joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19d2020
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
mov esi, ecx
test ebx, ebx
je 0x1a394f5
test bl, 7
jne 0x1a394f5
mov al, byte [ebx + 7]
test al, 0x3f
je 0x1a394f5
test al, al
js 0x19d210f
cmp dword [esi + 0x4c], 0
je 0x19d2078
mov eax, dword [ebx]
mov ecx, eax
xor ecx, dword [esi + 0x50]
mov dword [ebp - 8], eax
mov dword [ebp - 8], ecx
mov al, byte [ebp - 6]
xor al, byte [ebp - 7]
xor al, cl
shr ecx, 0x18
cmp cl, al
jne 0x1a394f5
cmp byte [ebx + 7], 4
je 0x1a394d5
mov al, byte [ebx + 6]
test al, al
je 0x19d212f
movzx eax, al
mov ecx, ebx
shl eax, 0x10
and ecx, 0xffff0000
sub ecx, eax
add ecx, 0x10000
test ecx, ecx
je 0x1a394f5
cmp dword [ecx + 0x18], esi
jne 0x1a394f5
cmp ebx, dword [ecx + 0x24]
jb 0x1a394f5
cmp ebx, dword [ecx + 0x28]
jae 0x1a394f5
cmp dword [esi + 0x4c], 0
je 0x19d213a
mov eax, dword [ebx]
test dword [esi + 0x4c], eax
je 0x19d20d6
xor eax, dword [esi + 0x50]
shr eax, 0x10
test al, 4
jne 0x1a394e6
cmp byte [ebx + 7], 4
je 0x19d2101
lea ecx, [esi + 0xa4]
mov eax, dword [ecx]
cmp eax, ecx
je 0x1a394f5
cmp ebx, dword [eax + 0x14]
jb 0x19d210b
cmp ebx, dword [eax + 0x18]
jae 0x19d210b
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [eax]
jmp 0x19d20ef
cmp byte [esi + 0xda], 2
jne 0x19d2136
mov ecx, dword [esi + 0xd4]
test ecx, ecx
je 0x1a394f5
cmp al, 4
jne 0x19d2101
jmp 0x1a394f5
mov ecx, esi
jmp 0x19d20a3
xor ecx, ecx
jmp 0x19d211e
mov al, byte [ebx + 2]
jmp 0x19d20d9
mov eax, ebx
and eax, 0xfff
cmp eax, 0x18
jne 0x1a394f5
jmp 0x19d20c6
mov ecx, esi
call fcn.01a8428f
test al, al
jne 0x19d20e1
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a3951e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a39528
push 0x19b4dbc
call fcn.019dafb0
pop ecx
lea eax, [ebx + 8]
push eax
push esi
push dword [ebp + 8]
push 0x19cea14
call fcn.019dafb0
mov eax, dword fs:[0x30]
add esp, 0x10
cmp byte [eax + 2], 0
je 0x1a39559
mov byte [0x1ac6255], 1
int3
xor al, al
jmp 0x19d2103

Function at 0x19d213f
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
cmp dword [edi + 0x60], 0xeeffeeff
jne 0x1a39560
mov al, 1
pop edi
pop esi
pop ecx
ret
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a39589
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a39593
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push edi
push 0x19b75e0
call fcn.019dafb0
pop ecx
pop ecx
test esi, esi
je 0x1a395b2
push esi
push 0x19b7608
call fcn.019dafb0
pop ecx
pop ecx
push 0x19b7618
call fcn.019dafb0
mov eax, dword fs:[0x30]
pop ecx
cmp byte [eax + 2], 0
je 0x1a395d8
mov byte [0x1ac6255], 1
int3
xor al, al
jmp 0x19d2157
Function at 0x19d2630
Capabilities:
Access peb ldr_data

Disassembly:
push 0x18
push 0x1aaf100
call fcn.01a3611c
mov dword [ebp - 0x1c], 0xc0000001
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], bl
jne 0x19d2728
test edi, edi
je 0x1a39a92
mov dword [ebp - 4], ebx
xor edx, edx
lea ecx, [ebp - 0x20]
call fcn.019e8f34
