joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x4011b5
pop dword [ebp - 0xc]
mov eax, 0xbbe76855
add eax, 0x4458a960
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x72751889
add dword [ebp - 0x1c], 0xdbdd2cc2
mov dword [ebp - 0x18], 0x4803724c
add dword [ebp - 0x18], 0xea2fd9f9
mov dword [ebp - 0x14], 0x69de9707
sub dword [ebp - 0x14], 0x1d9252d9
mov dword [ebp - 0x10], 0xeb58380e
add dword [ebp - 0x10], 0x14a7c7f2
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x4cbacb3
add eax, 0xfb7523a1
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x83b4b3fa
sub dword [ebp - 0x1c], 0xf424aa4
mov dword [ebp - 0x18], 0x83a05fae
add dword [ebp - 0x18], 0xbdcc01c7
mov dword [ebp - 0x14], 0x899e0df8
add dword [ebp - 0x14], 0xd9d15e74
mov dword [ebp - 0x10], 0xe4204513
add dword [ebp - 0x10], 0x1bdfbaed
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x23b610ef
add eax, 0xdc8abf5d
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3a0db
push 0
call eax
mov ecx, 0xa52c09a7
sub ecx, 0xa52bbf9b
mov edi, eax
mov esi, 0x3e8ae9bc
sub esi, 0x3e4939bc
add esi, dword [ebp - 0xc]
mov ebx, 0x68bc5638
add ebx, 0xb7aff040
add dword [ebp - 8], esi
mov edx, dword [esi]
xor dword [ebp - 8], ebx
add edx, ebx
xor dword [ebp - 4], 0x36fd56cf
mov dword [edi], edx
mov dword [ebp - 8], 0x5449e221
add edi, 4
add esi, 4
loop 0x4012d7
add eax, 0xd97825cb
sub eax, 0xd9770ac8
mov ebx, eax
add eax, 5
mov ecx, 0x9ec78db5
sub ecx, 0x9e878db5
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x4015c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44bd1b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x460620]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push esi
push edi
mov eax, dword [0x460620]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00414ca0
test eax, eax
jne 0x40163a
mov eax, 1
test byte [0x464cac], al
jne 0x401630
or dword [0x464cac], eax
call fcn.00403e70
push 0x44c170
call fcn.0043180e
add esp, 4
push str.please_run_as_admin_
jmp 0x401720
push str.Global9F2E5111_A708_4068_B72D_21E92CEF3ED7
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x4016f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4016ef
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push ebx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esi + 0xa4]
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00448efc
mov ecx, esi
call fcn.0041ddaa
push ebx
call fcn.0041f6b6
add esp, 4
lea eax, [esp + 0x2c]
push eax
call fcn.00401780
lea ecx, [esp + 0x2c]
mov dword [esp + 0x290], ebx
mov dword [esi + 0x20], ecx
call method.CFirstPageDlg.virtual_324
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x290], 0xffffffff
call fcn.00401830
jmp 0x40172d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
test byte [0x464cac], al
jne 0x40171b
or dword [0x464cac], eax
call fcn.00403e70
push 0x44c170
call fcn.0043180e
add esp, 4
push 0x4536f4
mov esi, 0x464a98
call fcn.00404230
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.004316db
mov esp, ebp
pop ebp
ret
Function at 0x401ce0
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi + 0x2c], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jne 0x401d02
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401d0d
mov eax, dword [esi + 0x2c]
push str.SC_CreateSetup
push eax
call ebx
mov dword [esi], eax
cmp dword [esi + 0x2c], 0
jne 0x401d23
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401d2e
mov ecx, dword [esi + 0x2c]
push str.SC_CloseSetup
push ecx
call ebx
mov dword [esi + 4], eax
cmp dword [esi + 0x2c], 0
jne 0x401d45
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401d50
mov edx, dword [esi + 0x2c]
push str.SC_AddProperty
push edx
call ebx
mov dword [esi + 8], eax
