joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19ff7a0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor edx, edx
mov dword [ebp - 8], ebx
mov ecx, edi
call fcn.019fd879
test eax, eax
je 0x1a4a884
cmp dword [edi + 4], 0x19b1120
jne 0x1a4a884
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], dl
jne 0x1a4a884
cmp dword [ebp + 0xc], edx
je 0x19ff82f
mov esi, dword [edi + 0x5c]
lea eax, [edi + 0x90]
push eax
call fcn.019f6460
inc byte [edi + 0xdf]
lea eax, [ebp - 8]
push eax
push 2
lea edx, [esi + 0x40]
mov ecx, edi
call fcn.019fcc49
mov eax, dword [edi + 0x20]
test eax, eax
jne 0x19ff86e
dec byte [edi + 0xdf]
lea eax, [edi + 0x90]
push eax
call fcn.019f8f20
mov edx, dword [ebp + 0xc]
mov ecx, edi
call fcn.019fd89c
test bl, bl
jne 0x1a4a852
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x19ff85b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 8
neg ecx
mov eax, ecx
neg eax
lock xadd dword [edi], eax
cmp eax, ecx
jne 0x19ff848
jmp 0x1a4a86f
mov bl, 1
jmp 0x19ff823
lea esi, [edi + 0x90]
push esi
call fcn.019f6460
dec byte [edi + 0xdf]
push esi
call fcn.019f8f20
jmp 0x19ff841
mov eax, dword [edi + 4]
push edi
mov esi, dword [eax]
mov ecx, esi
call dword [0x1ac91d0]
call esi
jmp 0x19ff848
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], dl
jne 0x19ff848
call fcn.01aa5c15
jmp 0x19ff848

Function at 0x19ff872
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
je 0x19ff8a7
call fcn.019fd879
test eax, eax
je 0x19ff8a7
cmp dword [esi + 4], 0x19b1148
jne 0x19ff8a7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19ff8a7
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
cmp dword [ebp + 8], 0
jne 0x19ff8c0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
je 0x19ff8c0
xor eax, eax
jmp 0x19ff8a2
call fcn.01aa5c15
jmp 0x19ff8bc
Function at 0x1a0020d
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, 0xa0
mov dword [ebp - 0xc0], edx
push edi
lea eax, [ebp - 0xac]
mov byte [ebp - 0xad], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0xbc], esi
call fcn.01a28e60
add esp, 0xc
lea ebx, [ebp - 0xac]
cmp byte [0x1ac7c28], 0
mov ecx, edi
jne 0x1a0027f
push 0
push 0
push 0x19dae10
push 0x1ac86d4
call fcn.01a00340
test eax, eax
jne 0x1a4aaad
mov ecx, edi
lea eax, [esi + 0xc]
mov esi, eax
mov edi, ebx
mov eax, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xbc]
mov dword [ebx + 0x10], eax
movzx eax, word [esi + 0x34]
and dword [ebx + 0x24], 0
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebx + 0x20], eax
lea eax, [ebp - 0xb4]
push eax
push ecx
push ebx
push 0xa0
push ebx
push 0xf
call fcn.01a244b0
cmp eax, 0xc0000023
je 0x1a4aab8
test eax, eax
jne 0x1a4ab0c
xor edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x18]
mov dword [esi + 0x30], ecx
cmp eax, 3
jne 0x1a00326
lea edx, [ebx + 0x28]
mov ecx, esi
call fcn.01a0088b
push 0x10
lea eax, [esi + 0xc]
push 0x19b4f98
push eax
call fcn.01a28780
add esp, 0xc
test eax, eax
je 0x1a0032d
cmp byte [ebp - 0xad], 0
jne 0x1a4ab21
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
