joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100357bc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100c45b7
call fcn.100c0df0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d0c80
mov dword [esi + 4], 0x100d0c70
lea ecx, [esi + 0x158]
mov dword [ebp - 4], 0xf
call fcn.100be260
mov eax, dword [esi + 0x804]
test eax, eax
je 0x100357fc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x7f8]
call fcn.100032e0
mov eax, dword [esi + 0x154]
pop ecx
test eax, eax
mov byte [ebp - 4], 0xd
je 0x1003581c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x14c]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x10035830
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x144]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x10035844
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x13c]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x10035858
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x120]
call fcn.100032e0
push dword [esi + 0x114]
call fcn.100032e0
push dword [esi + 0x108]
call fcn.100032e0
mov eax, dword [esi + 0xf4]
add esp, 0xc
test eax, eax
mov byte [ebp - 4], 6
je 0x10035890
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x7c]
call fcn.100032e0
pop ecx
mov byte [ebp - 4], 4
lea ecx, [esi + 0x5c]
call fcn.100358e1
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 3
call fcn.100358e1
push dword [esi + 0x30]
call fcn.100032e0
push dword [esi + 0x24]
call fcn.100032e0
push dword [esi + 0x18]
call fcn.100032e0
push dword [esi + 0xc]
call fcn.100032e0
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x1003aeae
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100c49cc
call fcn.100c0df0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10001d16
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.10001d16
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x28]
mov byte [esi + 0x28], al
mov al, byte [edi + 0x29]
mov byte [esi + 0x29], al
mov al, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
mov al, byte [edi + 0x2b]
mov byte [esi + 0x2b], al
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1003bfb1
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100c4b1d
call fcn.100c0df0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100cb96c
mov dword [esi + 4], 0x100cb750
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.10002417
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov dword [esi], 0x100d1970
mov dword [esi + 4], 0x100d1960
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1003c047
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x100c4b3e
call fcn.100c0df0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [esi + 0x30]
mov dword [ebp - 4], 1
call fcn.100032e0
pop ecx
lea ecx, [esi + 0x24]
call fcn.1001a35e
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.1003c1bd
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.1003c130
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1004065b
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100c4ff9
call fcn.100c0df0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov byte [esi], al
mov byte [esi + 1], al
mov byte [esi + 2], al
mov byte [esi + 3], al
mov byte [esi + 4], al
mov byte [esi + 5], al
mov byte [esi + 6], al
mov byte [esi + 7], al
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.100403e7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x100411b7
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100c5132
call fcn.100c0df0
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10001cba
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10001cba
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10001cba
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10001cba
or dword [esi + 0x7c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x64], bl
mov byte [esi + 0x65], bl
mov byte [esi + 0x66], bl
mov byte [esi + 0x67], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1004273b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100c52ce
call fcn.100c0df0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10001d16
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10001d16
mov eax, dword [esi + 0x18]
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.10001d16
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
mov byte [ebp - 4], 2
call fcn.10001d16
mov al, byte [esi + 0x64]
push 5
mov byte [ebx + 0x64], al
mov al, byte [esi + 0x65]
mov byte [ebx + 0x65], al
mov al, byte [esi + 0x66]
mov byte [ebx + 0x66], al
mov al, byte [esi + 0x67]
mov byte [ebx + 0x67], al
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x7c], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1004d9ae
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100c606c
call fcn.100c0df0
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10081ce4
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.10048963
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.10048963
lea edi, [esi + 0xc0]
mov byte [ebp - 4], 0xa
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.10048963
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 0xb
call fcn.10048963
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 0xc
call fcn.10048963
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10052713
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x1005276f
cmp word [ecx], 0x5a4d
jne 0x1005276f
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x1005276f
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x1005276f
test al, 7
jne 0x1005276f
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1005276f
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x10052789
sub ecx, 0x74
je 0x10052782
dec ecx
dec ecx
je 0x10052782
dec ecx
dec ecx
je 0x1005277b
sub ecx, 0x3c
je 0x10052774
sub ecx, 0x8464
je 0x10052789
xor eax, eax
ret 4
mov ecx, 0x3030401
jmp 0x1005278e
mov ecx, 0x3030701
jmp 0x1005278e
mov ecx, 0x3030501
jmp 0x1005278e
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x1005276f
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x100527a8
cmp eax, 0x20b
jne 0x1005276f
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x10052771

Function at 0x10056ad1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x10056af0
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x10056adf
pop edi
cmp esi, 4
jb 0x10056afa
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x10056b0b
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x10056b17
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x10056b21
movzx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x10062ea6
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [ecx + 0x3c]
cmp edx, 2
jge 0x10062ebf
cmp byte [ecx + 0x42], 0
mov eax, dword [esp + 4]
je 0x10062f24
cmp eax, 0x3f
jb 0x10062f24
jmp 0x10062f13
mov eax, dword [esp + 4]
cmp eax, 0x2c
jb 0x10062f24
cmp edx, 3
jl 0x10062ed7
cmp eax, 0x2c
jne 0x10062ed6
push 0x48
jmp 0x10062f23
dec eax
cmp edx, 4
jl 0x10062ee6
cmp eax, 0x2c
jne 0x10062ee5
push 0x49
jmp 0x10062f23
dec eax
cmp eax, 0x3a
jb 0x10062f24
cmp byte [ecx + 0x14], 0
je 0x10062f05
cmp eax, 0x3a
jne 0x10062efa
push 0x44
jmp 0x10062f23
cmp eax, 0x3b
jne 0x10062f03
push 0x45
jmp 0x10062f23
dec eax
dec eax
cmp eax, 0x3f
jb 0x10062f1c
cmp byte [ecx + 0x42], 0
je 0x10062f1c
cmp eax, 0x3f
jne 0x10062f19
push 0x46
jmp 0x10062f23
dec eax
jmp 0x10062f24
cmp eax, 0x44
jne 0x10062f24
push 0x47
pop eax
ret 4