cmp dword [esi + 0x2c], 0
jne 0x401d67
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401d72
mov eax, dword [esi + 0x2c]
push str.SC_GetProperty
push eax
call ebx
mov dword [esi + 0xc], eax
cmp dword [esi + 0x2c], 0
jne 0x401d89
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401d94
mov ecx, dword [esi + 0x2c]
push str.SC_RemoveSequence
push ecx
call ebx
mov dword [esi + 0x10], eax
cmp dword [esi + 0x2c], 0
jne 0x401dab
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401db6
mov edx, dword [esi + 0x2c]
push str.SC_InstallProduct
push edx
call ebx
mov dword [esi + 0x14], eax
cmp dword [esi + 0x2c], 0
jne 0x401dcd
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401dd8
mov eax, dword [esi + 0x2c]
push str.SC_IsNeedReboot
push eax
call ebx
mov dword [esi + 0x18], eax
cmp dword [esi + 0x2c], 0
jne 0x401def
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401dfa
mov ecx, dword [esi + 0x2c]
push str.SC_AddSequence
push ecx
call ebx
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x2c], 0
jne 0x401e11
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401e1c
mov edx, dword [esi + 0x2c]
push str.SC_GetActionParam
push edx
call ebx
mov dword [esi + 0x20], eax
cmp dword [esi + 0x2c], 0
jne 0x401e33
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401e3e
mov eax, dword [esi + 0x2c]
push str.SC_InstallProductEx
push eax
call ebx
mov dword [esi + 0x24], eax
cmp dword [esi + 0x2c], 0
jne 0x401e55
push str.setup.dll
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x401e60
mov ecx, dword [esi + 0x2c]
push str.SC_LoadInstallScript
push ecx
call ebx
cmp dword [esi], 0
pop edi
mov dword [esi + 0x28], eax
pop ebx
je 0x401eaa
cmp dword [esi + 4], 0
je 0x401eaa
cmp dword [esi + 8], 0
je 0x401eaa
cmp dword [esi + 0xc], 0
je 0x401eaa
cmp dword [esi + 0x10], 0
je 0x401eaa
cmp dword [esi + 0x14], 0
je 0x401eaa
cmp dword [esi + 0x18], 0
je 0x401eaa
cmp dword [esi + 0x1c], 0
je 0x401eaa
cmp dword [esi + 0x20], 0
je 0x401eaa
cmp dword [esi + 0x24], 0
je 0x401eaa
test eax, eax
je 0x401eaa
mov eax, 1
ret
xor eax, eax
ret
Function at 0x403e70
Capabilities:
Create directory
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x460620]
xor eax, esp
mov dword [esp + 0x418], eax
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x218]
push ecx
lea edx, [esp + 0xc]
push edx
push str.debug
push str.SOFTWAREStarAngel
mov esi, 1
push 0x80000002
mov dword [0x464a98], 0x453f0c
mov dword [0x464ca8], 0
mov dword [0x464a9c], 0
mov word [0x464aa0], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x403f09
lea eax, [esp + 0x214]
push 0x453e6c
push eax
call fcn.00432216
add esp, 8
test eax, eax
jne 0x403f09
mov dword [0x464a9c], esi
jmp 0x403f12
cmp dword [0x464a9c], 0
je 0x403f84
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x403f84
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
push 0x453e70
lea edx, [esp + 0x14]
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
lea eax, [esp + 0x14]
push eax
call edi
push 0x453e84
lea ecx, [esp + 0x14]
push ecx
call esi
push 0
lea edx, [esp + 0x14]
push edx
call edi
xor eax, eax
pop edi
jmp 0x403f70
movzx ecx, word [esp + eax + 0xc]
mov word [eax + 0x464aa0], cx
add eax, 2
test cx, cx
jne 0x403f70
mov ecx, dword [esp + 0x41c]
pop esi
xor ecx, esp
mov eax, 0x464a98
call fcn.004316db
add esp, 0x41c
ret

Function at 0x404a40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404a59
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404a94
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x404a90
lea ebx, [ebx]
cmp esi, eax
jae 0x404a94
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404a80
cmp esi, eax
jb 0x404a9a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x408960
