joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034a09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10034a18
pop dword [ebp - 0x24]
mov eax, 0x10034a18
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x4f3ca
push 0
mov eax, 0xa1e5cf7d
sub eax, 0x91dcbd4d
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x3edb
xor edx, edx
add edx, eax
mov esi, 0x1cdf932
sub esi, 0xf1bca732
add esi, dword [ebp - 0x24]
mov ebx, 0xa6276105
sub ebx, 0x32dd35a2
sub dword [ebp - 0x10], edx
mov edi, dword [esi]
sub dword [ebp - 4], esi
sub edi, ebx
xor dword [ebp - 0x20], ecx
mov dword [edx], edi
add dword [ebp - 0x20], edx
add edx, 0x6494c2fc
sub edx, 0x6494c2f8
add esi, 0x1abd5fb
add esi, 0xfe542a09
loop 0x10034a6e
add eax, 0xaa928cfd
add eax, 0x556e6142
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xee9985ca
sub ecx, 0xde9985ca
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x10046b8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10046ba0
test al, 0x10
jne 0x10046ba0
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x10046ba3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
jne 0x10046bb1
xor eax, eax
jmp 0x10046be4
movzx eax, word [esi]
mov ecx, eax
push ebx
mov ebx, edi
test ax, ax
je 0x10046be1
mov ecx, esi
movzx edx, word [ecx + 2]
movzx ecx, ax
shl ecx, 0x10
or ecx, edx
xor edi, ecx
test dx, dx
je 0x10046be1
add ebx, 2
lea ecx, [esi + ebx*2]
movzx eax, word [ecx]
test ax, ax
jne 0x10046bc0
mov eax, edi
pop ebx
pop edi
pop esi
ret

Function at 0x100470b6
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x1004710c
test esi, esi
je 0x1004710c
push 2
pop edx
call fcn.10034a09
mov edi, eax
test edi, edi
jne 0x100470d7
mov eax, 0x80004005
jmp 0x10047111
mov ecx, esi
call fcn.10001da2
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push 0
push edi
call dword [sym.imp.advapi32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x10047111
mov eax, 0x80070057
pop edi
pop esi
ret 4

Function at 0x10047116
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10047126
mov eax, 0x80070057
jmp 0x1004716a
call fcn.10034a09
mov edi, eax
test edi, edi
je 0x10047167
push 0
call fcn.100474e6
neg eax
sbb eax, eax
and eax, 0x100
push eax
push esi
push edi
call dword [sym.imp.advapi32.dll_RegDeleteKeyExW]
push edi
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp esi, 2
je 0x10047167
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x1004716a
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret
Function at 0x10056595
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc0
mov eax, 0x1008eff9
call fcn.1008bdcf
mov eax, dword [ebp - 0xc8]
xor ebx, ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc8], 0x100fd92c
mov dword [0x100fd92c], ebx
mov dword [0x100fd930], ebx
mov dword [0x100fd934], ebx
xor ecx, ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], ebx
push eax
inc ecx
push ecx
push ebx
push str.Control_PanelInternational
push ADsGetObject
mov dword [ebp - 0xcc], ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10056732
mov edi, dword [sym.imp.advapi32.dll_RegGetValueW]
lea eax, [ebp - 0xc0]
push eax
push ebx
push ebx
push 0x20000020
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
mov dword [ebp - 0xc0], ebx
call edi
test eax, eax
jne 0x10056726
cmp dword [ebp - 0xc0], 3
jbe 0x10056726
push dword [ebp - 0xc0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10056726
lea eax, [ebp - 0xc0]
push eax
push esi
push ebx
push 0x20
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
call edi
test eax, eax
jne 0x1005671e
mov ebx, dword [ebp - 0xc0]
cmp ebx, 3
jbe 0x1005671e
xor edx, edx
shr ebx, 1
push edx
pop ecx
mov eax, edx
mov edi, edx
mov word [esi + ebx*2 - 2], cx
je 0x1005671e
jmp 0x100566ab
cmp eax, ebx
jae 0x100566b1
inc eax
cmp word [esi + eax*2], dx
je 0x100566a6
cmp word [esi + edi*2], dx
jne 0x10056719
cmp edi, eax
jbe 0x10056719
xor ecx, ecx
lea eax, [esi + eax*2]
mov word [ebp - 0xbc], cx
lea ecx, [ebp - 0xbc]
push 0x55
push ecx
push eax
call dword [sym.imp.kernel32.dll_ResolveLocaleName]
test eax, eax
je 0x10056714
cmp word [ebp - 0xbc], 0
je 0x10056714
mov eax, dword [0x100fd930]
lea ecx, [ebp - 0xbc]
push ecx
cmp eax, dword [0x100fd934]
je 0x10056709
mov ecx, eax
call fcn.10034a09
add dword [0x100fd930], 0x18
jmp 0x10056714
push eax
mov ecx, 0x100fd92c