je 0x1a002e3
jmp 0x1a002ed
mov dword [0x1ac60c0], esi
jmp 0x1a00304
push eax
call fcn.01a062b0
jmp 0x1a00313
cmp byte [ebp - 0xad], 0
je 0x1a4aad2
mov eax, dword fs:[0x30]
push ebx
push 0
push dword [eax + 0x18]
call fcn.019f1440
push dword [ebp - 0xb4]
mov eax, dword fs:[0x30]
push 8
mov byte [ebp - 0xad], 1
push dword [eax + 0x18]
call fcn.019f3940
mov ecx, dword [ebp - 0xb4]
mov ebx, eax
lea eax, [esi + 0xc]
test ebx, ebx
jne 0x1a00282
mov eax, 0xc0000017
jmp 0x1a002cb
push eax
call fcn.01a062b0
mov edi, eax
test edi, edi
jne 0x1a00304
jmp 0x1a002d5
test ebx, ebx
je 0x1a00311
mov eax, dword fs:[0x30]
push ebx
push 0
push dword [eax + 0x18]
call fcn.019f1440
jmp 0x1a00311

Function at 0x1a015bd
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
je 0x1a4b233
cmp byte [esi + 0xdd], 0
jne 0x1a4b233
call fcn.019fd879
test eax, eax
je 0x1a4b233
cmp dword [esi + 4], 0x19b1100
jne 0x1a4b233
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a4b233
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
cmp dword [ebp + 8], 0
jne 0x1a4b248
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a4b24d
call fcn.01aa5c15
xor eax, eax
jmp 0x1a0160a
Function at 0x1a019b9
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
push esi
push edi
movzx edi, word [ecx + 6]
xor ecx, ecx
movzx eax, ax
add edx, eax
test edi, edi
je 0x1a019f0
mov esi, dword [ebp + 8]
cmp esi, dword [edx + 0xc]
jb 0x1a019e8
mov eax, dword [edx + 0x10]
add eax, dword [edx + 0xc]
cmp esi, eax
jb 0x1a019f4
add edx, 0x28
inc ecx
cmp ecx, edi
jb 0x1a019d9
xor eax, eax
jmp 0x1a019f6
mov eax, edx
pop edi
pop esi
pop ebp
ret 4
Function at 0x1a0260a
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
not eax
test eax, eax
jns 0x1a0266e
mov edi, 0x1ac7b60
push edi
call fcn.019fbe50
mov ecx, dword [0x1ac7b84]
lea eax, [esi + 0x20]
mov edx, 0x1ac7b80
cmp dword [ecx], edx
jne 0x1a02672
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ecx], eax
push edi
mov dword [0x1ac7b84], eax
call fcn.019fbdd0
cmp dword [0x1ac7b20], 0
je 0x1a0266e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a0266e
push dword [0x1ac7b20]
call fcn.019ff680
pop edi
pop esi
pop ecx
ret
push 3
pop ecx
int 0x29
Function at 0x1a05e42
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edx
mov edx, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
test edi, edi
je 0x1a05eca
test edx, edx
jne 0x1a05e75
mov ax, word [edi + 0x14]
lea esi, [edi + 0x18]
movzx eax, ax
add esi, eax
je 0x1a05eca
mov eax, dword [ebp - 4]
movzx ecx, word [edi + 6]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x1a05ece
mov edi, dword [ebp + 0x10]
test edx, edx
jne 0x1a05ea1
cmp byte [ebp + 0x14], dl
je 0x1a05ea1
mov ecx, dword [ebp - 8]
and ecx, 0xfffffffc
add ecx, eax
lea eax, [esi + 0x28]
cmp eax, ecx
ja 0x1a05ece
mov ecx, dword [ebp - 0xc]
cmp edi, dword [esi + 0xc]
je 0x1a05ebf
jbe 0x1a05eb2
mov eax, dword [esi + 0x10]
add eax, dword [esi + 0xc]
cmp edi, eax
jb 0x1a05ebf
add esi, 0x28
inc ebx
cmp ebx, ecx
jge 0x1a05ece
mov eax, dword [ebp - 4]
