joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a12dd
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1007c0ad
mov edi, eax
add esp, 4
test edi, edi
je 0x100150e2
push 1
mov dword [ebp - 4], 0
call fcn.1007ae2b
add esp, 4
mov dword [edi + 4], eax
jmp 0x100150e4
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
push ebx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.1000fe30
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x10015140
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10015140
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
pop ebx
jne 0x1001515d
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1001517e
cmp byte [ebp + 0xc], 0
je 0x1001516c
push esi
call fcn.1007b812
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1001518a
mov esi, str.ios_base::badbit_set
jmp 0x1001519a
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10015950
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10010620
push 0x100e7ef8
lea eax, [ebp - 0x28]
push eax
call fcn.1007d847
int3
Function at 0x10015c40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1375
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, dword [0x100efd94]
mov dword [ebp - 4], 1
test esi, esi
jne 0x10015d2c
mov eax, dword fs:[0x30]
push ebx
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov dword [ebp - 0x14], ecx
nop dword [eax + eax]
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp eax, ecx
je 0x10015d0c
mov edi, dword [eax + 0x18]
test edi, edi
je 0x10015d0c
mov eax, dword [eax + 0x20]
lea eax, [eax + edi*4]
add eax, ecx
sub eax, 4
dec edi
mov dword [ebp - 0x1c], eax
mov esi, 0x6d309ac5
mov eax, dword [eax]
add eax, ecx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x10015d02
nop dword [eax]
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x10015cd0
cmp esi, 0x9aac5e84
je 0x10015db5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
test edi, edi
jne 0x10015cb5
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
cmp ecx, edx
je 0x10015d22
cmp dword [ecx + 0x18], 0
jne 0x10015c90
xor esi, esi
pop edi
mov dword [0x100efd94], esi
pop ebx
cmp dword [ebp + 0x34], 0xf
lea ecx, [ebp + 0x20]
push 0
cmova ecx, dword [ebp + 0x20]
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0xf
push ecx
cmova eax, dword [ebp + 8]
push eax
push 0
call esi
mov ecx, dword [ebp + 0x1c]
pop esi
cmp ecx, 0xf
jbe 0x10015d7b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10015d71
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015ded
push ecx
push edx
call fcn.1007c0dd
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0xf
jbe 0x10015ddf
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10015dd5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015ded
jmp 0x10015dd5
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
jmp 0x10015d24
push ecx
push edx
call fcn.1007c0dd
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.1008173f
int3
Function at 0x100201b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x100f036c]
sub esp, 0x1c
mov eax, dword [edx + 0x3e1aa]
mov ecx, dword [eax]
mov eax, dword [edx + 0x3e1ae]
mov eax, dword [ecx + eax + 0x50]
test eax, eax
je 0x10020340
push edi
lea edi, [eax + 4]
mov dword [ebp - 0x1c], edi
cmp edi, 0x1000
jb 0x1002033f
push ebx
mov ebx, dword [edi]
push esi
mov esi, dword [0x100efedc]
mov dword [ebp - 0x18], ebx
cmp ebx, esi
je 0x1002033d
test esi, esi
jne 0x1002033b
cmp dword [0x100efee0], esi
jne 0x10020239
nop
push 1
lea eax, [esi + ebx]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 1]
push eax
call fcn.10076fa0
add esp, 0xc
test al, al
je 0x10020239
inc dword [0x100efee0]
inc esi
cmp esi, 0x10000
jl 0x10020210
mov eax, dword [0x100efee8]
test eax, eax
jne 0x100202f6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x10], ecx
cmp ecx, ebx
je 0x100202c9
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x100202c9
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [ebp - 0xc], ecx
mov edi, 0x8da00a68
mov dword [ebp - 8], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x100202bf
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x10020291
cmp edi, 0xca477508
je 0x100202cd
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x10020277
mov eax, dword [eax]
jmp 0x10020252
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov eax, dword [esi + 0x24]
mov edi, dword [ebp - 0x1c]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x100efee8], eax
push 0x40
push 0x3000
push dword [0x100efee0]
push 0
call eax
mov esi, eax
mov dword [0x100efedc], esi
test esi, esi
je 0x1002033d
push dword [0x100efee0]
push ebx
push esi
call fcn.1007dc70
add esp, 0xc
cmp dword [0x100efde8], 0
jne 0x10020334
mov eax, dword [esi + 0x20]
mov dword [0x100efde8], eax
mov dword [esi + 0x20], 0x100184f0
mov dword [edi], esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10024f00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1a90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 4]