call fcn.1005ca38
lea eax, [edi + 1]
xor edx, edx
inc edi
cmp edi, ebx
jb 0x100566ab
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push dword [ebp - 0xc4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 0x100fd92c
call fcn.1008bd84
ret 4
Function at 0x411077
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x417478
call fcn.00411850
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, ebx
mov esi, 0x4198ac
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x410f4a
cmp eax, edx
jne 0x410f33
xor esi, esi
inc esi
mov edi, esi
jmp 0x410f4d
xor esi, esi
inc esi
cmp dword [0x4198b0], esi
jne 0x410f5f
push 0x1f
call sub.MSVCR120.dll__amsg_exit
pop ecx
jmp 0x410f99
cmp dword [0x4198b0], ebx
jne 0x410f93
mov dword [0x4198b0], esi
push 0x4143cc
push 0x4143bc
call sub.MSVCR120.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x410f99
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x411071
mov dword [0x419520], esi
cmp dword [0x4198b0], esi
jne 0x410fbc
push 0x4143b8
push 0x414394
call sub.MSVCR120.dll__initterm
pop ecx
pop ecx
mov dword [0x4198b0], 2
test edi, edi
jne 0x410fc9
xor eax, eax
mov ecx, 0x4198ac
xchg dword [ecx], eax
cmp dword [0x4198b4], 0
je 0x410feb
push 0x4198b4
call fcn.00404ae0
pop ecx
test eax, eax
je 0x410feb
push ebx
push 2
push ebx
call dword [0x4198b4]
mov ecx, dword [0x419534]
mov eax, dword [sym.imp.MSVCR120.dll___winitenv]
mov dword [eax], ecx
push dword [0x419534]
push dword [0x419530]
push dword [0x41952c]
call fcn.00404ae0
add esp, 0xc
mov dword [0x419524], eax
cmp dword [0x419528], 0
jne 0x411056
push eax
call dword [sym.imp.MSVCR120.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.MSVCR120.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x419520], 0
jne 0x41106a
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x419524]
mov dword [ebp - 4], 0xfffffffe
call fcn.00411895
ret
call fcn.00404ae0
jmp 0x410f12
Function at 0x100047b8
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x10004cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10004cdc
or eax, eax
ret
Function at 0x10013d88
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e5d2b
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
or dword [esi + 0x7c], 0xffffffff
push 0x4c
lea eax, [esi + 0x3e8]
push ebx
push eax
mov byte [ebp - 4], 9
mov dword [esi + 0x78], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [esi + 0x444]
mov byte [esi + 0x434], bl
mov byte [esi + 0x435], bl
mov byte [esi + 0x436], bl
mov byte [esi + 0x437], bl
mov byte [esi + 0x438], bl
mov dword [esi + 0x43c], ebx
mov dword [esi + 0x440], ebx
call fcn.100025df
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100142f9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100e5de8
call fcn.100e0f70
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov ecx, dword [eax + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebx + 0x14], ecx
mov ecx, dword [eax + 0x18]
mov dword [ebx + 0x18], ecx
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x1c], ecx
mov ecx, dword [eax + 0x20]
mov dword [ebx + 0x20], ecx
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x24], ecx
mov ecx, dword [eax + 0x28]
mov dword [ebx + 0x28], ecx
mov ecx, dword [eax + 0x2c]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [eax + 0x30]
mov dword [ebx + 0x30], ecx
mov ecx, dword [eax + 0x34]
mov dword [ebx + 0x34], ecx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x38], ecx
mov ecx, dword [eax + 0x3c]
mov dword [ebx + 0x3c], ecx
mov ecx, dword [eax + 0x40]
mov dword [ebx + 0x40], ecx
mov ecx, dword [eax + 0x40]
mov dword [ebx + 0x40], ecx
mov ecx, dword [eax + 0x44]
mov dword [ebx + 0x44], ecx
mov ecx, dword [eax + 0x48]
mov dword [ebx + 0x48], ecx
mov ecx, dword [eax + 0x4c]
mov dword [ebx + 0x4c], ecx
mov ecx, dword [eax + 0x50]
mov dword [ebx + 0x50], ecx
mov cx, word [eax + 0x54]
mov word [ebx + 0x54], cx
mov cx, word [eax + 0x56]
mov word [ebx + 0x56], cx
mov ecx, dword [eax + 0x58]
mov dword [ebx + 0x58], ecx
mov ecx, dword [eax + 0x5c]
push 0xa
mov dword [ebx + 0x5c], ecx
lea esi, [eax + 0x60]
lea edi, [ebx + 0x60]
pop ecx
add eax, 0x88
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x88]
mov dword [ebp - 0x10], ebx
call fcn.10001e14
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebx + 0x9c]
mov al, byte [esi + 0x94]