jmp 0x1a05e86
mov eax, esi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
jmp 0x1a05ec2
xor eax, eax
jmp 0x1a05ec1
Function at 0x1a062b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1aafd00
push 0x1a2a000
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1acd344]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x1a4d8e8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ecx + 0xbf4], eax
mov dword [ebp - 4], 0xfffffffe
test eax, eax
je 0x1a063b5
cmp eax, 0x103
je 0x1a063cb
test eax, 0x20000000
jne 0x1a063a1
mov ecx, eax
and ecx, 0xff0000
cmp ecx, 0x70000
je 0x1a063fe
mov ecx, eax
and ecx, 0xf0000000
cmp ecx, 0xd0000000
je 0x1a4d901
xor edi, edi
mov ebx, 0x11b
lea edx, [ebx + edi]
shr edx, 1
mov ecx, dword [edx*8 + 0x19ba940]
mov esi, eax
sub esi, ecx
cmp eax, ecx
jae 0x1a06374
lea ebx, [edx - 1]
cmp edi, ebx
jbe 0x1a06354
jmp 0x1a4d90b
movzx ecx, byte [edx*8 + 0x19ba944]
cmp esi, ecx
jb 0x1a06385
lea edi, [edx + 1]
jmp 0x1a0636b
movzx eax, word [edx*8 + 0x19ba946]
cmp byte [edx*8 + 0x19ba945], 1
jne 0x1a063e4
add eax, esi
movzx eax, word [eax*2 + 0x19b8d40]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x3e5
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [eax + esi*2]
movzx eax, word [ecx*2 + 0x19b8d42]
shl eax, 0x10
movzx ecx, word [ecx*2 + 0x19b8d40]
or eax, ecx
jmp 0x1a063a1
mov ecx, eax
shr ecx, 0x18
cmp ecx, 0x80
jne 0x1a4d8f0
movzx eax, ax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
jmp 0x1a0630b
cmp ecx, 0xc0
je 0x1a0640f
jmp 0x1a06339
and eax, 0xcfffffff
jmp 0x1a0634d
mov ecx, eax
and ecx, 0xffff0000
cmp ecx, 0xc0010000
je 0x1a0640f
push eax
push 0x19b7628
call fcn.019dafb0
push 0x19b766c
call fcn.019dafb0
add esp, 0xc
push 0x19b76a0
call fcn.019dafb0
add esp, 4
mov eax, 0x13d
jmp 0x1a063a1
Function at 0x1a06750
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0x14
push 0x1aafd68
call fcn.01a3611c
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1a4db0f
mov edi, 0x1ac6d60
mov edx, edi
mov ecx, 0x1ac6d94
call fcn.01a06904
push edi
call fcn.019fbe50
mov dword [ebp - 4], esi
mov edi, esi
mov dword [ebp - 0x20], edi
mov edx, dword [0x1ac6d78]
cmp edi, dword [0x1ac6d80]
jb 0x1a06863
test edx, edx
je 0x1a06878
mov eax, dword [0x1ac6d44]
cmp dword [0x1ac6d80], eax
jae 0x1a4db3c
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1a06808
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1a067c2
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
mov dword [ebp - 0x24], eax
add eax, 2
push eax
push 8
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
test esi, esi
je 0x1a4db6b
push dword [ebp - 0x24]
push edi
push esi
call fcn.01a287e0
add esp, 0xc
mov edx, dword [0x1ac6d78]
imul ecx, dword [0x1ac6d80], 0x18
mov dword [ecx + edx], ebx
mov dword [ecx + edx + 4], esi
mov eax, dword [ebp + 0x10]
mov dword [ecx + edx + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + edx + 0xc], eax
mov dword [ecx + edx + 0x10], 1
mov eax, dword [ebp + 0x18]
mov dword [ecx + edx + 0x14], eax
inc dword [0x1ac6d80]
