joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102c0580
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x102c05a3
and esi, 7
cmp esi, 7
jbe switch.0x102c06a2
mov ecx, edx
and ecx, 3
sub esi, ecx
cmp ecx, 1
je 0x102c05ec
cmp ecx, 2
je 0x102c05d7
cmp ecx, 3
jne 0x102c0601
movzx ecx, byte [edx]
add edx, 1
movzx edi, al
xor edi, ecx
shr eax, 8
xor eax, dword [edi*4 + 0x1038b810]
movzx ecx, byte [edx]
add edx, 1
movzx edi, al
xor edi, ecx
shr eax, 8
xor eax, dword [edi*4 + 0x1038b810]
movzx ecx, byte [edx]
add edx, 1
movzx edi, al
xor edi, ecx
shr eax, 8
xor eax, dword [edi*4 + 0x1038b810]
cmp esi, 8
jb 0x102c05a0
mov ebx, esi
sar ebx, 3
mov ecx, esi
and ecx, 0xfffffff8
mov dword [esp], ecx
xor ebp, ebp
nop word cs:[eax + eax]
nop
xor eax, dword [edx + ebp*8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1038b810]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1038b810]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1038b810]
movzx edi, al
mov ecx, dword [edx + ebp*8 + 4]
xor ecx, dword [edi*4 + 0x1038b810]
shr eax, 8
xor ecx, eax
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x1038b810]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x1038b810]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x1038b810]
movzx edi, cl
shr ecx, 8
mov eax, ecx
xor eax, dword [edi*4 + 0x1038b810]
add ebp, 1
cmp ebx, ebp
jne 0x102c0620
add edx, dword [esp]
jmp 0x102c05a0
jmp dword [esi*4 + 0x1038b7f0]
movzx ecx, byte [edx]
add edx, 1
movzx esi, al
xor esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x1038b810]
movzx ecx, byte [edx]
add edx, 1
movzx esi, al
xor esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x1038b810]
movzx ecx, byte [edx]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1038b810]
jmp case.0x102c06a2.0
movzx ecx, byte [edx]
add edx, 1
movzx esi, al
xor esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x1038b810]
movzx ecx, byte [edx]
add edx, 1
movzx esi, al
xor esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x1038b810]
movzx ecx, byte [edx]
add edx, 1
movzx esi, al
xor esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x1038b810]
xor eax, dword [edx]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1038b810]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1038b810]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1038b810]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1038b810]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102e4a60
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1041020c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x102e4bdc
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x102e4bc9
cmp dword [ebp - 0x28], 0x10
jb 0x102e4bad
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.1033d1b5
cmp dword [ebp - 0x1c], eax
jne 0x102e4bad
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.1033d1b5
cmp dword [ebp - 0x20], eax
je 0x102e4bad
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x102e4b34
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x10433b84]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.1033d1b5
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x102e4b32
jmp 0x102e4bc9
jmp 0x102e4b8d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x102e4b8d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x10433b84]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.1033d1b5
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x102e4b77
jmp 0x102e4bc9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x28], 0x1c
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x102e4ab3
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1033d1b5
push edx
mov ecx, ebp
push eax
lea edx, [0x102e4c08]
call fcn.1033d1d8
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1033bd36
add esp, 0x30
cmp ebp, esp
call fcn.1033d1b5
mov esp, ebp
pop ebp
ret
Function at 0x102e4c20
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.102e4a60
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x102e4ceb
mov dword [ebp - 4], 0