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x3a0
mov eax, dword [0x460620]
xor eax, esp
mov dword [esp + 0x39c], eax
mov eax, dword [esp + 0x3a8]
push ebp
mov ebp, dword [esp + 0x3a8]
push esi
lea edx, [esp + 0x19c]
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
sub edx, eax
jmp 0x4089a0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4089a0
push str.lang.ini
lea eax, [esp + 0x1a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x1a0]
push ecx
push 0x64
lea edx, [esp + 0xe0]
push edx
push str.zh_cn
push str.default
push str.lang
call edi
movzx eax, word [ebp + 0x124]
push eax
lea ecx, [esp + 0x14]
push str.0x_04x
push ecx
call fcn.00433293
add esp, 0xc
lea edx, [esp + 0x1a0]
push edx
push 0x64
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xe4]
push ecx
mov edx, eax
push edx
push str.lang
call edi
lea eax, [esp + 0x10]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408a41
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00403a90
mov ecx, dword [esp + 0x3a8]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.004316db
add esp, 0x3a0
ret 8
Function at 0x40dbb0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x44b0d8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
mov eax, dword [0x460620]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, edx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40dbf2
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x34]
call fcn.00403a90
mov esi, dword [esp + 0x5c]
lea eax, [esp + 0x24]
push eax
add esi, 0x40
push esi
lea eax, [esp + 0x34]
mov dword [esp + 0x5c], ebx
call fcn.0040e400
mov ecx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x54], 0xffffffff
cmp dword [esp + 0x44], 8
mov dword [esp + 0x18], ecx
jb 0x40dc4b
mov edx, dword [esp + 0x30]
push edx
call fcn.0041593a
add esp, 4
cmp ebp, ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
mov dword [esp + 0x20], eax
je 0x40dc6b
cmp ebp, esi
je 0x40dc70
call int.00431b4d
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x18], ecx
je 0x40dcb2
cmp ebp, ebx
jne 0x40dc83
call int.00431b4d
mov edx, dword [esp + 0x18]
cmp edx, dword [ebp + 4]
jne 0x40dc91
call int.00431b4d
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
add eax, 0x28
push ebx
mov ecx, edi
mov word [edi + 4], bx
call fcn.004039e0
jmp 0x40dccd
push ebx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push 0x453f40
mov esi, edi
mov word [edi + 4], bx
call fcn.00403a90
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 4
Function at 0x4113e0
Capabilities:
Get number of processors

Disassembly:
ja 0x41144b
je 0x41144d
cmp eax, 0x68743b61
imul esi, dword [ebx + 0x2e], 0x67696568
push 0x3b623d74
outsw dx, word [esi]
jb 0x411422
je 0x411464
imul esi, dword [ebx + 0x2e], 0x57786f62
jb 0x411466
jo 0x411477
jb 0x411465
jo 0x411434
arpl word [ecx], bp
xor byte [ecx], ch
aas
and ah, byte [ecx + 0x6e]
imul ebp, dword [ebp + 0x61], 0x3a226574
and ah, byte [ecx + 0x74]
je 0x411493
and bl, byte [ebp + 0x28]
jnp 0x41149d
pop ebp
sub byte [ebx + 0x77], bh
imul esp, dword [esp + esi*2 + 0x68], 0x682c613a
imul esp, dword gs:[edi + 0x68], 0x7d623a74
push 0x7d623a74
bound edi, qword [ebp + 0x29]
cmp esp, dword [ebp + 0x2d]
sub eax, 0x5b64293b
sub dword [ebx], edi
sub eax, 0x64293b2d
pop ebx
pop ebp
popal
insb byte es:[edi], dx
imul esp, dword [edi + 0x6e], 0x2c7d2928
cmp ah, byte [bp + 0x75]
outsb dx, byte [esi]
jne 0x4114be
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
sub byte [ecx + 0x29], ah
jnp 0x4114d0
popal
jb 0x41147d
bound edi, qword [0x73696874]
arpl word cs:[edx + 0x65], si
arpl word [edx + 0x65], si
jb 0x4114cc
popal
popal
je 0x4114cf
inc ebp
insb byte es:[edi], dx
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x41149a