mov dword [ebp - 4], 0xfffffffe
call fcn.01a068ac
cmp dword [ebp - 0x1c], 0
jl 0x1a06858
test edi, edi
je 0x1a06858
mov edx, edi
mov ecx, ebx
call fcn.01a068b7
mov eax, dword [ebp - 0x1c]
call fcn.01a36161
ret 0x14
imul eax, edi, 0x18
cmp dword [eax + edx], ebx
je 0x1a4db19
inc edi
mov dword [ebp - 0x20], edi
jmp 0x1a06791
push 0x300
push 8
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f3940
mov edx, eax
test edx, edx
je 0x1a4db2d
mov dword [0x1ac6d78], edx
mov dword [0x1ac6d44], 0x20
jmp 0x1a067b6
mov eax, 0xc000000d
jmp 0x1a0685b
push esi
push esi
push esi
push ebx
call fcn.01a06600
mov edx, dword [0x1ac6d78]
jmp 0x1a0686f
mov dword [ebp - 0x1c], 0xc0000017
mov edi, dword [ebp + 0xc]
jmp 0x1a06839
add eax, 0x20
imul eax, eax, 0x18
push eax
push edx
push esi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f01b0
mov edx, eax
test edx, edx
je 0x1a4db2d
mov dword [0x1ac6d78], edx
add dword [0x1ac6d44], 0x20
jmp 0x1a067b6
mov dword [ebp - 0x1c], 0xc0000017
jmp 0x1a06839
Function at 0x1a06c36
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0
push 0
push dword [ebx + 0x18]
mov dword [ebp - 8], ebx
push 3
call fcn.019fba70
mov edx, dword [ebx + 0x1c]
xor edi, edi
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
movzx eax, word [ebx + 0x14]
lea esi, [ebx + 0x18]
add esi, eax
xor eax, eax
cmp ax, word [ebx + 6]
jae 0x1a06cd0
cmp dword [esi + 0xc], 0
je 0x1a06cc4
cmp dword [esi + 8], 0
je 0x1a06cc4
push 8
push 0x19b53e8
push esi
call fcn.01a29cf0
add esp, 0xc
test eax, eax
je 0x1a4de48
push 6
push 0x19b53e0
push esi
call fcn.01a29cf0
add esp, 0xc
test eax, eax
je 0x1a4de48
push 8
push 0x19b53d8
push esi
call fcn.01a29cf0
add esp, 0xc
test eax, eax
je 0x1a06cd9
movzx eax, word [ebx + 6]
inc edi
add esi, 0x28
cmp edi, eax
jb 0x1a06c74
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
jmp 0x1a06cd2
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp - 0xc]
add ecx, dword [eax + 0x18]
cmp edx, ecx
jb 0x1a06cc4
mov eax, dword [esi + 8]
add eax, ecx
cmp edx, eax
ja 0x1a06cc4
test dword [esi + 0x24], 0x20000000
jmp 0x1a06cc2

Function at 0x1a06f43
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ecx + 0x18]
lea eax, [ebp - 8]
push esi
push edi
push eax
xor esi, esi
push esi
push esi
push ebx
push 3
call fcn.019fba70
mov edi, dword [ebp - 8]
mov edx, dword [edi + 0x78]
test edx, edx
jne 0x1a06f73
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x7c], esi
jbe 0x1a06f6a
mov ecx, dword [edi + 0x50]
lea eax, [ecx - 0xd]
cmp edx, eax
jae 0x1a06f6a
mov edx, dword [edx + ebx + 0xc]
lea eax, [ecx - 0xc]
cmp edx, eax
ja 0x1a06f6a
push 0xc
lea eax, [edx + ebx]
push 0x19b54b8
push eax
call fcn.01a27440
add esp, 0xc
test eax, eax
jne 0x1a06f6a
jmp 0x1a4e152
movzx eax, word [edi + 0x14]
lea ebx, [edi + 0x18]
add ebx, eax
xor ecx, ecx
xor eax, eax
inc ecx
inc eax
mov dword [ebp - 8], ecx
xor edx, edx
mov dword [ebp - 4], eax
cmp dx, word [edi + 6]
jae 0x1a06f6a
test eax, eax
je 0x1a4e18d
push 5
push 0x19bcb34
push ebx
call fcn.01a29cf0