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1007c0ad
mov edi, eax
add esp, 4
test edi, edi
je 0x10024fa3
push 1
mov dword [ebp - 4], 0
call fcn.1007ae2b
add esp, 4
mov dword [edi + 4], eax
jmp 0x10024fa5
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.10011aa0
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi + 0x1c], ecx
lea edi, [esi + 0x24]
mov dword [esi + 0x2c], edi
lea edx, [esi + 0x18]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea ebx, [esi + 0x28]
mov dword [esi + 0x30], ebx
mov byte [esi + 0x48], 0
mov byte [esi + 0x3d], 0
mov dword [esi + 0x20], edx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x100efda8]
mov ecx, dword [0x100efdac]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [esi + 0x38], 0
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10026ce0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a1c25
push eax
mov dword fs:[0], esp
sub esp, 0x44
push esi
push edi
mov edi, dword [0x100efd98]
test edi, edi
jne 0x10026dc4
mov eax, dword fs:[0x30]
push ebx
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x14], eax
mov edx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp eax, ecx
je 0x10026da3
mov edi, dword [eax + 0x18]
test edi, edi
je 0x10026da3
mov eax, dword [eax + 0x20]
lea eax, [eax + edi*4]
add eax, ecx
nop dword [eax]
sub eax, 4
dec edi
mov dword [ebp - 0x1c], eax
mov esi, 0x4518ba8a
mov eax, dword [eax]
add eax, ecx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x10026d99
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x10026d67
cmp esi, 0xd8d0b16d
je 0x10026e74
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
test edi, edi
jne 0x10026d50
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp eax, edx
je 0x10026dbb
cmp dword [ecx + 0x18], 0
jne 0x10026d24
xor edi, edi
mov dword [0x100efd98], edi
pop ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x50]
push eax
call fcn.1000fca0
cmp dword [ebp - 0x3c], 0xf
lea eax, [ebp - 0x38]
push dword [ebp + 8]
lea esi, [ebp - 0x50]
mov dword [ebp - 4], 0
cmova esi, dword [ebp - 0x50]
push eax
call fcn.1000fca0
add esp, 0x10
cmp dword [ebp - 0x24], 0xf
lea eax, [ebp - 0x38]
push 0
cmova eax, dword [ebp - 0x38]
push esi
push eax
push 0
mov byte [ebp - 4], 1
call edi
mov ecx, dword [ebp - 0x24]
pop edi
pop esi
cmp ecx, 0xf
jbe 0x10026e3a
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10026e30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10026ead
push ecx
push edx
call fcn.1007c0dd
add esp, 8
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
cmp ecx, 0xf
jbe 0x10026e9f
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10026e95
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10026ead
jmp 0x10026e95
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add eax, dword [edx + 0x18]
add ecx, dword [edx + 0x18]
movzx eax, word [eax + edi*2]
mov edi, dword [ecx + eax*4]
add edi, dword [edx + 0x18]
jmp 0x10026dbd
push ecx
push edx
call fcn.1007c0dd
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.1008173f
int3
Function at 0x10065360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
call fcn.1006f6e0
mov esi, dword [eax]
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
jne 0x100654f0
mov eax, dword [esi + 0x10]
mov ebx, 0x16
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x10], eax
call fcn.1006f930
mov ecx, eax
xorps xmm0, xmm0
mov edi, ecx
mov dword [ebp - 0xc], ecx
movups xmmword [ebp - 0x28], xmm0
lea edx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x100653a0
sub edi, edx
cmp edi, 0x7fffffff
ja 0x100654fe
cmp edi, 0xf
ja 0x100653e2
push edi
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], edi
push eax
mov dword [ebp - 0x14], 0xf
call fcn.1007dc70
mov byte [ebp + edi - 0x28], 0
add esp, 0xc
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], ebx
jmp 0x1006542d
mov eax, edi
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x100653f5
mov eax, 0x7fffffff
jmp 0x100653fb
cmp eax, 0x16
cmovb eax, ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10001a30
mov ebx, eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 4]
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], ebx
push ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], eax
call fcn.1007dc70
add esp, 0x14
mov byte [ebx + edi], 0
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edx, 0x811c9dc5
cmova eax, ebx
mov dword [ebp - 4], edx
xor ecx, ecx
mov dword [ebp - 0xc], eax
test edi, edi
je 0x10065467
mov ebx, eax
nop word [eax + eax]
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10065450
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x10065496
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x1006548c
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100654f9
push ecx
push ebx
call fcn.1007c0dd
add esp, 8
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
je 0x100654e6
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x100654c7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100654c0