mov byte [ebx + 0x94], al
mov al, byte [esi + 0x95]
mov byte [ebx + 0x95], al
mov eax, dword [esi + 0x98]
mov dword [ebx + 0x98], eax
lea eax, [esi + 0x9c]
push eax
call fcn.10088429
lea eax, [esi + 0xa8]
lea ecx, [ebx + 0xa8]
push eax
mov byte [ebp - 4], 1
call fcn.10014523
mov eax, dword [esi + 0xb4]
add esi, 0xc0
mov dword [ebx + 0xb4], eax
mov eax, dword [esi - 8]
mov dword [ebx + 0xb8], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0xc0]
mov dword [ebx + 0xbc], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100180e3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e6168
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10001e14
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10001e14
mov eax, dword [esi + 0x18]
add esi, 0x40
mov dword [ebx + 0x18], eax
mov eax, dword [esi - 0x24]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi - 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi - 0x1c]
mov dword [ebx + 0x24], eax
mov eax, dword [esi - 0x18]
mov dword [ebx + 0x28], eax
mov al, byte [esi - 0x14]
mov byte [ebx + 0x2c], al
mov al, byte [esi - 0x13]
mov byte [ebx + 0x2d], al
mov al, byte [esi - 0x12]
mov byte [ebx + 0x2e], al
mov al, byte [esi - 0x11]
mov byte [ebx + 0x2f], al
mov al, byte [esi - 0x10]
mov byte [ebx + 0x30], al
mov al, byte [esi - 0xf]
mov byte [ebx + 0x31], al
mov ax, word [esi - 0xe]
mov word [ebx + 0x32], ax
mov eax, dword [esi - 8]
mov dword [ebx + 0x38], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x40]
mov dword [ebx + 0x3c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1001c9c9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100e658b
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x20]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
lea eax, [edi + 0x20]
push eax
call fcn.10001e14
mov eax, dword [edi + 0x2c]
and dword [ebp - 4], 0
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
add edi, 0x58
lea ecx, [esi + 0x58]
push edi
mov dword [esi + 0x54], eax
call fcn.1001449e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10025bae
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100e6c21
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f00e8
mov dword [esi + 4], 0x100f00cc
mov dword [esi + 8], 0x100f00bc
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push fcn.10025d13
push 0x10025d09
push 6
lea eax, [esi + 0x160]
push 8
push eax
mov byte [ebp - 4], 6
call fcn.100e125a
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100f290c
mov dword [esi + 4], 0x100f28f0
mov dword [esi + 8], 0x100f28e0
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10031cdb
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
mov ecx, dword [esp + 8]
lea esi, [edx + ecx]
cmp edx, esi
je 0x10031d0a
push edi
movzx edi, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, edi
shr eax, 8
movzx ecx, word [ecx*2 + 0x1010f600]
xor eax, ecx
inc edx
cmp edx, esi
jne 0x10031cea
pop edi
pop esi
ret 4

Function at 0x100368e6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e7b3a
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f00e8
mov dword [esi + 4], 0x100f0770
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.100025df
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100f4514
mov dword [esi + 4], 0x100f4504
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1003ae17
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x100e7e8d
call fcn.100e0f70
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0x18]
mov dword [ebx], eax
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.1003aeb6
and dword [ebp - 4], 0
lea eax, [esi + 0x24]
push eax
lea ecx, [ebx + 0x24]
call fcn.1003af25
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.1003af94
mov eax, dword [ebp + 8]
push 0xa
add esi, 0x40
lea edi, [ebx + 0x40]
pop ecx
add eax, 0x68
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x68]
mov byte [ebp - 4], 2
call fcn.1001449e
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1004463a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x14
pop eax
cmp edx, eax
jb case.0x10044745.8
mov esi, dword [ebp + 8]
mov di, word [esi]
mov word [ecx], di
mov di, word [esi + 2]
mov bx, word [ecx]
mov word [ecx + 2], di
mov di, word [esi + 4]
mov word [ecx + 4], di
mov di, word [esi + 6]
mov word [ecx + 6], di