and ah, byte [edi + 0x22]
sub dword [ebx], edi
jb 0x4114de
je fcn.004114f0
jb 0x4114eb
and byte [ebx + 0x28], dh
popal
sub dword [edi], edi
bound ebp, qword [esi]
popal
je 0x4114fc
jb 0x4114b2
jnp 0x4114ae
arpl word [ecx + 0x73], bp
jae 0x4114b4
cmp cl, byte [ecx + 0x61]
dec ecx
popal
sub esp, dword [ecx + 0x7d]
sub dword [edx], edi
bound edi, qword [ebp + 0x2c]
imul ebp, dword [ebp + 0x61], 0x663a6567
jne 0x411514
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
sub byte [ecx + 0x2c], ah
bound ebp, qword [ebx]
sub al, 0x64
sub al, 0x65
sub al, 0x65
sub dword gs:[ebx + 0x76], edi
sub dword [ebx + 0x76], edi
popal
jb 0x4114db
cmp ax, 0x707b
jb 0x411526
jo 0x411532
jae 0x411528
jae 0x411528
jb 0x41153b
inc ecx
jae 0x411539
arpl word gs:[edx + edx*2 + 0x61], si
push edx
popal
je 0x411539
imul ebp, dword [edi + 0x3a], 0x3b7d614d
outsd dx, dword [esi]
cmp cl, byte [ebp + 0x61]
jge 0x411511
popal
jb 0x411540
jne 0x411548
outsb dx, byte gs:[esi]
je 0x411552
jae 0x41150e
insb byte es:[edi], dx
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x41154e
xor dword ds:[esi], esp
dec esp
sub byte [esi + 0x2c], ah
jnp 0x411568
cmp ah, byte [esp + ebp + 0x68]
imul esp, dword gs:[edi + 0x68], 0x7d653a74
sub dword [ebx], edi
cmp ax, 0x6874
imul esi, dword [ebx + 0x2e], 0x61657263
arpl word [edx + 0x65], si
popal
je 0x41157c
inc ebp
insb byte es:[edi], dx
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x411547
and ch, byte [ecx + 0x6d]
popal
and ch, byte gs:[bx + di]
popal
sub dword [esi], ebp
popal
je 0x41159f
jb 0x411555
sub word [ebx], di
insb byte es:[edi], dx
jae 0x4115a1
je 0x41157f
insd dword es:[edi], dx
jae 0x4115ba
je 0x411606

Function at 0x411530
Capabilities:
Get number of processors

Disassembly:
cmp ah, byte [edx + 0x2c]
jns 0x41152f
arpl word [edi + esi*2], bp
imul esp, dword [esp + esi*2 + 0x68], 0x682c643a
cmp esp, dword [esi + 0x2e]
Function at 0x759b0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0759b200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x759b0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x759b0c2
add dl, dl
jne 0x759b0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x759b134
xor eax, eax
add dl, dl
jne 0x759b0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x759b1d5
add dl, dl
jne 0x759b0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x759b108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x759b113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x759b11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x759b12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x759b0cd
mov eax, 1
add dl, dl
jne 0x759b142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x759b14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x759b139
sub eax, ebx
mov ebx, 1
jne 0x759b180
mov ecx, 1
add dl, dl
jne 0x759b166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x759b171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x759b15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x759b0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x759b197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x759b1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x759b18e
cmp eax, 0x7d00
jae 0x759b1c5
cmp eax, 0x500
jb 0x759b1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x759b0cd
cmp eax, 0x7f
ja 0x759b1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x759b0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x759b1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x759b0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10005db0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100803b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x10097288]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x38], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea eax, [esp + 0xc]