mov ecx, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 4], eax
test ecx, ecx
je 0x1a4e1a6
push 6
push 0x19bcb3c
push ebx
call fcn.01a29cf0
mov ecx, eax
add esp, 0xc
mov dword [ebp - 8], ecx
cmp dword [ebp - 4], 0
jne 0x1a4e1b7
test ecx, ecx
jne 0x1a4e1b7
mov al, 1
jmp 0x1a06f6c
movzx eax, word [edi + 6]
add ebx, 0x28
inc esi
cmp esi, eax
jae 0x1a06f6a
mov eax, dword [ebp - 4]
jmp 0x1a4e173
Function at 0x1a072d5
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x210]
push 0x208
push ebx
push eax
mov dword [ebp - 0x214], ebx
call fcn.01a28e60
add esp, 0xc
lea ecx, [ebp - 0x210]
mov edi, ebx
call fcn.01a07392
dec eax
cmp eax, 0x102
ja 0x1a07325
lea edi, [ebp - 0x210]
mov eax, dword fs:[0x30]
push 0x1c
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
test esi, esi
je 0x1a4e551
lea eax, [ebp - 0x214]
mov dword [esi + 8], ebx
push eax
push ebx
push ebx
push ebx
or ecx, 0xffffffff
call fcn.01a07255
mov dword [esi + 0xc], eax
test eax, eax
jne 0x1a4e56c
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x1a0738b
mov eax, dword fs:[0x30]
push esi
push ebx
push dword [eax + 0x18]
call fcn.019f1440
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret
call fcn.01aaa998
jmp 0x1a07368
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], ebx
jne 0x1a07378
push 0xe
call fcn.01a06240
jmp 0x1a07378
mov eax, dword [eax + 0xc]
cmp dword [eax + 0x44], 1
jae 0x1a4e588
push 0x20010502
jmp 0x1a4e57e
push 0xe
call fcn.01a06240
jmp 0x1a07361
call fcn.01aaac50
mov ecx, dword [esi + 0xc]
mov dword [ecx + 0x20], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x34]
shl eax, 2
push eax
mov eax, dword fs:[0x30]
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov dword [esi + 0x10], eax
test eax, eax
jne 0x1a4e5c8
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], ebx
jne 0x1a07361
jmp 0x1a4e57c
test edi, edi
je 0x1a4e5d5
mov ecx, edi
call fcn.01a07f81
jmp 0x1a4e5d7
mov eax, ebx
or dword [esi], 0x80
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x214]
and eax, 7
mov dword [esi + 0x18], ebx
or dword [esi + 4], eax
mov eax, esi
jmp 0x1a0737a

Function at 0x1a078e0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
push esi
push edi
mov edi, edx
test ebx, ebx
je 0x1a4e626
mov eax, dword [ebx]
add eax, 0xc
push eax
mov dword [ebp - 4], eax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
test esi, esi
je 0x1a4e62d
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push edi
push dword [ebp - 8]
call fcn.01a22ab0
mov edi, eax
cmp edi, 0xc0000034
je 0x1a07973
test edi, edi
js 0x1a4e637
test ebx, ebx
je 0x1a0794b
mov eax, dword [esi + 8]
mov dword [ebx], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1a07957
mov eax, dword [esi + 4]
mov dword [ecx], eax
test edi, edi
js 0x1a07973
cmp dword [ebp + 0xc], 0
je 0x1a07973
push dword [esi + 8]
lea eax, [esi + 0xc]
push eax
push dword [ebp + 0xc]
call fcn.01a287e0
add esp, 0xc
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call fcn.019f1440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
jmp 0x1a078fc
mov eax, 0xc000009a
