joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100096de
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
mov ecx, dword [0x10010934]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov edx, dword [eax]
jmp 0x10009703
test edx, edx
je 0x10009761
cmp dword [edx + 0x18], ecx
je 0x10009709
mov edx, dword [edx]
cmp edx, eax
jne 0x100096f8
leave
ret
mov dword [0x1001090c], ecx
mov ecx, dword [edx + 4]
mov dword [0x1001091c], edx
mov eax, dword [ecx]
mov dword [0x10010910], eax
mov eax, dword [edx + 0x14]
mov eax, dword [eax]
mov dword [0x10010918], eax
mov eax, dword [edx + 0xc]
mov eax, dword [eax]
mov dword [0x10010914], eax
mov eax, dword [edx]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x14]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
leave
ret

Function at 0x10009c5b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], eax
lea esi, [eax + 0xd]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
test eax, eax
je 0x10009cb5
push 0xfffffffffffffff3
pop eax
sub eax, dword [ebp - 4]
mov edi, esi
mov dword [ebp - 4], eax
movsx eax, byte [edi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
pop ecx
test eax, eax
jne 0x10009ca3
mov al, byte [edi]
cmp al, 0x5f
je 0x10009ca3
cmp al, 0xc0
jl 0x10009ca0
cmp al, 0xff
jle 0x10009ca3
xor ebx, ebx
inc ebx
push esi
inc edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
mov ecx, dword [ebp - 4]
add ecx, edi
cmp ecx, eax
jb 0x10009c83
mov ecx, dword [0x10010908]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp byte [eax + 0xd], 0
jne 0x10009cc9
xor ebx, ebx
inc ebx
test ebx, ebx
je 0x10009d1b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strstr]
mov edi, eax
push 0x1000e218
push edi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x10009d1b
push 0x1000e218
push edi
call ebx
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strchr]
push 0x20
lea edi, [eax + 3]
push edi
call ebx
add esp, 0x10
test eax, eax
je 0x10009d1b
push 0x19
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x20
push esi
call ebx
add esp, 0x14
mov byte [eax], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009d20
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ebx, 0x1000e21c
mov esi, eax
push ebx
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10009d81
push ebx
push esi
call edi
push 0x20
lea ebx, [eax + 3]
push ebx
call dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 0x10
test eax, eax
je 0x10009d81
push 0x20
call fcn.1000b4f5
push 0x20
push ebx
push eax
mov dword [0x10010928], eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x20
push dword [0x10010928]
call dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 0x18
mov byte [eax], 0
mov ebx, 0x1000e220
push ebx
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10009da6
push ebx
push esi
call edi
add eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 0xc
mov dword [0x10010120], eax
pop edi
pop esi
pop ebx
ret
Function at 0x1000ac56
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 1
jne 0x1000acda
mov eax, dword [ebp + 8]
mov dword [0x10010934], eax
push str.ashot_st
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x10010924], eax
cmp dword [0x10010924], 0
jne 0x1000acda
push str.ashot_st
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10010924], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10010900], eax
push str.ws2_32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x100108fc], eax
mov byte [0x100108cf], 1
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 8], 0x1000ae71
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
cmp dword [ebp + 0xc], 5
jne 0x1000ad03
push dword [0x10010934]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1000ae80
push 0
push 0
push 0x1000a2cc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
xor eax, eax
inc eax
leave
ret 0xc
Function at 0x408b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push str.AppID
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408be3
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x408bb1
cmp eax, 2
jne 0x408bcd
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x408bdd
test ecx, ecx
je 0x408bd8
test cl, 1
jne 0x408bcd
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x408bdd
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1001e34
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x10011e0
call fcn.01002c88
mov edi, 0x94
mov eax, edi
call fcn.01002df0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x10010a8]
mov ecx, dword [esi + 0x10]
mov dword [0x10062b8], ecx
mov eax, dword [esi + 4]
mov dword [0x10062c4], eax
mov edx, dword [esi + 8]
mov dword [0x10062c8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10062bc], esi