mov byte [esp + 0x38], 1
push eax
call fcn.10005920
lea eax, [esp + 0xc]
push esi
push eax
lea edx, [esi + 0xa0]
lea ecx, [esp + 0x20]
call fcn.1003ee70
add esp, 8
test al, al
jne 0x10005e54
xor edi, edi
jmp 0x10005e8b
mov eax, dword [ebp + 0xc]
mov edi, 1
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x18], 0
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [eax], edx
mov esi, dword [esp + 0xc]
test esi, esi
je 0x10005ea6
push dword [esp + 0x10]
push esi
call fcn.10007e70
push esi
call fcn.1006f76a
add esp, 4
push dword [esp + 0x18]
call fcn.10005810
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10008450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10080598
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10097288]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
dec ebp
mov esi, dword [esp + 0x34]
dec edx
mov dword [esp + 0x20], 0
mov ecx, esi
mov eax, dword [esp + 0x30]
mov byte [esp + 0x30], al
lea eax, [esp + 0x30]
shr ebp, cl
push eax
shr edx, cl
inc ebp
inc edx
mov dword [ebx], 0x1008e184
mov eax, ebp
mov dword [ebx + 4], 0
imul eax, edx
lea ecx, [ebx + 4]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [esp + 0x2c], edx
add eax, 0x10
push eax
call fcn.10008890
mov eax, dword [ebx + 4]
mov edx, eax
mov ecx, dword [esp + 0x28]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
and edx, 0xf
je 0x10008500
sub eax, edx
add eax, 0x10
mov dword [ebx + 0x10], eax
cmp ebp, 1
jbe 0x1000851b
push 8
push ebp
push ecx
push 0x1008e03c
push 6
call fcn.100520e0
add esp, 0x14
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
Function at 0x10008540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10080598
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10097288]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
dec ebp
mov esi, dword [esp + 0x34]
dec edx
mov dword [esp + 0x20], 0
mov ecx, esi
mov eax, dword [esp + 0x30]
movzx eax, ax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
shr ebp, cl
push eax
shr edx, cl
inc ebp
inc edx
mov dword [ebx], 0x1008e0f4
mov eax, ebp
mov dword [ebx + 4], 0
imul eax, edx
lea ecx, [ebx + 4]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [esp + 0x2c], edx
add eax, 0x10
push eax
call fcn.100088d0
mov eax, dword [ebx + 4]
mov edx, eax
mov ecx, dword [esp + 0x28]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
and edx, 0xf
je 0x100085f3
sub eax, edx
add eax, 0x10
mov dword [ebx + 0x10], eax
cmp ebp, 1
jbe 0x1000860e
push 0x10
push ebp
push ecx
push 0x1008e03c
push 6
call fcn.100520e0
add esp, 0x14
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10

Function at 0x10008630
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10080598
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10097288]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
dec ebp
mov esi, dword [esp + 0x34]
dec edx
mov dword [esp + 0x20], 0
mov ecx, esi
mov eax, dword [esp + 0x30]
movzx eax, ax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
shr ebp, cl
push eax
shr edx, cl
inc ebp
inc edx
mov dword [ebx], 0x1008e064
mov eax, ebp
mov dword [ebx + 4], 0
imul eax, edx
lea ecx, [ebx + 4]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [esp + 0x2c], edx
add eax, 0x10
push eax
call fcn.100088d0
mov eax, dword [ebx + 4]
mov edx, eax
mov ecx, dword [esp + 0x28]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
and edx, 0xf
je 0x100086e3
sub eax, edx
add eax, 0x10
mov dword [ebx + 0x10], eax
cmp ebp, 1
jbe 0x100086fe
push 0x10
push ebp
push ecx
push 0x1008e03c
push 6
call fcn.100520e0
add esp, 0x14
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10