jmp 0x1a07986
cmp edi, 0x80000005
jne 0x1a07957
jmp 0x1a07942
Function at 0x1a07f81
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1a07fad
xor edx, edx
mov edi, 0x104
mov eax, edx
cmp word [ecx], dx
je 0x1a07fa2
inc eax
add ecx, 2
cmp eax, edi
jl 0x1a07f95
cmp eax, edi
jl 0x1a07fb3
push 0x57
call fcn.01a06240
xor eax, eax
pop edi
pop esi
pop ebx
ret
lea ebx, [eax + eax]
lea eax, [ebx + 2]
push eax
mov eax, dword fs:[0x30]
push edx
push dword [eax + 0x18]
call fcn.019f3940
mov edi, eax
test edi, edi
je 0x1a07fad
push ebx
push esi
push edi
call fcn.01a287e0
add esp, 0xc
xor eax, eax
mov word [ebx + edi], ax
mov eax, edi
jmp 0x1a07faf
Function at 0x1a0caee
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
je 0x1a50c2e
lea ecx, [esi + 0x30]
call fcn.019fd879
test eax, eax
je 0x1a50c2e
cmp dword [esi + 0x34], 0x19b1244
jne 0x1a50c2e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a50c2e
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
cmp dword [ebp + 8], 0
jne 0x1a50c43
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a50c48
call fcn.01aa5c15
xor eax, eax
jmp 0x1a0cb31
Function at 0x1a0ce5f
Capabilities:
Access peb ldr_data

Disassembly:
push 0x30
push 0x1aaff38
call fcn.01a3611c
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x1c], 0xc0000001
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x1a0d044
xor eax, eax
mov dword [ebp - 0x24], eax
test ecx, ecx
je 0x1a50e4f
cmp dword [ebp + 8], 0
je 0x1a50e4f
test edx, edx
je 0x1a50e4f
test eax, 0xfffffffc
jne 0x1a50e4f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a50e4f
and dword [ecx], 0
mov eax, dword [0x1ac84bc]
add eax, 0x80000
push 0xb8
or eax, 8
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f3940
mov edi, eax
mov dword [ebp - 0x20], edi
and dword [ebp - 4], 0
mov dword [ebp - 0x34], 1
test edi, edi
je 0x1a50de2
mov eax, dword [ebp + 4]
mov edi, dword [ebp - 0x20]
mov dword [edi + 0x9c], eax
lea eax, [edi + 0x30]
mov dword [ebp - 0x2c], eax
push 0x19b1244
push dword [ebp - 0x24]
push esi
mov edx, dword [ebp + 0xc]
mov ecx, eax
call fcn.019fcf70
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
js 0x1a0d01e
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x60], eax
xor ecx, ecx
cmp byte [ebp + 0x14], cl
setne cl
mov eax, dword [edi + 0xb4]
and eax, 0xfffffffe
or ecx, eax
mov dword [edi + 0xb4], ecx
mov ecx, dword [ebp - 0x28]
mov dword [edi + 0xa8], ecx
mov eax, dword [edi + 0x8c]
mov dword [edi + 0x20], 0x19e5a00
lea esi, [edi + 0x28]
test eax, eax
je 0x1a50def
lea edx, [edi + 0x24]
push esi
mov ecx, eax
call fcn.019fd76a
mov ecx, dword [ebp - 0x28]
and dword [edi + 0x14], 0
lea eax, [edi + 0x18]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [edi], 0x19b1118
mov eax, dword [edi + 0x24]
mov dword [edi + 4], eax
mov al, byte [esi]
mov byte [edi + 8], al
mov edx, dword [edi + 0x8c]
mov dword [ebp - 0x28], edx
test edx, edx
je 0x1a50dfe
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a50dfb
mov eax, dword [edx + 0x28]
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x40], edi