jmp 0x102e4c7c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x102e4ceb
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1033d1b5
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x102e4ce9
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1033d1b5
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.102e4880
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1033d1b5
jmp 0x102e4c73
pop esi
add esp, 8
cmp ebp, esp
call fcn.1033d1b5
mov esp, ebp
pop ebp
ret

Function at 0x102e4d00
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x102e4dab
mov dword [ebp - 4], 0
jmp 0x102e4d33
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x102e4d8e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1033d1b5
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x102e4d8c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1033d1b5
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1033d1b5
jmp 0x102e4d2a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x10433b84]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1033d1b5
pop esi
add esp, 8
cmp ebp, esp
call fcn.1033d1b5
mov esp, ebp
pop ebp
ret
Function at 0x102e4dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x10433b90]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x102e4e23
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1033d1b5
test eax, eax
jne 0x102e4e4e
mov eax, 0xa
jmp 0x102e4f50
cmp dword [ebp + 0xc], 0
je 0x102e4e9a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x102e4e98
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x102e4ed6
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x102e4ec1
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x102e4ed6
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1033d1b5
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1033d1b5
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.1033d1b5
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x102e4f74]
call fcn.1033d1d8
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.1033d1b5
mov esp, ebp
pop ebp
ret
Function at 0x102ed0d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1041020c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, 1
push ebx
mov dword [ebp - 0xc], eax
call fcn.102e7a80
add esp, 4
sub eax, edi
je 0x102ed1c0
dec eax
push edi
push ebx
mov dword [ebp - 0x10], eax
call fcn.102e7e20
add esp, 8
cmp eax, 3
jne 0x102ed190
push edi
push ebx
call fcn.102e7e00
add esp, 8
push 0
push edi
push ebx
test eax, eax
je 0x102ed143
call fcn.102e7ed0
push edx
push eax
push str._lld
push dword [ebp - 0xc]
call fcn.102e5b30
add esp, 0x1c
jmp 0x102ed15e
call fcn.102e7e60
add esp, 4
fstp qword [esp]
push str._.14g
push dword [ebp - 0xc]
call fcn.102e5b30
add esp, 0x10
test esi, esi
je 0x102ed166
test eax, eax
jg 0x102ed1b9
xor esi, esi
mov eax, dword [ebp - 0x10]
inc edi
test eax, eax
jne 0x102ed105
test esi, esi
jne 0x102ed1c0
push esi
push esi
push ebx
call fcn.102e6630
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1033bd36
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
push ebx
call fcn.102e5f60
add esp, 0xc
test esi, esi
je 0x102ed166
push dword [ebp - 0xc]
push dword [ebp - 8]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 8]
jne 0x102ed166
mov esi, 1
jmp 0x102ed168
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1033bd36
mov esp, ebp
pop ebp
ret
Function at 0x102eeb00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1041020c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push str._5_3
push esi
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x14]
push str._s_s
push edi
mov dword [ebp - 0x110], eax
call fcn.102e83b0
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x102eeb5f
push esi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x102eebc2
push str.LUA_NOENV
push 0xfff0b9d8
push edi
call fcn.102e8590
push 0xffffffffffffffff
push edi
call fcn.102e7f50
push 0xfffffffffffffffe
push edi
mov esi, eax
call fcn.102e7aa0
add esp, 0x1c
test esi, esi
jne 0x102eebc2
push 0x103af860
push 0x103af85c
push ebx
push edi
call fcn.102e6b40
push dword [ebp - 0x110]