xor edi, edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x18], edi
cmp bx, 2
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x1c], edi
je 0x1004479e
cmp bx, 9
je 0x10044798
cmp bx, 1
jne 0x100446c6
cmp edx, 0x20
jb case.0x10044745.8
mov eax, dword [esi + 0x10]
push 0x20
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
movzx eax, word [esi + 0x18]
cdq
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
movzx eax, word [esi + 0x1a]
mov dword [ecx + 0xc], eax
pop eax
jmp 0x10044816
cmp bx, 8
jne 0x1004472f
push 0x28
pop eax
cmp edx, eax
jb case.0x10044745.8
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edi
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x1c], edi
movzx edx, word [esi + 0x20]
movzx ebx, word [esi + 0x22]
cmp edx, edi
mov dword [ecx + 0xc], ebx
jbe 0x10044816
lea ecx, [eax + 0xc]
cmp ecx, dword [ebp + 0xc]
ja case.0x10044745.8
mov ecx, dword [eax + esi + 8]
lea eax, [eax + ecx + 0xd]
cmp eax, dword [ebp + 0xc]
ja case.0x10044745.8
cmp ecx, 0x400
ja case.0x10044745.8
inc edi
cmp edi, edx
jb 0x100446fc
jmp 0x10044816
movzx edx, bx
add edx, 0xfffffffd
cmp edx, 0xb
ja case.0x10044745.8
movzx edx, byte [edx + 0x1004482d]
jmp dword [edx*4 + 0x1004481d]
cmp dword [ebp + 0xc], 0x18
jb case.0x10044745.8
mov esi, dword [esi + 0x14]
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], edi
lea eax, [esi + 0x18]
cmp dword [ebp + 0xc], eax
jb case.0x10044745.8
cmp esi, 0x40000000
jbe case.0x10044745.6
jmp case.0x10044745.8
push 0x18
pop eax
cmp dword [ebp + 0xc], eax
jb case.0x10044745.8
cmp bx, 8
jb 0x10044816
add eax, 4
cmp dword [ebp + 0xc], eax
jb case.0x10044745.8
jmp 0x10044816
cmp bx, 2
jne 0x100447c5
cmp edx, 0x20
jb case.0x10044745.8
mov eax, dword [esi + 0x10]
push 0x20
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
mov eax, dword [esi + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edi
jmp 0x100447f0
cmp edx, 0x38
jb case.0x10044745.8
mov eax, dword [esi + 0x10]
push 0x38
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 0xc], eax
pop esi
push dword [ebp + 0x10]
call fcn.100445f2
push edi
push 4
push edx
push eax
call fcn.100e1100
xor ecx, ecx
add eax, esi
adc edx, ecx
cmp edx, ecx
ja case.0x10044745.8
jb 0x10044816
cmp eax, dword [ebp + 0xc]
jbe 0x10044816
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10044a28
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e8859
call fcn.100e0f70
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f5e7c
mov dword [esi + 4], 0x100f5e6c
lea ecx, [esi + 0x168]
mov dword [ebp - 4], 0x10
call fcn.100da510
mov eax, dword [esi + 0x89c]
test eax, eax
je 0x10044a5d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x890]
call fcn.100035f8
mov eax, dword [esi + 0x164]
pop ecx
test eax, eax
mov byte [ebp - 4], 0xe
je 0x10044a7d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x15c]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x10044a91
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x154]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x10044aa5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x138]
call fcn.100035f8
push dword [esi + 0x12c]
call fcn.100035f8
push dword [esi + 0x120]
call fcn.100035f8
mov eax, dword [esi + 0x108]
add esp, 0xc
test eax, eax
mov byte [ebp - 4], 8
je 0x10044add
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x90]
call fcn.100035f8
push dword [esi + 0x88]
call fcn.100035f8
push dword [esi + 0x7c]
call fcn.100035f8
add esp, 0xc
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 4
call fcn.10044b46
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 3
call fcn.10044b46
push dword [esi + 0x30]
call fcn.100035f8
push dword [esi + 0x24]
call fcn.100035f8
push dword [esi + 0x18]
call fcn.100035f8
push dword [esi + 0xc]
call fcn.100035f8
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x10049d0d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e8b64
call fcn.100e0f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10001e14
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.10001e14
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x28]
mov byte [esi + 0x28], al
mov al, byte [edi + 0x29]
mov byte [esi + 0x29], al
mov al, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
mov al, byte [edi + 0x2b]
mov byte [esi + 0x2b], al
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4