10], eax
jne 0x100188f9
cmp dword [esi + 4], eax
je 0x100188f9
call fcn.10018c4d
test al, al
jne 0x100188ba
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [0x1008f098]
xor eax, eax
push eax
push eax
call dword [0x1008f09c]
push str.ntdll.dll
call ebx
mov dword [esi], eax
test eax, eax
je 0x100188f9
push str.ZwQuerySystemInformation
push eax
call edi
push str.GetProcessHeap
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push str.HeapAlloc
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push str.HeapFree
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007048b
leave
ret
Function at 0x100201a0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.10070e80
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x10052100
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x10052119
mov esi, edi
mov edi, eax
jmp 0x1005211b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x1005212b
mov eax, ebx
jmp 0x10052135
push eax
push ebx
call fcn.100232f0
add esp, 8
test eax, eax
jne 0x1005213d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x10052159
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x10052144
cmp eax, dword [esi + 4]
jge 0x10052170
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x10052160
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x10052191
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x1005218e
dec eax
test eax, eax
jg 0x10052180
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x405830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x676122
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x71906c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xor eax, eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 7
mov word [edi + 4], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], al
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], 0xf
mov byte [edi + 0x34], al
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], 0xf
mov byte [edi + 0x4c], al
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], 0xf
mov byte [edi + 0x64], al
mov dword [edi + 0x8c], eax
mov dword [edi + 0x90], 0xf
mov byte [edi + 0x7c], al
lea esi, [edi + 0x94]
mov byte [ebp - 4], 5
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0042ddd1
add esp, 4
cmp dword [ebp + 8], 0
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
setne al
mov byte [edi], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40d1d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x676822
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x71906c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
call fcn.00428580
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x40d268
push eax
push esi
call fcn.004289ac
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x700ae0
lea ecx, [ebp - 0x1c]
call fcn.0040d190
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.0040d130
int3
Function at 0x40ffe0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x676b8f
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x71906c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x10], 0
je 0x410035
mov dword [edi], 0x700d54
mov dword [edi + 0x50], 0x691eac
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x691eb4
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ebx, dword [eax + 4]
add ebx, edi
mov ecx, ebx
call fcn.0040df00
lea eax, [edi + 4]
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 4], 2
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 3
push eax
call fcn.00411710
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx eax, ax
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 4
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
test eax, eax
je 0x4100bb
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
cmp dword [ebx + 0x38], 0
mov word [ebx + 0x40], ax
jne 0x4100dc
mov eax, dword [ebx + 0xc]
mov ecx, ebx
or eax, 4
push 0
push eax
call fcn.0040de70
mov dword [ebp - 4], 5
lea ebx, [edi + 4]
mov eax, dword [edi]
push 8
mov dword [ebp + 0xc], ebx
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x691f3c
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [ebx], 0x691ebc
call fcn.0042ddd1
mov esi, eax
push 1
mov byte [ebp - 4], 6
call fcn.004288a5
mov dword [esi + 4], eax
lea ecx, [ebx + 8]
lea eax, [ebx + 4]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
add esp, 8
lea eax, [ebx + 0x14]
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov ecx, eax
not ecx
mov dword [ebx], 0x691efc
and ecx, 1
mov dword [ebx + 0x38], 0
shl ecx, 2
mov edx, ecx
or edx, 8
and al, 8
cmove edx, ecx
mov ecx, dword [ebp + 8]
mov eax, edx
or eax, 0x10
and cl, 4
cmove eax, edx
mov dword [ebx + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x411110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6762b0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x71906c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x691ebc
call fcn.0042ddd1
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004288a5
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x677388
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x71906c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
push 0x10
push 0x70126c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00407210
mov dword [ebp - 4], 0
call fcn.00419e50
cmp dword [ebp - 0x14], 0x10
lea esi, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
mov edx, 0x811c9dc5
cmovae esi, ebx
mov dword [ebp - 0x2c], eax
mov edi, dword [eax + 4]
xor ecx, ecx
cmp dword [ebp - 0x18], ecx
jbe 0x417aa5
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x18]
jb 0x417a90
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x2c]
and eax, edx
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x30], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x34], eax
cmp edx, edi
jne 0x417aca
mov eax, edi
jmp 0x417ace
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x417b03
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 8]
push eax
call fcn.00419610
test al, al
je 0x417aed
mov esi, dword [esi]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
jmp 0x417ac2
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00419610
test al, al
mov ecx, edi
cmove ecx, esi
jmp 0x417b05
mov ecx, edi
cmp ecx, edi
je 0x417b47
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0041a5c0
mov eax, dword [ebp - 0x38]
mov esi, dword [eax + 0x20]
mov edi, dword [eax + 0x24]
cmp esi, edi
je 0x417b44
mov ebx, dword [ebp - 0x3c]
nop dword [eax]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x417b97
mov eax, dword [ecx]
push ebx
call dword [eax + 8]
add esi, 0x28
cmp esi, edi
jne 0x417b30
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x417b76
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x417b6c
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417b92
push ecx
push ebx
call fcn.0042dda0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042d755
mov esp, ebp
pop ebp
ret
call fcn.0050cafe
call fcn.00428367
int3