push 0x103b00ec
push eax
push edi
call fcn.102e6b40
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.102e7b30
push 0xfffffffffffffffe
push edi
call fcn.102e7aa0
add esp, 0x34
jmp 0x102eebd1
push dword [ebp - 0x110]
push edi
call fcn.102e8310
add esp, 8
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x102eec3f
cmp eax, 0x105
je 0x102eec3f
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x102eec3f
mov byte [eax], 0
lea eax, [ebp - 0x10c]
push eax
push 0x103affb0
push 0
push 0xffffffffffffffff
push edi
call fcn.102e7f80
add esp, 0xc
push eax
push edi
call fcn.102e6b40
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.102e7b30
push 0xfffffffffffffffe
push edi
call fcn.102e7aa0
add esp, 0x24
jmp 0x102eec4d
push str.unable_to_get_ModuleFileName
push edi
call fcn.102e64f0
add esp, 8
push dword [ebp - 0x114]
push 0xfffffffffffffffd
push edi
call fcn.102e8920
push 0xfffffffffffffffe
push edi
call fcn.102e7aa0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1033bd36
mov esp, ebp
pop ebp
ret
Function at 0x10326200
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x1c]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
movzx ebx, word [eax]
mov eax, dword [esp + 0x18]
mov ebp, dword [ebp]
mov dword [esp + 8], ebp
cmp ebp, eax
jb 0x10326227
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
sub eax, ebp
push esi
mov esi, dword [esp + 0x24]
cmp esi, eax
cmova esi, eax
xor edx, edx
mov dword [esp + 0x24], esi
test esi, esi
je 0x10326277
push edi
mov edi, dword [esp + 0x24]
sub ebp, edi
movzx eax, byte [edi + ebp]
lea edi, [edi + 1]
mov edx, ebx
mov ecx, 0x58bf
shr edx, 8
xor edx, eax
add eax, ebx
imul eax, eax, 0x3193
mov byte [edi - 1], dl
sub ecx, eax
movzx ebx, cx
sub esi, 1
jne 0x10326244
mov esi, dword [esp + 0x28]
mov edx, esi
mov ebp, dword [esp + 0x10]
pop edi
mov eax, dword [esp + 0x18]
lea ecx, [esi + ebp]
pop esi
pop ebp
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov word [eax], bx
mov eax, edx
pop ebx
add esp, 8
ret
Function at 0x10337af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x1041020c]
xor eax, esp
mov dword [esp + 0x1a0], eax
mov eax, dword [esp + 0x1b4]
mov edx, dword [esp + 0x1a8]
push ebx
push ebp
mov ecx, dword [eax]
mov ebp, dword [eax + 4]
mov ebx, dword [edx + 0x78]
shl ecx, 2
mov dword [esp + 8], ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1b8]
push esi
push edi
shl ebp, 2
lea esi, [esp + 0x28]
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov ecx, dword [esp + 0x1bc]
shl eax, 2
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ebp
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
shl eax, 2
mov dword [esp + 0x38], eax
mov eax, dword [edx + 0x74]
mov dword [esp + 0x40], eax
mov eax, ebp
sar eax, 8
mov dword [esp + 0x2c], ebp
mov ebp, dword [edx + 0x54]
shl edi, 2
shl ecx, 2
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x14], eax
cmp eax, ebp
jl 0x10337ba6
mov eax, edi
sar eax, 8
cmp eax, ebp
jl 0x10337ba6
mov eax, ecx
sar eax, 8
cmp eax, ebp
jl 0x10337ba6
mov eax, ebx
sar eax, 8
cmp eax, ebp
jge 0x10337bc4
mov eax, dword [edx + 0x50]
cmp dword [esp + 0x14], eax
jge 0x10337bf0
sar edi, 8
cmp edi, eax
jge 0x10337bf0
sar ecx, 8
cmp ecx, eax
jge 0x10337bf0
sar ebx, 8
cmp ebx, eax
jge 0x10337bf0
mov eax, dword [esp + 0x10]
mov dword [edx + 0x74], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 0x78], eax
mov ecx, dword [esp + 0x1b0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1033bd36
add esp, 0x1a4
ret
mov ebp, dword [esi + 0x18]
lea eax, [esi + 0x18]
sub ebp, dword [esi]
mov ebx, dword [esi + 0x1c]
sub ebx, dword [esi + 4]
mov dword [esp + 0x24], eax
mov eax, ebp
cdq
mov ecx, eax
mov dword [esp + 0x10], ebx
xor ecx, edx
mov eax, ebx
sub ecx, edx
cdq
mov edi, eax
xor edi, edx
sub edi, edx
cmp ecx, edi
jle 0x10337c26
lea eax, [edi + edi*2]
sar eax, 3
add eax, ecx
jmp 0x10337c2e
lea eax, [ecx + ecx*2]
sar eax, 3
add eax, edi
cmp eax, 0x7fff
jg 0x10337ce1
mov ecx, dword [esi + 0xc]
sub ecx, dword [esi + 4]
imul edi, eax, 0x2a
mov eax, dword [esi + 8]