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
js 0x19d2778
lea eax, [edi + 8]
push eax
call fcn.019f6460
xor esi, esi
inc esi
mov dword [ebp - 4], esi
or dword [edi + 4], 8
push ebx
push ebx
push ebx
push dword [edi + 0x18]
call fcn.019dbd80
mov dword [ebp - 4], ebx
call fcn.019d2765
lea eax, [edi + 0xc]
mov dword [ebp - 0x24], eax
lock or dword [eax], esi
test byte [edi + 4], 4
jne 0x19d274d
mov esi, ebx
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x19d273e
test eax, eax
jne 0x1a39aac
mov ecx, dword [edi + 0x18]
call fcn.019d277d
mov dword [ebp - 0x28], eax
push dword [edi + 0x18]
call fcn.019fc990
push 0xfffffffffffffffe
pop ecx
mov edi, dword [ebp - 0x24]
mov eax, dword [edi]
mov edx, eax
and edx, ecx
lock cmpxchg dword [edi], edx
jne 0x19d26e8
mov edx, eax
test dl, 2
mov edi, dword [ebp + 8]
jne 0x19d272c
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x19d273a
neg esi
sbb esi, esi
and esi, 0xfffffefd
add esi, 0x103
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ecx
call fcn.019d276f
mov eax, esi
call fcn.01a36161
ret 8
xor eax, eax
jmp 0x19d2720
mov ecx, edi
call fcn.019d27db
mov eax, ebx
push 0xfffffffffffffffe
pop ecx
jmp 0x19d26ff
mov esi, ebx
jmp 0x19d2713
test esi, esi
jne 0x19d26cd
push ebx
push dword [edi + 0x18]
call fcn.019ff7a0
jmp 0x19d26cd
mov ecx, dword fs:[0x18]
mov eax, dword [edi + 0x30]
cmp eax, dword [ecx + 0x24]
jne 0x19d26bb
jmp 0x19d26bd
push 0xfffffffffffffffe
pop ecx
jmp 0x19d2716
mov eax, 0xc00000ef
jmp 0x19d2720
mov dword [edi + 0x2c], eax
jmp 0x19d26cd
Function at 0x19d4ae0
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, edx
mov edx, ecx
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [edx], eax
jne 0x19d4b01
xor edi, edi
inc edi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
inc eax
cmp ax, word [0x7ffe036a]
push ebx
sbb eax, eax
and eax, 0x64
xor edi, edi
mov dword [ebp - 4], eax
mov ebx, edi
lea eax, [edx + 0x10]
push esi
mov dword [ebp - 0x14], eax
mov esi, dword [eax]
mov eax, esi
shr eax, 0x10
mov dword [ebp - 0x10], esi
test eax, 0x8000
jne 0x1a3b2a6
test si, si
je 0x19d4c11
mov edx, dword [ebp - 0x14]
mov ecx, esi
or ecx, 0x80000000
mov eax, esi
lock cmpxchg dword [edx], ecx
mov edx, dword [ebp - 8]
cmp eax, esi
jne 0x1a3b2a6
cmp esi, 0xffffffff
je 0x19d4c11
test esi, esi
je 0x19d4c0c
movzx esi, word [edx + 0x18]
mov eax, dword [edx]
neg esi
add eax, 0x50
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], eax
mov edi, dword [eax]
mov edx, dword [eax + 4]
mov eax, edi
mov dword [ebp - 0x1c], edx
lea ebx, [edi + esi]
lea ecx, [edx - 1]
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
mov esi, dword [ebp - 0x18]
cmp eax, edi
mov eax, dword [ebp - 4]
jne 0x19d4b7b
cmp edx, dword [ebp - 0x1c]
jne 0x19d4b7b
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
movzx edx, word [eax + 0x18]
mov eax, dword [ebp - 0xc]
add eax, 0x50
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [edi]