cmp ecx, 2
je 0x1001e94
or esi, 0x8000
mov dword [0x10062bc], esi
shl eax, 8
add eax, edx
mov dword [0x10062c0], eax
cmp word [0x1000000], 0x5a4d
jne 0x1001ed0
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1001ed0
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1001ee9
cmp ecx, 0x20b
je 0x1001ed6
and dword [ebp - 0x1c], 0
jmp 0x1001efd
cmp dword [eax + 0x84], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1001ef7
cmp dword [eax + 0x74], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.01002c2a
pop ecx
test eax, eax
jne 0x1001f2a
cmp dword [0x10062a8], 1
jne 0x1001f17
call fcn.01002406
push 0x1c
call fcn.01002219
push 0xff
call fcn.01002078
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01002a5a
test eax, eax
jge 0x1001f3f
push 0x1b
call fcn.01001e05
pop ecx
call dword [0x10010ac]
mov dword [0x1006854], eax
call fcn.0100292d
mov dword [0x10062a0], eax
call fcn.01002884
test eax, eax
jge 0x1001f65
push 8
call fcn.01001e05
pop ecx
call fcn.0100262a
test eax, eax
jge 0x1001f76
push 9
call fcn.01001e05
pop ecx
call fcn.010020d2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1001f89
push eax
call fcn.01001e05
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [fcn.010010b0]
call fcn.010025bc
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1001fab
movzx eax, word [ebp - 0x40]
jmp 0x1001fae
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.01001c3d
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1001fcf
push esi
call fcn.010021b2
call fcn.010021ea
jmp 0x1002001
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call fcn.01002cc3
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40102b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
push esp
pop ebp
and esp, 0xfffffff8
sub esp, 0x1c
mov al, byte [ecx]
and dword [esp + 0x18], 0
push ebx
push esi
mov byte [edx], al
lea eax, [edx + 1]
push edi
xor edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.004011dd
test eax, eax
je 0x40118f
lea ecx, [esp + 0x18]
call fcn.004011dd
lea ecx, [esp + 0x18]
or eax, eax
je 0x4010fe
call fcn.004011dd
or eax, eax
je 0x4010bc
push 4
sub edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.004011dd
lea edi, [eax + edi*2]
dec ebx
jne 0x40108e
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x4010af
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x4010b2
mov byte [edx], 0
mov ebx, dword [esp + 0x10]
inc edx
jmp 0x4011a1
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
push esi
pop ecx
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x4010f2
or ecx, ecx
je 0x40118a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x4010e4
jmp 0x401186
xor ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
jmp 0x40118a
call fcn.004011bc
test edi, edi
jne 0x401133
cmp eax, 2
jne 0x40112e
lea ecx, [esp + 0x18]
call fcn.004011bc
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x40118a
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x401123
jmp 0x401186
sub eax, 3
jmp 0x401136
sub eax, 2
mov ecx, dword [esp + 0x18]
push eax
pop esi
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.004011bc
push eax
pop ecx
cmp esi, 0x7d00
jb 0x40115d
inc ecx
cmp esi, 0x500
jb 0x401166
inc ecx
cmp esi, 0x80
jae 0x401171
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x40118a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x40117d
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x4011a7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
sub edi, edi
mov dword [esp + 0x1c], edx
test ebx, ebx
je 0x40105e
sub edx, dword [esp + 0x14]
pop edi
pop esi
push edx
pop eax
pop ebx
push ebp
pop esp
pop ebp
ret
Function at 0x401271
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push esi
push ecx
pop esi
xor ecx, ecx
mov edx, dword [esi + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
add edx, esi
mov dword [eax], ecx
mov eax, 0x14c
push edi
mov edi, ecx
cmp word [edx + 4], ax
jne 0x4013b8
push ebx
mov ebx, dword [edx + 0x88]
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x4013b7
cmp dword [edx + 0x8c], ecx
je 0x4013b7
movzx eax, word [edx + 0x14]
add eax, 0x18
add eax, edx
movzx edx, word [edx + 6]
or edx, edx
je 0x4013b7
cmp dword [eax + 0xc], ebx
je 0x4012e2
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x4012d0
jmp 0x4013b7
mov edx, dword [eax + 0x14]
add edx, esi
push 0
movzx ecx, word [edx + 0xe]
movzx eax, word [edx + 0xc]
add ecx, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], ecx
pop ebx
je 0x4013b7
sub eax, eax
mov esi, dword [edx + eax*8 + 0x14]
and esi, 0x7fffffff
add esi, edx
push 0
movzx ecx, word [esi + 0xe]
movzx eax, word [esi + 0xc]
add ecx, eax
mov dword [ebp - 0x18], ecx