sub eax, dword [esi]
mov dword [esp + 0x14], eax
imul eax, ebx
mov dword [esp + 0x1c], ecx
imul ecx, ebp
mov dword [esp + 0x18], edi
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, edi
jg 0x10337ce1
mov edi, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
sub edi, dword [esi]
sub ebx, dword [esi + 4]
mov eax, edi
imul eax, dword [esp + 0x10]
mov ecx, ebx
imul ecx, ebp
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [esp + 0x18]
jg 0x10337ce1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
sub eax, ebp
imul eax, dword [esp + 0x14]
sub ecx, edx
imul ecx, dword [esp + 0x1c]
add ecx, eax
test ecx, ecx
jg 0x10337ce1
mov ecx, ebx
mov eax, edi
sub ecx, edx
sub eax, ebp
imul ecx, ebx
imul eax, edi
add ecx, eax
test ecx, ecx
jg 0x10337ce1
push dword [esi + 4]
push dword [esi]
push dword [esp + 0x28]
call fcn.10337570
lea eax, [esp + 0x34]
add esp, 0xc
cmp esi, eax
je 0x10337bd2
sub esi, 0x18
jmp 0x10337bf0
push esi
call fcn.10337a20
mov esi, dword [esp + 0x28]
add esp, 4
jmp 0x10337bf0
Function at 0x1033cb70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x10433f3c]
mov dword [ebp - 4], eax
jmp 0x1033cb97
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1033cbb0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1033cbae
mov eax, dword [ebp - 4]
jmp 0x1033cc34
jmp 0x1033cb8f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1033d1b5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1033cc31
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x1033cbf3
mov edx, dword [ebp - 4]
mov eax, dword [0x10433f3c]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10433f3c], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.1033d1b5
mov esp, ebp
pop ebp
ret

Function at 0x1033d120
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x1033d170
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x1033d170
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x1033d170
xor eax, eax
jmp 0x1033d1b1
mov dword [ebp - 4], 1
jmp 0x1033d182
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1033d1ac
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x1033d1aa
xor eax, eax
jmp 0x1033d1b1
jmp 0x1033d179
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1033e890
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x1041020c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push esi
call fcn.1033f490
mov edx, eax
add esp, 8
test edx, edx
je 0x1033e8f1
mov ecx, dword [ebp - 0xd8]
sub edx, esi
mov dword [ebx], ecx
mov eax, 0x13
mov ecx, dword [ebp - 0xd4]
pop edi
mov dword [ebx + 4], ecx
mov dword [ebx + 8], eax
lea eax, [edx + 1]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1033bd36
mov esp, ebp
pop ebp
ret
push str..xXnN
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x1033e922
movzx edi, byte [eax]
or edi, 0x20
cmp edi, 0x6e
jne 0x1033e924
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1033bd36
mov esp, ebp
pop ebp
ret
xor edi, edi
push edi
lea eax, [ebp - 0xe4]
push eax
push esi
call fcn.1033f400
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x1033e9de
push 0x2e
push esi
call sub.VCRUNTIME140.dll_strchr
mov edx, esi
mov dword [ebp - 0xd4], eax
add esp, 8
lea ecx, [edx + 1]
mov dword [ebp - 0xdc], ecx
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1033e960
sub edx, dword [ebp - 0xdc]
cmp edx, 0xc8
ja 0x1033e90f
test eax, eax
je 0x1033e90f
lea edx, [ebp - 0xd0]
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1033e983
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
mov ecx, dword [ebp - 0xd4]
sub ecx, esi
push edi
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + ecx - 0xd0], al
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.1033f400
mov edx, eax
add esp, 0xc
test edx, edx
je 0x1033e90f
mov eax, esi
lea ecx, [ebp - 0xd0]
sub eax, ecx
add edx, eax
test edx, edx
je 0x1033e90f
movsd xmm0, qword [ebp - 0xe4]
sub edx, esi
mov ecx, dword [ebp - 4]
mov eax, 3
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov dword [ebx + 8], eax
lea eax, [edx + 1]
pop esi
pop ebx
call fcn.1033bd36
mov esp, ebp
pop ebp
ret