test edx, edx
mov ecx, dword [edi + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
lea ebx, [eax + edx]
lea edx, [ecx + 1]
je 0x19d4c18
mov dword [ebp - 0x10], edx
mov edx, ecx
mov ecx, dword [ebp - 0x10]
lock cmpxchg8b qword [edi]
mov ecx, edx
mov edx, dword [ebp - 4]
cmp eax, dword [ebp - 0x1c]
jne 0x19d4bb6
cmp ecx, dword [ebp - 0x18]
jne 0x19d4bb6
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov dword [ebx], edi
xor edi, edi
inc edi
call fcn.019f1a00
test eax, eax
jne 0x1a3b2b7
mov eax, 0x7ffe0380
cmp byte [eax], 0
jne 0x1a3b2ca
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
pop esi
pop ebx
jmp 0x19d4afa
lea edx, [ecx - 1]
jmp 0x19d4bcb
lea eax, [edx + 0x10]
jmp 0x19d4b1f
inc ebx
cmp ebx, dword [ebp - 4]
jbe 0x1a3b29e
or esi, 0xffffffff
mov dword [ebp - 0x10], esi
jmp 0x19d4b59
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x226
jmp 0x19d4c03
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 1
je 0x19d4c0c
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebx + 4]
movzx eax, word [eax + 0xfa8]
mov ecx, dword [ecx]
dec eax
push eax
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
call fcn.01a92c79
jmp 0x19d4c0c
Function at 0x19d4cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0x24
push 0x1aaf188
call fcn.01a3611c
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0xc0000001
mov dword [ebp - 0x28], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], bl
jne 0x19d4dfc
test esi, esi
je 0x1a3b304
mov dword [ebp - 4], ebx
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.019e8f34
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
js 0x19d4d7b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x19d4d39
cmp eax, 0xffffffff
jne 0x19d4d90
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esi + 0x14], eax
lea eax, [esi + 4]
push eax
call fcn.019f6460
xor edx, edx
inc edx
mov dword [ebp - 4], edx
lea eax, [esi + 0xc]
mov dword [ebp - 0x2c], eax
mov ecx, dword [eax]
mov edi, dword [ebp - 0x20]
cmp ecx, eax
jne 0x19d4d95
mov dword [ebp - 4], ebx
call fcn.019d4de6
or eax, 0xffffffff
lock xadd dword [esi], eax
jne 0x1a3b318
mov dword [esi + 0x14], ebx
mov ecx, esi
call fcn.019d4e00
mov edi, ebx
mov dword [ebp - 0x1c], edi
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 4], eax
call fcn.019d4df3
mov eax, edi
call fcn.01a36161
ret 8
mov dword [esi + 8], eax
jmp 0x19d4d39
mov eax, ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
lea esi, [eax + 0x18]
lock or dword [esi], edx
push dword [eax + 0x20]
call fcn.01a025d0
add edi, eax
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x24]
push dword [eax + 0x20]
call fcn.019fc2c0
push 0xfffffffffffffffe
pop edx
mov eax, dword [esi]
mov ecx, eax
and ecx, edx
lock cmpxchg dword [esi], ecx
jne 0x19d4dc2
test al, 2
je 0x19d4dd8
mov ecx, dword [ebp - 0x24]
call fcn.019e8b24
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
xor edx, edx
inc edx
jmp 0x19d4d53
xor eax, eax
jmp 0x19d4d88
mov eax, 0xc00000ef
jmp 0x19d4d88
cmp dword [ebp + 0xc], 0xffffffff
jne 0x1a3b32c
push ebx
push dword [ebp + 8]
call fcn.01a24580
jmp 0x19d4d76
neg edi
sbb edi, edi
and edi, 0x103
jmp 0x19d4d78
Function at 0x19d4f1d
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
lea eax, [ecx + 0xa4]
mov dword [ebp - 4], edx
mov ebx, dword [eax]
mov dword [ebp - 0x10], eax
push esi
push edi
cmp ebx, eax
je 0x19d4fa6
lea eax, [ebx - 0x10]
test eax, eax
je 0x19d4f9f
mov esi, dword [eax + 0x1c]
cmp esi, dword [eax + 0x28]
jae 0x19d4f9f
push 0
push 0x1c
lea eax, [ebp - 0x30]
push eax
push 0
push esi
push 0xffffffffffffffff
call fcn.01a22b90
mov edi, eax
test edi, edi
js 0x1a3b38d
cmp dword [ebp - 0x20], 0x1000
jne 0x19d4f97
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
call fcn.01a22e60
mov edi, eax
test edi, edi
js 0x1a3b350
add esi, dword [ebp - 0x24]
cmp esi, dword [ebx + 0x18]
jb 0x19d4f49
mov ebx, dword [ebx]
cmp ebx, dword [ebp - 0x10]
jne 0x19d4f3a
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a3b379
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a3b383
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push edi
push esi
push 0x19c2f04
jmp 0x1a3b3c8
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x1a3b3b6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x19b4db0
call fcn.019dafb0
pop ecx
jmp 0x1a3b3c0
push 0x19b4dbc
call fcn.019dafb0
pop ecx
push edi
push esi
push 0x19c2ee4
call fcn.019dafb0
add esp, 0xc
jmp 0x19d4fa8

Function at 0x19d5890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x1ac8668
push ebx
call fcn.019f6460
mov ecx, dword [ebp + 8]
call fcn.019d590e
mov esi, eax
test esi, esi
je 0x19d58fe
sub dword [esi + 0x10], 1
jne 0x19d590a
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp dword [ecx + 4], esi
jne 0x19d5905
cmp dword [eax], esi
jne 0x19d5905
mov dword [eax], ecx
mov dword [ecx + 4], eax
lea eax, [esi + 0xc]
push 1
push eax
lea eax, [esi + 8]
push eax
push 0xffffffffffffffff
call fcn.01a24530
mov ecx, dword fs:[0x30]
mov edi, eax
push esi
push 0
push dword [ecx + 0x18]
call fcn.019f1440
push ebx
call fcn.019f8f20
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov edi, 0xc000002a
jmp 0x19d58ef
push 3
pop ecx
int 0x29
xor edi, edi
jmp 0x19d58ef
Function at 0x19d6250
Capabilities:
Access peb ldr_data

Disassembly:
push 0x2c
push 0x1aaf240
call fcn.01a36178
mov byte [ebp - 0x1d], 0
mov edi, dword [ebp + 8]
test edi, edi
je 0x19d6286
cmp edi, dword [0x1ac86e4]
je 0x19d6286
cmp edi, dword [0x1ac86dc]
je 0x19d6286
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
je 0x19d62a1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
je 0x1a3bd83
call fcn.01a361c0
ret 4
lea eax, [edi + 0xe0]
push eax
call fcn.019f6460
and dword [ebp - 4], 0
cmp byte [edi + 0xe5], 0
jne 0x1a3bcb2
cmp byte [edi + 0xe4], 0
jne 0x19d62d7
mov byte [edi + 0xe4], 1
push edi
push dword [edi + 0x24]
call fcn.01a243e0
lea eax, [edi + 8]
mov dword [ebp - 0x2c], eax
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ecx
test ecx, ecx
jne 0x1a3bcbc
mov eax, dword [ebp + 4]
mov dword [edi + 0xf4], eax
mov byte [edi + 0xe5], 1
mov byte [ebp - 0x1d], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.019d637a
call fcn.019f1a00
test eax, eax
jne 0x1a3bd70
mov eax, 0x7ffe0386
cmp byte [eax], 0
jne 0x19d6387
cmp byte [ebp - 0x1d], 0
je 0x19d6299
cmp edi, dword [0x1ac86e4]
jne 0x19d634d
mov edx, 0x1ac86e8
mov ecx, 0x1ac86e4
call fcn.019edd22
jmp 0x19d6299
cmp edi, dword [0x1ac86dc]
je 0x19d636e
or eax, 0xffffffff
lock xadd dword [edi], eax
jne 0x19d6299
mov ecx, edi
call fcn.019d6390
jmp 0x19d6299
mov edx, 0x1ac86e0
mov ecx, 0x1ac86dc
jmp 0x19d6343
mov ecx, edi
call fcn.01aa5e74
jmp 0x19d6327
call fcn.01aa5c15
jmp 0x19d6304
mov esi, ebx
mov edx, ecx
mov dword [ebp - 0x30], edx
dec ecx
mov dword [ebp - 0x24], ecx
mov eax, esi
mov edi, dword [ebp - 0x2c]
lock cmpxchg8b qword [edi]
mov ebx, eax
mov dword [ebp - 0x28], ebx
mov ecx, edx
mov dword [ebp - 0x24], ecx
cmp ebx, esi
mov edi, dword [ebp + 8]
jne 0x19d62e8
cmp ecx, dword [ebp - 0x30]
jne 0x19d62e8
test ecx, ecx
je 0x19d62f0
xor eax, eax
mov dword [ebp - 0x34], eax
xor esi, esi
mov dword [ebp - 0x3c], esi
cmp esi, 3
jge 0x1a3bd3a
test eax, eax
jne 0x1a3bd42
xor ebx, ebx
mov dword [ebp - 0x38], ebx
cmp ebx, dword [0x1ac84b8]
jae 0x1a3bd37
test eax, eax
jne 0x1a3bd37
imul ecx, ebx, 0xc
add ecx, dword [edi + esi*4 + 0x10]
call fcn.01aa637f
test eax, eax
je 0x1a3bd2f
add eax, 0xfffffff4
jmp 0x1a3bd31
xor eax, eax
mov dword [ebp - 0x34], eax
inc ebx
jmp 0x1a3bd0b
inc esi
jmp 0x1a3bcfd
test eax, eax
je 0x19d62d7
mov esi, dword [eax]
test esi, esi
je 0x19d62d7
mov esi, dword [esi + 4]
test esi, esi
je 0x19d62d7
push edi
push eax
mov ecx, esi
call dword [0x1ac91d0]
call esi
jmp 0x19d62d7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22c
jmp 0x19d6322
call fcn.01aa5c15
jmp 0x19d6299
Function at 0x19d6976
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, edx
mov dword [ebp - 8], ecx
call fcn.019db041
test eax, eax
js 0x19d6a5d
lea eax, [ebp - 4]
push eax
push 0x19b4c08
call fcn.019d6a70
test eax, eax
jns 0x1a3c047
push esi
xor ecx, ecx
call fcn.01a1ac2e
call fcn.019fe5aa
push 0x10
push 0
test eax, eax
jne 0x19d6a52
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
test esi, esi
je 0x19d6a40
push ebx
push edi
mov dword [esi + 8], 1
call fcn.01a13630
imul ebx, dword [ebp + 8], 0xc
push 0
mov dword [esi + 0xc], eax
add ebx, 0x1ac9308
lea edi, [ebx + 4]
call fcn.019db104
push dword [ebx]
call fcn.019f6460
cmp dword [edi], edi
jne 0x19d6a16
mov ecx, dword [ebp + 8]
mov eax, dword fs:[0x30]
add ecx, 2
add eax, 0x28
lock bts dword [eax], ecx
cmp dword [ebp - 8], 0
je 0x1a3c056
mov eax, dword [edi]
cmp dword [eax + 4], edi
jne 0x19d6a61
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [eax + 4], esi
mov dword [edi], esi
push dword [ebx]
call fcn.019f8f20
push 1
call fcn.019db104
pop ebx
xor ecx, ecx
inc ecx