pop ecx
mov dword [ebp - 0xc], ecx
je 0x4013aa
sub eax, eax
cmp word [esi + eax*8 + 0x10], 0x65
jne 0x40139a
mov ecx, dword [esi + eax*8 + 0x14]
and ecx, 0x7fffffff
add ecx, edx
mov dword [ebp - 8], 0
movzx eax, word [ecx + 0xe]
mov dword [ebp - 4], eax
movzx eax, word [ecx + 0xc]
add dword [ebp - 4], eax
je 0x401393
xor eax, eax
mov edx, 0x409
cmp word [ecx + eax*8 + 0x10], dx
mov edx, dword [ebp - 0x10]
je 0x401376
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
movzx eax, ax
cmp eax, dword [ebp - 4]
jb 0x401356
jmp 0x401393
mov ecx, dword [ecx + eax*8 + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [ecx + edx]
sub eax, dword [ebp - 0x14]
add eax, edx
mov dword [edi], eax
mov eax, dword [ecx + edx + 4]
mov ecx, dword [ebp + 0x10]
sub edi, edi
mov dword [ecx], eax
inc edi
or edi, edi
jne 0x4013b7
mov ecx, dword [ebp - 0xc]
inc ecx
movzx eax, cx
mov dword [ebp - 0xc], ecx
cmp eax, dword [ebp - 0x18]
jb 0x401329
or edi, edi
jne 0x4013b7
inc ebx
movzx eax, bx
cmp eax, dword [ebp - 0x1c]
jb 0x401302
pop ebx
push edi
pop eax
pop edi
pop esi
leave
ret 0xc

Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push edx
pop edi
push edi
pop ebx
shr ebx, 2
and edi, 3
push ecx
pop esi
or ebx, ebx
je 0x4013f3
mov al, byte [ebp + 0xc]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [ebp + 8]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x4013d6
jmp 0x4013f6
mov eax, dword [ebp + 8]
test edi, edi
je 0x401400
xor byte [esi], al
inc esi
dec edi
jne 0x4013fa
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1000d0c0
Capabilities:
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10135c61
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1021eb80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [0x101a70f4]
push 0x2e75e
call esi
push 0x2e75f
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
call esi
push 0x2e763
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 1
call esi
push 0x2e765
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call esi
push 0x2e766
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 3
call esi
push 0x2e767
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 4
call esi
push 0x2e768
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 5
call esi
push 0x2e769
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 6
call esi
push 0x2e76a
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 7
call esi
push 0x2e76b
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 8
call esi
push 0x2e76c
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 9
call esi
push 0x2e76d
lea ecx, [edi + 0x58]
mov byte [ebp - 4], 0xa
call esi
push 0x2e76e
lea ecx, [edi + 0x60]
mov byte [ebp - 4], 0xb
call esi
push 0x2e76f
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 0xc
call esi
push 0x2e770
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 0xd
call esi
push 0x2e771
lea ecx, [edi + 0x78]
mov byte [ebp - 4], 0xe
call esi
mov byte [ebp - 4], 0xf
push 0x35410
lea ecx, [edi + 0x80]
call esi
push 0x35411
lea ecx, [edi + 0x88]
mov byte [ebp - 4], 0x10
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000d210
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10135d1e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1021eb80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [0x101a70f4]
push 0x3491b
call esi
push 0x3491c
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
call esi
push 0x3491d
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 1
call esi
push 0x3491e
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call esi
push 0x3491f
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 3
call esi
push 0x34920
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 4
call esi
push 0x34921
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 5
call esi
push 0x34922
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 6
call esi
push 0x34923
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 7
call esi
push 0x34924
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 8
call esi
push 0x34925
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 9
call esi
push 0x34926
lea ecx, [edi + 0x58]
mov byte [ebp - 4], 0xa
call esi
push 0x34927
lea ecx, [edi + 0x60]
mov byte [ebp - 4], 0xb
call esi
push 0x34928
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 0xc
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000dd00
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013650d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1021eb80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [0x101a70f4]
push 0x378d1
call esi
push 0x378d2
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
call esi