push 8
lea eax, [ebp - 0x40]
push eax
push 2
push ecx
call fcn.01a23200
mov esi, eax
test esi, esi
js 0x1a0cff3
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x28]
call fcn.01a0d2cb
xor esi, esi
mov dword [ebp - 0x1c], esi
test esi, esi
js 0x1a0d00e
xor esi, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2c]
test eax, eax
jne 0x1a0d04c
cmp dword [ecx + 8], esi
jne 0x1a0d072
and dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
call fcn.01a0d054
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x34], 0
call fcn.01a0d05f
test esi, esi
js 0x1a0d03a
mov eax, dword [ebp - 0x38]
mov dword [eax], edi
mov eax, esi
call fcn.01a36161
ret 0x10
mov eax, dword [esi + 0x1c]
jmp 0x1a0ce85
mov eax, dword [eax + 0x18]
mov dword [ecx + 0x10], eax
jmp 0x1a0d009
call fcn.019fc1fb
jmp 0x1a0d00e
mov esi, 0xc0000017
mov dword [ebp - 0x1c], esi
jmp 0x1a0d01e
and dword [edi + 0x24], 0
mov byte [esi], 0
jmp 0x1a0cf85
mov edi, dword [ebp - 0x20]
call fcn.01aa5c15
mov esi, 0xc000000d
jmp 0x1a0cff3
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x1a0d03c
Function at 0x1a0d266
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
test ecx, ecx
je 0x1a0d2bf
test edx, edx
je 0x1a0d2bf
mov esi, dword [ebp + 8]
test esi, esi
je 0x1a0d2bf
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a0d2bf
mov eax, dword [esi + 0x28]
push 0x1e
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 8
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], edx
push eax
push ecx
call fcn.01a22bd0
test eax, eax
js 0x1a0d2b8
xor edx, edx
mov ecx, esi
inc edx
call fcn.01a0d2cb
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x1a0d2b8
Function at 0x1a0d8c0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0xc00000bb
test edi, edi
je 0x1a512d7
cmp dword [edi + 0x24], 0
jne 0x1a512d7
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x1a0d998
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
test eax, eax
je 0x1a512dc
cmp dword [0x1ac86dc], eax
je 0x1a512d3
or ecx, 0xffffffff
lock xadd dword [eax + 0xf8], ecx
dec ecx
mov dword [ebp - 0x10], ecx
lock inc dword [eax + 0xfc]
add eax, 8
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov edx, eax
mov esi, ecx
lea eax, [ecx + 1]
mov dword [ebp - 0xc], edx
xor eax, ecx
movzx ebx, ax
mov eax, esi
xor ebx, ecx
mov ecx, dword [ebp - 4]
lock cmpxchg8b qword [edi]
mov ecx, eax
mov eax, edx
mov dword [ebp - 4], eax
cmp ecx, esi
jne 0x1a0d931
cmp eax, dword [ebp - 0xc]
jne 0x1a0d931
mov edi, dword [ebp + 8]
xor esi, esi
inc esi
or dword [edi + 0x50], 0x10
mov ecx, dword [edi + 0x4c]
mov dword [edi + 0x24], esi
test ecx, ecx
jne 0x1a0d9a0
cmp dword [ebp - 0x10], 0
je 0x1a0d980
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov eax, dword [ebp - 8]
push 9
push dword [eax + 0x24]
call fcn.01a24280
jmp 0x1a0d977
mov eax, dword [edi + 0x48]
jmp 0x1a0d8f3
call fcn.019e65d0
jmp 0x1a0d96f
mov ecx, esi
jmp 0x1a512e1
call fcn.01aa5c15
mov ecx, 0xc000000d
mov eax, ecx
sub eax, esi
neg eax
sbb eax, eax
and eax, ecx
jmp 0x1a0d977