cmp esi, dword [eax + 8]
jne 0x100654c0
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100654b0
mov esi, eax
jmp 0x10065372
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x10065372
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x100654d5
jmp 0x10065372
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1008173f
call fcn.1000c150
int3
Function at 0x1006db00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x100f0ab0]
sub esp, 0x14
push ebx
test ecx, ecx
jne 0x1006dbc8
mov eax, dword fs:[0x30]
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 4], eax
mov edx, eax
mov dword [ebp - 8], ecx
nop
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0xc], ecx
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov dword [ebp - 0x14], eax
cmp eax, ecx
je 0x1006dba8
mov edi, dword [eax + 0x18]
test edi, edi
je 0x1006dba8
mov eax, dword [eax + 0x20]
lea eax, [eax + edi*4]
add eax, ecx
sub eax, 4
dec edi
mov dword [ebp - 0x10], eax
mov esi, 0x51d47c76
mov eax, dword [eax]
add eax, ecx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x1006db9e
nop dword [eax]
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x1006db70
cmp esi, 0x2cb82bc3
je 0x1006dbec
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test edi, edi
jne 0x1006db55
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp ecx, edx
je 0x1006dbbe
cmp dword [ecx + 0x18], 0
jne 0x1006db30
xor ecx, ecx
pop edi
mov dword [0x100f0ab0], ecx
pop esi
mov bl, byte [ebp + 8]
movzx eax, bl
push eax
mov eax, dword [0x100f036c]
push dword [eax + 0x3bc56]
call ecx
xor bl, 1
mov byte [0x100f0a9a], bl
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
add ecx, edx
jmp 0x1006dbc0
Function at 0x10072060
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword [0x100f036c]
sub esp, 0x38
push esi
push edi
mov dword [eax + 0xe], 0x61
call fcn.10072430
test al, al
je 0x10072115
mov eax, dword [0x100f036c]
mov eax, dword [eax + 0x3e116]
test eax, eax
jne 0x100721d9
mov dword [ebp - 0x28], 0x82b629a3
mov dword [ebp - 0x24], 0x92221139
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0xb563e00e
mov dword [ebp - 0x24], 0xbbeeaa18
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0xe7d846cd
mov dword [ebp - 0x24], 0x92221139
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0xb563e00e
mov dword [ebp - 0x24], 0xbbeeaa18
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [0x100f0b68]
test eax, eax
jne 0x100721d9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 0xc], ecx
nop word [eax + eax]
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov dword [ebp - 0x24], eax
cmp eax, ecx
je 0x100721bc
mov edi, dword [eax + 0x18]
test edi, edi
je 0x100721bc
mov eax, dword [eax + 0x20]
lea eax, [eax + edi*4]
add eax, ecx
sub eax, 4
dec edi
mov dword [ebp - 0x14], eax
mov esi, 0x4d46c031
mov eax, dword [eax]
add eax, ecx
mov cl, byte [eax]
inc eax
test cl, cl
je 0x100721af
nop dword [eax]
movsx edx, cl
lea eax, [eax + 1]
sub cl, 0x41
mov byte [ebp - 1], cl
mov ecx, edx
or ecx, 0x20
cmp byte [ebp - 1], 0x19
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [eax - 1]
test cl, cl
jne 0x10072180
cmp esi, 0xf9818599
je 0x100721ea
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
test edi, edi
jne 0x10072165
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
cmp ecx, edx
je 0x100721d2
cmp dword [ecx + 0x18], 0
jne 0x10072140
xor eax, eax
mov dword [0x100f0b68], eax
push dword [ebx + 8]
call eax
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov esi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x100721d4
Function at 0x10072430
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100f0b24]
sub esp, 0x14
test eax, eax
je 0x10072449
cmp eax, 1
sete al
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100f0b5c]
test eax, eax
jne 0x10072539
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 4], eax
mov edx, eax
mov dword [ebp - 8], ecx
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0xc], ecx
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov dword [ebp - 0x14], eax
cmp eax, ecx
je 0x100724e8
mov edi, dword [eax + 0x18]
test edi, edi
je 0x100724e8
mov eax, dword [eax + 0x20]
lea eax, [eax + edi*4]
add eax, ecx
sub eax, 4
dec edi
mov dword [ebp - 0x10], eax
mov esi, 0x186b0da3
mov eax, dword [eax]
add eax, ecx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x100724de
nop dword [eax]
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x100724b0
cmp esi, 0x6574201f
je 0x1007251c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test edi, edi
jne 0x10072496
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp ecx, edx
je 0x100724fe
cmp dword [ecx + 0x18], 0
jne 0x10072471
xor eax, eax
mov dword [0x100f0b5c], eax
pop edi
pop esi
pop ebx
test eax, eax
jne 0x10072539
mov dword [0x100f0b24], 1
mov al, 1
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x10072500
mov dword [0x100f0b24], 2
xor al, al
mov esp, ebp
pop ebp
ret