push 0x378d3
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 1
call esi
push 0x378d4
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call esi
push 0x378d5
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 3
call esi
push 0x378d6
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 4
call esi
push 0x378d7
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 5
call esi
push 0x378d8
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 6
call esi
push 0x378d9
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 7
call esi
push 0x378da
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 8
call esi
push 0x378db
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 9
call esi
push 0x378dc
lea ecx, [edi + 0x58]
mov byte [ebp - 4], 0xa
call esi
push 0x378dd
lea ecx, [edi + 0x60]
mov byte [ebp - 4], 0xb
call esi
push 0x378de
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 0xc
call esi
push 0x378df
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 0xd
call esi
push 0x378e0
lea ecx, [edi + 0x78]
mov byte [ebp - 4], 0xe
call esi
mov byte [ebp - 4], 0xf
push 0x378e1
lea ecx, [edi + 0x80]
call esi
push 0x378e2
lea ecx, [edi + 0x88]
mov byte [ebp - 4], 0x10
call esi
push 0x378e3
lea ecx, [edi + 0x90]
mov byte [ebp - 4], 0x11
call esi
push 0x378e4
lea ecx, [edi + 0x98]
mov byte [ebp - 4], 0x12
call esi
push 0x378e5
lea ecx, [edi + 0xa0]
mov byte [ebp - 4], 0x13
call esi
push 0x378e6
lea ecx, [edi + 0xa8]
mov byte [ebp - 4], 0x14
call esi
push 0x378e7
lea ecx, [edi + 0xb0]
mov byte [ebp - 4], 0x15
call esi
push 0x378e8
lea ecx, [edi + 0xb8]
mov byte [ebp - 4], 0x16
call esi
push 0x378e9
lea ecx, [edi + 0xc0]
mov byte [ebp - 4], 0x17
call esi
push 0x378ea
lea ecx, [edi + 0xc8]
mov byte [ebp - 4], 0x18
call esi
push 0x378eb
lea ecx, [edi + 0xd0]
mov byte [ebp - 4], 0x19
call esi
push 0x378ec
lea ecx, [edi + 0xd8]
mov byte [ebp - 4], 0x1a
call esi
push 0x378ed
lea ecx, [edi + 0xe0]
mov byte [ebp - 4], 0x1b
call esi
push 0x378ee
lea ecx, [edi + 0xe8]
mov byte [ebp - 4], 0x1c
call esi
push 0x378ef
lea ecx, [edi + 0xf0]
mov byte [ebp - 4], 0x1d
call esi
push 0x378f0
lea ecx, [edi + 0xf8]
mov byte [ebp - 4], 0x1e
call esi
mov byte [ebp - 4], 0x1f
lea ecx, [edi + 0x100]
push 0x378f1
call esi
push 0x378f2
lea ecx, [edi + 0x108]
mov byte [ebp - 4], 0x20
call esi
push 0x378f3
lea ecx, [edi + 0x110]
mov byte [ebp - 4], 0x21
call esi
push 0x378f4
lea ecx, [edi + 0x118]
mov byte [ebp - 4], 0x22
call esi
push 0x378f5
lea ecx, [edi + 0x120]
mov byte [ebp - 4], 0x23
call esi
push 0x378f6
lea ecx, [edi + 0x128]
mov byte [ebp - 4], 0x24
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005efb0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101475de
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1021eb80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [0x101a70f4]
push 1
call esi
push 2
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
call esi
push 3
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 1
call esi
push 4
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call esi
push 5
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 3
call esi
push 6
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 4
call esi
push 7
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 5
call esi
push 8
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 6
call esi
push 9
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 7
call esi
push 0xa
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 8
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005ffb0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10147fb2
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1021eb80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [0x101a70f4]
push 2
call esi
push 3
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
call esi
push 4
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 1
call esi
push 5
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call esi
push 6
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 3
call esi
push 7
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 4
call esi
push 8
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 5
call esi
push 9
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 6
call esi
push 0xa
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 7
call esi
push 0x36bdf
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 8
call esi
push 0x36be0
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 9
call esi
push 0x36be1
lea ecx, [edi + 0x58]
mov byte [ebp - 4], 0xa
call esi
push 0x36be2
lea ecx, [edi + 0x60]
mov byte [ebp - 4], 0xb
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret