joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1ce0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.004f1cc0
push ebp
push 0x415030
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4f1d33
jmp 0x4f1db0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.0047b860
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.0047b7b0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.0047bf70
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.0047d420
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4f1e07
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.004f1ca0
push ebp
push 0x415030
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004f1ca0
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004f1cc0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51d420
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x51d43b
jmp 0x51d448
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x51d450
jmp 0x51d458
jmp 0x51d50a
xor eax, eax
push 0x51d4e7
push ebp
push 0x4153b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov edx, 0
call fcn.0040d490
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x51d4c9
jmp 0x51d4dc
cmp dword [ebp - 8], 0
jne 0x51d4d1
jmp 0x51d4dc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x51d50a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x560cc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00560ca0
push ebp
push 0x415030
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040aad0
cmp dword [ebp - 0xc], 0
jg 0x560d0c
jmp 0x560d2c
mov eax, dword [ebp - 0xc]
lea eax, [eax + 1]
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x560d1f
mov eax, 0x61f2f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
nop
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040aad0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040b400
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x560d55
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x560d61
mov eax, 0x61f2f0
call fcn.0043f520
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00560ca0
mov esp, ebp
pop ebp
ret
Function at 0x5623a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x608460
call fcn.0040eba0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00562390
push ebp
push 0x415030
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x34]
mov edx, 0
call fcn.00408b70
mov eax, dword [ebp - 0xc]
mov edx, fcn.004ee880
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dx, 0
call fcn.004094c0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x30]
call fcn.00408b70
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00560330
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00562a30
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
je 0x5624a5
jmp 0x5624c4
mov eax, dword [ebp - 4]
call fcn.00510cc0
test al, al
je 0x5624b3
jmp 0x5624c4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00562390
mov esp, ebp
pop ebp
ret
Function at 0x57ea90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x57eab4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x57eb9a
mov esi, esi
xor eax, eax
push 0x57eb7b
push ebp
push 0x4153b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
mov word [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 8]
mov word [eax + 0x14], 0x1010
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x1c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x28], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x57eb70
cmp dword [ebp - 4], 0
je 0x57eb70
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x57eb9a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5941a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x5941e0
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jne 0x5941c8
call fcn.0040f4d0
mov edx, 0x619d40
mov edi, ebx
mov eax, edi
call fcn.00404410
mov eax, esi
call dword [edi + 0x34]
mov dword [ebp - 0xc], eax
mov esi, esi
cmp dword [ebp - 0xc], 0
je 0x594382
mov esi, esi
xor eax, eax
push 0x594363
push ebp
push 0x4153b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040d490
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
add eax, 0x54
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x58
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
add eax, 0x18
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x50], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1c], 0
mov eax, dword [ebp - 0xc]
add eax, 0x20
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x24
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x28
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x2c
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x44
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x40
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x48
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x4c
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x30
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x34
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x38
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x3c
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x5c
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x60
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
add eax, 0x64
xor edx, edx
call fcn.00408b70
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x68], 0xffffffff
mov eax, dword [ebp - 0xc]
add eax, 0x6c
xor edx, edx
call fcn.00408b70
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x594358
cmp dword [ebp - 8], 0
je 0x594358
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x594382
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf0a726
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0xf0ac00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
push esi
push edi
mov edi, edx
test ebx, ebx
je 0xf0ad0d
test edi, edi
je 0xf0ad0d
cmp dword [ebp + 8], 0
je 0xf0ad0d
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xf0ac30
sub ecx, edx
mov esi, 0x1505
mov edx, 0
je 0xf0ac60
mov bl, byte [edx + edi]
test bl, bl
je 0xf0ac5d
mov eax, esi
inc edx
shl esi, 5
add esi, eax
movzx eax, bl
add esi, eax
cmp edx, ecx
jb 0xf0ac45
mov ebx, dword [ebp - 4]
mov ecx, edi
mov dword [ebp - 4], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xf0ac70
lea eax, [ebp - 4]
sub ecx, edx
push eax
push esi
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00f0ab50
add esp, 0xc
mov edx, eax
cmp dword [ebp - 4], 0
jne 0xf0ad0d
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x1c]
jb 0xf0accd
mov ecx, ebx
call fcn.00f0aa60
test eax, eax
jne 0xf0ad0d
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xf0acb0
lea eax, [ebp - 4]
sub ecx, edx
push eax
push esi
push ecx
mov edx, edi
mov ecx, ebx
call fcn.00f0ab50
add esp, 0xc
mov edx, eax
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
mov dword [eax + ecx*4], edi
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 0x18]
mov edi, dword [ebp + 8]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x10]
mov dword [eax + ecx*4], edi
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x14]
mov dword [eax + ecx*4], edx
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 8]
mov dword [eax + ecx*4], esi
inc dword [ebx + 0x18]
mov eax, dword [ebx]
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf0b840
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
push 0x2e
push esi
mov dword [ebp - 8], ebx
call fcn.00f164e0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0xf0b8f4
mov edi, eax
sub edi, esi
test ebx, ebx
je 0xf0b8d5
test esi, esi
je 0xf0b8d5
xor edx, edx
mov eax, 0x1505
test edi, edi
je 0xf0b89b
nop dword [eax]
mov bl, byte [edx + esi]
test bl, bl
je 0xf0b898
mov ecx, eax
inc edx
shl eax, 5
add eax, ecx
movzx ecx, bl
add eax, ecx
cmp edx, edi
jb 0xf0b880
mov ebx, dword [ebp - 8]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push eax
push edi
mov edx, esi
mov ecx, ebx
call fcn.00f0ab50
add esp, 0xc
cmp dword [ebp - 8], 0
je 0xf0b8d5
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ebx + 0x10]
mov ebx, dword [eax + ecx*4]
test ebx, ebx
je 0xf0b8d5
cmp dword [ebx + 4], 4
jne 0xf0b8d5
mov ebx, dword [ebx + 8]
jmp 0xf0b8d7
xor ebx, ebx
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 8], ebx
push 0x2e
push esi
call fcn.00f164e0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
jne 0xf0b866
test ebx, ebx
je 0xf0b966
test esi, esi
je 0xf0b966
mov edx, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0xf0b901
sub edx, ecx
mov edi, 0
mov ecx, 0x1505
je 0xf0b932
mov al, byte [edi + esi]
mov byte [ebp - 1], al
test al, al
je 0xf0b932
mov eax, ecx
inc edi
shl ecx, 5
add ecx, eax
movzx eax, byte [ebp - 1]
add ecx, eax
cmp edi, edx
jb 0xf0b916
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push ecx
push edx
mov edx, esi
mov ecx, ebx
call fcn.00f0ab50
add esp, 0xc
mov ecx, eax
cmp dword [ebp - 0xc], 0
je 0xf0b966
mov eax, dword [ebx + 4]
pop edi
pop esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebx + 0x10]
pop ebx
mov eax, dword [eax + ecx*4]
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf0de70
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 2
push 0x104
mov dword [ebp - 4], ecx
call fcn.00f18c20
mov edx, dword fs:[0x30]
mov ebx, eax
add esp, 8
mov dword [ebp - 0xc], ebx
mov edx, dword [edx + 0xc]
mov edi, dword [edx + 0x10]
mov esi, edi
nop
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0xf0deba
push 0xb9a3c4
push dword [esi + 0x30]
push ecx
call fcn.01250b95
test eax, eax
je 0xf0debe
cmp edi, esi
jne 0xf0dea0
mov ecx, dword [esi + 0x18]
mov edx, 0xab87776c
call fcn.00f155d0
push 0xb9a3c4
call eax
mov edx, 0x7328f505
mov ecx, eax
call fcn.00f155d0
push 0x104
push ebx
push dword [ebp - 4]
call eax
push 1
push 8
mov dword [ebp - 8], 0
call fcn.00f18c20
push 1
push 8
mov ebx, eax
call fcn.00f18c20
push 1
push 0x18
mov dword [ebp - 0x10], eax
call fcn.00f18c20
push 2
push 0x118
mov dword [ebp - 4], eax
call fcn.00f18c20
mov esi, dword [0xb93088]
add esp, 0x20
mov edi, eax
push 0xb9b10c
push edi
call esi
push dword [ebp - 0xc]
push edi
call esi
pop esi
call fcn.00fa0e6c
push edi
call esi
add eax, eax
push edi
mov word [ebx], ax
call esi
mov dword [ebx + 4], edi
pop edi
call fcn.011186e1
lea eax, [eax*2 + 2]
mov word [ebx + 2], ax
mov eax, dword [ebp - 4]
mov dword [eax], 0x18
mov dword [eax + 4], 0
mov dword [eax + 0xc], 0x40
mov dword [eax + 8], ebx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov esi, ebx
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0xf0dfa9
push 0xb9a3c4
push dword [esi + 0x30]
call edi
test eax, eax
je 0xf0dfad
cmp ebx, esi
jne 0xf0df93
mov ecx, dword [esi + 0x18]
mov edx, 0xab87776c
call fcn.00f155d0
push 0xb9b118
call eax
mov edx, 0xb5ca9f40
mov ecx, eax
call fcn.00f155d0
mov ecx, dword [ebp - 4]
push 0
push 0
push 0x20
push 1
push 3
push pe_nt_image_headers32
push 0
push dword [ebp - 0x10]
push ecx
push 0x120089
lea ecx, [ebp - 8]
push ecx
call eax
mov ecx, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov esi, ebx
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0xf0e018
push 0xb9a3c4
push dword [esi + 0x30]
call edi
test eax, eax
je 0xf0e01c
cmp ebx, esi
jne 0xf0e002
mov ecx, dword [esi + 0x18]
mov edx, 0xab87776c
call fcn.00f155d0
push 0xb9b118
call eax
mov edx, 0x77bf809f
mov ecx, eax
call fcn.00f155d0
mov esi, dword [ebp - 0x10]
push esi
call eax
mov eax, dword [ebp - 8]
xor ecx, ecx
pop edi
test esi, esi
pop esi
cmovs eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf0e060
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 8], edx
call fcn.00f0de70
push 1
push 8
mov dword [ebp - 4], eax
call fcn.00f18c20
push 0x18
mov dword [ebp - 0xc], eax
call fcn.00f1d6d4
mov ecx, dword fs:[0x30]
add esp, 0xc
call fcn.00f4c3b4
retf
Function at 0xf0e240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 2
push 0x104
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
call fcn.00f18c20
mov esi, dword fs:[0x30]
add esp, 8
push ebp
call fcn.00f7eacf
mov dword [ebp - 4], eax
mov esi, dword [esi + 0xc]
mov edi, dword [esi + 0x10]
mov esi, edi
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0xf0e28c
push 0xb9a3c4
push dword [esi + 0x30]
call ebx
test eax, eax
je 0xf0e290
cmp edi, esi
jne 0xf0e276
mov ecx, dword [esi + 0x18]
mov edx, 0xab87776c
call fcn.00f155d0
push 0xb9a3c4
call eax
mov edx, 0x7328f505
mov ecx, eax
call fcn.00f155d0
push 0x104
push dword [ebp - 4]
push dword [ebp - 0x10]
call eax
push 1
push 0x18
mov dword [ebp - 8], 0
call fcn.00f18c20
push 1
push 8
mov dword [ebp - 0xc], eax
call fcn.00f18c20
push 1
push 8
mov edi, eax
call fcn.00f18c20
push 2
push 0x118
mov dword [ebp - 0x10], eax
call fcn.00f18c20
add esp, 0x20
mov esi, eax
push 0xb9b10c
push esi
call dword [0xb93088]
push dword [ebp - 4]
push esi
call dword [0xb93088]
push esi
call fcn.010cda23
ret
Function at 0xf0e920
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5e6ea9af
push esi
push edi
mov edi, edx
movzx esi, cx
mul ebx
shr ecx, 0x10
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
mov dword [ebp - 0xc], ecx
sub edx, eax
mov dword [ebp - 4], edx
test edi, edi
jne 0xf0e95c
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0xf0ea77
xor ebx, ebx
cmp edx, 7
jbe 0xf0e9c6
mov eax, 7
sub eax, edi
mov dword [ebp - 0x10], eax
movzx eax, byte [edi]
add ebx, 8
add esi, eax
movzx eax, byte [edi + 1]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 2]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 3]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 4]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 5]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 6]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 7]
add ecx, esi
add edi, 8
add esi, eax
mov eax, dword [ebp - 0x10]
add eax, edi
add ecx, esi
cmp eax, edx
jb 0xf0e975
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 0x10], 0
cmp ebx, eax
jae 0xf0ea39
sub eax, ebx
cmp eax, 2
jb 0xf0ea25
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, ebx
movzx eax, byte [edi]
add esi, eax
movzx eax, byte [edi + 1]
add ebx, esi
add edi, 2
add esi, eax
add ecx, esi
sub edx, 1
jne 0xf0e9f3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jae 0xf0ea31
movzx eax, byte [edi]
mov edx, dword [ebp - 8]
add esi, eax
add ecx, esi
inc edi
jmp 0xf0ea34
movzx eax, byte [edi]
mov ebx, edx
add esi, eax
add ecx, esi
inc edi
jmp 0xf0ea34
mov edx, dword [ebp - 8]
lea eax, [edx + ebx]
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, 0x15b0
add ecx, eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], edx
jne 0xf0e964
shl ecx, 0x10
pop edi
lea eax, [esi + ecx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf0ea90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0xf0eafb
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0xb9acd0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0xb9acd0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0xb9acd0]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0xb9acd0]
sub edi, 1
jne 0xf0eaa4
pop edi
test esi, esi
je 0xf0eb1a
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0xb9acd0]
sub esi, 1
jne 0xf0eb00
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0xf13460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
sub esp, 0x14
mov eax, dword [eax + 0xc]
push ebx
push esi
call fcn.00f4c58b
ret