call fcn.01a1ac2e
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
push dword [0x1ac920c]
jmp 0x19d69c8
xor eax, eax
jmp 0x19d6a4b
push 3
pop ecx
int 0x29
int3
cmp dword [ebp - 4], 0
jne 0x19d6a5d
jmp 0x19d69a6
mov eax, dword [edi + 4]
cmp dword [eax], edi
jne 0x19d6a61
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [eax], esi
mov dword [edi + 4], esi
jmp 0x19d6a31

Function at 0x19d7be3
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, edx
mov dword [ebp - 4], ecx
imul edi, eax, 0xc
mov dword [ebp - 8], eax
add edi, 0x1ac9308
push dword [edi]
lea ebx, [edi + 4]
call fcn.019f6460
mov esi, dword [ebx]
cmp esi, ebx
je 0x1a3c712
mov eax, dword [ebp - 4]
cmp esi, eax
jne 0x1a3c708
xor ecx, ecx
call fcn.01a1ac2e
sub dword [esi + 8], 1
push 1
pop ebx
jne 0x1a3c720
push 0
call fcn.019db104
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp dword [ecx + 4], esi
jne 0x19d7c9f
cmp dword [eax], esi
jne 0x19d7c9f
mov dword [eax], ecx
mov dword [ecx + 4], eax
cmp eax, ecx
jne 0x19d7c62
mov ecx, dword [ebp - 8]
mov eax, dword fs:[0x30]
add ecx, 2
add eax, 0x28
lock btr dword [eax], ecx
push dword [edi]
call fcn.019f8f20
mov eax, esi
test eax, eax
je 0x19d7c96
call fcn.019fe5aa
push esi
push 0
test eax, eax
jne 0x19d7ca4
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f1440
push ebx
call fcn.019db104
mov ecx, ebx
call fcn.01a1ac2e
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 3
pop ecx
int 0x29
push dword [0x1ac920c]
jmp 0x19d7c84
mov esi, dword [esi]
cmp esi, ebx
jne 0x19d7c15
push dword [edi]
call fcn.019f8f20
xor eax, eax
jmp 0x19d7c98
mov ecx, ebx
call fcn.01a1ac2e
push dword [edi]
call fcn.019f8f20
xor eax, eax
jmp 0x19d7c6b
Function at 0x19d7ff0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [0x1acd344]
xor eax, esp
mov dword [esp + 0x7c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x19d8093
test ecx, ecx
je 0x19d8093
lea edi, [esp + 0x30]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword fs:[0x18]
lea edi, [esp + 0x48]
mov dword [esp + 0xc], eax
add esi, 0xf50
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x5c], eax
xor eax, eax
mov dword [esp + 0x60], edx
xor edx, edx
mov dword [esp + 0x64], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [esp + 0x58], al
mov dword [esp + 0x78], eax
lea eax, [esp + 8]
push eax
push 0x78
push 0x700
push ecx
mov word [esp + 0x6a], dx
call fcn.01a22f40
test eax, eax
jne 0x19d808b
mov ecx, dword [esp + 0x84]
pop edi
pop esi
xor ecx, esp
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 0x10
push eax
call fcn.01a062b0
jmp 0x19d8075
push 0x57
pop eax
jmp 0x19d8075
Function at 0x19da080
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0x30]
push 0x64
push 8
push dword [eax + 0x18]
call fcn.019f3940
test eax, eax
je 0x19da09d
or dword [eax], 0x400
ret
xor eax, eax
ret

Function at 0x19da4d0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
ret
Function at 0x19dafd1
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0x90
push 0x1aaf1d8
call fcn.01a36178
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x84], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x88], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x78], eax
cmp edx, 0xffffffff
je 0x1a3b4be
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
jne 0x1a3b4b5
push dword [ebp + 8]
push edx
call fcn.01a23cb0
test eax, eax
jne 0x1a3b4be
xor eax, eax
lea esp, [ebp - 0xb0]
call fcn.01a361c0
ret 0x10
cmp edx, 0x65
jne 0x19db020
mov ecx, dword [ebp - 0x78]
movzx eax, word [ecx + 0xfca]
test al, 2
jne 0x19db031
or eax, 2
mov word [ecx + 0xfca], ax
xor edi, edi
xor esi, esi
xor ebx, ebx
cmp ebx, 0x200
jae 0x1a3b5c0
mov eax, 0x80
call fcn.01a26400
mov dword [ebp - 0x18], esp
mov edi, esp
sub ebx, 0xffffff80
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x84]
mov esi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1a3b50d
sub esi, ecx
lea eax, [ebx - 1]
cmp esi, eax
jbe 0x1a3b51f
mov esi, eax
push esi
push edx
push edi
call fcn.01a287e0
add esp, 0xc
lea ecx, [esi + edi]
mov dword [ebp - 0x80], ecx
mov eax, ebx
sub eax, esi
push 0
pop esi
je 0x1a3b540
cmp eax, 0x7fffffff
jbe 0x1a3b545
mov esi, 0xc000000d
mov dword [ebp - 0x94], esi
test esi, esi
js 0x1a3b59c
xor esi, esi
mov dword [ebp - 0x90], esi
dec eax
mov dword [ebp - 0x7c], eax
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
push eax
push ecx
call fcn.01a276f0
add esp, 0x10
mov ecx, eax
mov eax, dword [ebp - 0x7c]
test ecx, ecx
js 0x1a3b582
cmp ecx, eax
ja 0x1a3b582
je 0x1a3b58d
jmp 0x1a3b594
mov esi, 0x80000005
mov dword [ebp - 0x90], esi
mov ecx, dword [ebp - 0x80]
mov byte [eax + ecx], 0
mov dword [ebp - 0x94], esi
jmp 0x1a3b5a3
test eax, eax
je 0x1a3b5a3
mov byte [ecx], 0
mov dword [ebp - 0xa0], esi
mov dword [ebp - 4], 0xfffffffe
test esi, esi
jns 0x1a3b60d
cmp esi, 0x80000005
je 0x1a3b4e0
test esi, esi
jns 0x1a3b60d
cmp esi, 0x80000005
jne 0x1a3b60d
mov word [ebx + edi - 2], 0xa
lea edx, [ebx - 1]
jmp 0x1a3b61b
mov edx, edi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1a3b612
sub edx, ecx
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
jne 0x1a3b67d
mov al, byte [0x7ffe02d4]
and al, 3
xor ecx, ecx
cmp al, 3
sete cl
test cl, cl
je 0x1a3b67d
push dword [ebp + 8]
push dword [ebp - 0x9c]
movzx eax, dx
push eax
push edi
push 1
call fcn.01a24680
mov ecx, eax
cmp byte [ebp + 0x14], 1
jne 0x1a3b667
cmp ecx, 0x80000003
jne 0x1a3b667
push 1
call fcn.01a24be0
xor ecx, ecx
mov eax, dword [ebp - 0x78]
mov edx, 0xfffd
and word [eax + 0xfca], dx
mov eax, ecx
jmp 0x19db033
mov dword [ebp - 0x74], 0x40010006
and dword [ebp - 0x6c], 0
mov dword [ebp - 0x64], 2
and dword [ebp - 0x70], 0
movzx eax, dx
inc eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edi
mov dword [ebp - 4], 1
lea eax, [ebp - 0x74]
push eax
call fcn.01a36f70
jmp 0x1a3b6b6
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x78]
mov ecx, 0xfffd
and word [eax + 0xfca], cx
jmp 0x19db031