Function at 0x10064378
Capabilities:
Parse pe header

Disassembly:
cmp edx, 2
jb 0x100643bc
cmp byte [ecx], 0x4d
jne 0x100643bc
cmp byte [ecx + 1], 0x5a
jne 0x100643bc
cmp edx, 0x40
jb 0x100643bc
mov eax, dword [ecx + 0x3c]
cmp eax, 0x40
jb 0x100643bc
cmp eax, 0x1000
ja 0x100643bc
test al, 7
jne 0x100643bc
push esi
lea esi, [eax + 0x18]
cmp esi, edx
pop esi
ja 0x100643bc
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100643bc
cmp word [ecx + 0x14], 0x60
sbb eax, eax
inc eax
ret
xor al, al
ret

Function at 0x100644f3
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100c7247
call fcn.100c0df0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi + 0x24], 0xffffffff
lea ecx, [esi + 0x30]
mov byte [esi], 1
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ebx
call fcn.10001cba
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.10002417
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10064650
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100c72db
call fcn.100c0df0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10001cba
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.10002417
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.100646f1
lea eax, [esi + 0xb0]
mov dword [eax], edi
mov dword [eax + 4], edi
lea ecx, [esi + 0xd0]
mov byte [ebp - 4], 6
call fcn.10001cba
lea ecx, [esi + 0xdc]
mov byte [ebp - 4], 7
call fcn.10001cba
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xe8]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea eax, [esi + 0xf4]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10068044
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100c771f
call fcn.100c0df0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x38]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ax, word [edi + 0x30]
mov word [esi + 0x30], ax
mov al, byte [edi + 0x32]
mov byte [esi + 0x32], al
mov al, byte [edi + 0x33]
mov byte [esi + 0x33], al
mov al, byte [edi + 0x34]
mov byte [esi + 0x34], al
mov al, byte [edi + 0x35]
mov byte [esi + 0x35], al
mov al, byte [edi + 0x36]
mov byte [esi + 0x36], al
lea eax, [edi + 0x38]
push eax
call fcn.10001d16
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
push eax
lea ecx, [esi + 0x44]
call fcn.1000247d
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov ax, word [edi + 0x64]
mov word [esi + 0x64], ax
mov ax, word [edi + 0x66]
mov word [esi + 0x66], ax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1006c632
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100c7ace
call fcn.100c0df0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100cb96c
mov dword [esi + 4], 0x100cdf3c
mov dword [esi + 8], 0x100d25c8
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
call fcn.10002417
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 5
call fcn.10035900
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100d3960
mov dword [esi + 4], 0x100d3944
mov dword [esi + 8], 0x100d3934
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1006caa4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100c7b7f
call fcn.100c0df0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov al, byte [edi + 8]
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.10001d16
mov eax, dword [edi + 0x1c]
and dword [ebp - 4], 0
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
lea eax, [edi + 0x34]
push eax
lea ecx, [esi + 0x34]
call fcn.10015c7b
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x100720f5
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, ecx
test esi, esi
mov ecx, edx
jbe 0x10072124
push ebx
push edi
movzx edi, byte [ecx]
movzx edx, ax
shr edx, 8
xor edx, edi
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x100e7d18]
xor ax, bx
inc ecx
dec esi
jne 0x10072104
pop edi
pop ebx
pop esi
ret 4
Function at 0x10073dfe
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100c82ae
call fcn.100c0df0
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x18]
lea edi, [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebp - 0x10], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x24]
lea edi, [ebx + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov cl, byte [eax + 0x30]
add eax, 0x34
mov byte [ebx + 0x30], cl
push eax
lea ecx, [ebx + 0x34]
call fcn.10015c7b
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebx + 0x3c]
lea eax, [esi + 0x3c]
push eax
call fcn.10073ecf
add esi, 0x48
lea ecx, [ebx + 0x48]
push esi
mov byte [ebp - 4], 1
call fcn.1008a3cc
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1007ad48
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
add ecx, 0x18
jmp fcn.100bb480

Function at 0x1007b083
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x100c8811
call fcn.100c0df0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x40]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
lea eax, [edi + 0x40]
push eax
call fcn.1000247d
and dword [ebp - 4], 0
lea eax, [edi + 0x4c]
push eax
lea ecx, [esi + 0x4c]
call fcn.1000247d
mov eax, dword [edi + 0x58]
lea ecx, [esi + 0x64]
mov dword [esi + 0x58], eax
mov al, byte [edi + 0x5c]
mov byte [esi + 0x5c], al
mov al, byte [edi + 0x5d]
mov byte [esi + 0x5d], al
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
lea eax, [edi + 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.1007b431
add edi, 0x70
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 2
call fcn.10015c7b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4