joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102deaf0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x10a21b93
call fcn.103a4800
nop
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x102deb44
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x102deb44
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x102deb44
xor eax, eax
jmp 0x102deb85
mov dword [ebp - 4], 1
jmp 0x102deb56
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x102deb80
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x102deb7e
xor eax, eax
jmp 0x102deb85
jmp 0x102deb4d
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x102f2e70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov ecx, 0x10a21b27
call fcn.103a4800
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 0x10]
call fcn.10062f90
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x811c9dc5
mov dword [ebp - 4], 0
jmp 0x102f2eba
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jae 0x102f2ed9
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp - 8]
imul ecx, eax, 0x1000193
mov dword [ebp - 8], ecx
jmp 0x102f2eb1
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.102f2f10
add esp, 0xc
mov ecx, dword [ebp - 0xc]
or ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x102f46f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x106a6100]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10a21b27
call fcn.103a4800
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x102f472e
xor al, al
jmp 0x102f4892
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x102f474c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x2c]
je 0x102f484d
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov dword [ebp - 0x24], edx
jne 0x102f4765
jmp 0x102f4744
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x34], 0
je 0x102f4796
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
jmp 0x102f479d
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x102f47bd
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x102f47c9
mov byte [ebp - 0xe], 0
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
jmp 0x102f4804
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], edx
je 0x102f47e2
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x4550
je 0x102f47ee
mov byte [ebp - 0xf], 0
mov cl, byte [ebp - 0xf]
mov byte [ebp - 0xd], cl
jmp 0x102f4804
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10], 1
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x102f4817
jmp 0x102f4744
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100e0ae0
nop
jmp 0x102f4744
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 8]
jne 0x102f486a
mov dword [ebp - 0x40], 1
jmp 0x102f4871
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x12], al
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x102f4888
mov dword [ebp - 0x44], 1
jmp 0x102f488f
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f5040
mov esp, ebp
pop ebp
ret
Function at 0x103077c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov ecx, 0x10a21b27
call fcn.103a4800
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 0x10]
call fcn.10062f90
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x811c9dc5
mov dword [ebp - 4], 0
jmp 0x1030780a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jae 0x10307829
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp - 8]
imul ecx, eax, 0x1000193
mov dword [ebp - 8], ecx
jmp 0x10307801
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10307860
add esp, 0xc
mov ecx, dword [ebp - 0xc]
or ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10309040
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x106a6100]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10a21b27
call fcn.103a4800
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x1030907e
xor al, al
jmp 0x103091e2
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x1030909c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x2c]
je 0x1030919d
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov dword [ebp - 0x24], edx
jne 0x103090b5
jmp 0x10309094
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x34], 0
je 0x103090e6
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
jmp 0x103090ed
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1030910d
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10309119
mov byte [ebp - 0xe], 0
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
jmp 0x10309154
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], edx
je 0x10309132
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x4550
je 0x1030913e
mov byte [ebp - 0xf], 0
mov cl, byte [ebp - 0xf]
mov byte [ebp - 0xd], cl
jmp 0x10309154
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10], 1
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x10309167
jmp 0x10309094
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100e0ae0
nop
jmp 0x10309094
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 8]
jne 0x103091ba
mov dword [ebp - 0x40], 1
jmp 0x103091c1
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x12], al
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x103091d8
mov dword [ebp - 0x44], 1
jmp 0x103091df
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f5040
mov esp, ebp
pop ebp
ret
Function at 0x103291c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x106a6100]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10a21b27
call fcn.103a4800
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x103291fe
xor al, al
jmp 0x10329362
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x1032921c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x2c]
je 0x1032931d
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov dword [ebp - 0x24], edx
jne 0x10329235
jmp 0x10329214
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x34], 0
je 0x10329266
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
jmp 0x1032926d
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1032928d
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10329299
mov byte [ebp - 0xe], 0
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
jmp 0x103292d4
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], edx
je 0x103292b2
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x4550
je 0x103292be
mov byte [ebp - 0xf], 0
mov cl, byte [ebp - 0xf]
mov byte [ebp - 0xd], cl
jmp 0x103292d4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10], 1
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x103292e7
jmp 0x10329214
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100e0ae0
nop
jmp 0x10329214
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 8]
jne 0x1032933a
mov dword [ebp - 0x40], 1
jmp 0x10329341
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x12], al
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x10329358
mov dword [ebp - 0x44], 1
jmp 0x1032935f
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f5040
mov esp, ebp
pop ebp
ret
Function at 0x10341b40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov ecx, 0x10a21b27
call fcn.103a4800
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 0x10]
call fcn.10062f90
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x811c9dc5
mov dword [ebp - 4], 0
jmp 0x10341b8a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jae 0x10341ba9
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp - 8]
imul ecx, eax, 0x1000193
mov dword [ebp - 8], ecx
jmp 0x10341b81
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10341be0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
or ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x103433c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x106a6100]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10a21b27
call fcn.103a4800
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x103433fe
xor al, al
jmp 0x10343562
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x1034341c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x2c]
je 0x1034351d
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov dword [ebp - 0x24], edx
jne 0x10343435
jmp 0x10343414
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x34], 0
je 0x10343466
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
jmp 0x1034346d
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1034348d
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10343499
mov byte [ebp - 0xe], 0
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
jmp 0x103434d4
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], edx
je 0x103434b2
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x4550
je 0x103434be
mov byte [ebp - 0xf], 0
mov cl, byte [ebp - 0xf]
mov byte [ebp - 0xd], cl
jmp 0x103434d4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10], 1
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x103434e7
jmp 0x10343414
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100e0ae0
nop
jmp 0x10343414
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 8]
jne 0x1034353a
mov dword [ebp - 0x40], 1
jmp 0x10343541
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x12], al
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x10343558
mov dword [ebp - 0x44], 1
jmp 0x1034355f
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f5040
mov esp, ebp
pop ebp
ret
Function at 0x6b986e32
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6c1e9014]
mov dword [ebp - 0xc], eax
jmp 0x6b986ea2
jmp 0x6b986f04
jmp 0x6b986f66
jmp 0x6b986fc8
jmp 0x6b98702a
jmp 0x6b98708c
jmp 0x6b9870ee
jmp 0x6b987150
jmp 0x6b9871b2
jmp 0x6b987214
jmp 0x6b987276
jmp 0x6b9872d8
jmp 0x6b98733a
jmp 0x6b98739c
jmp 0x6b9873fe
jmp 0x6b987460
jmp 0x6b9874c2
jmp 0x6b987524
jmp 0x6b987586
jmp 0x6b9875e8
jmp 0x6b98764a
jmp 0x6b9876ac
jmp 0x6b98770e
jmp 0x6b987770
jmp 0x6b9877d2
jmp 0x6b987834
jmp 0x6b987896
jmp 0x6b9878f8
jmp 0x6b98795a
cmp dword [ebp - 0xc], 0
je 0x6b98a61e
mov eax, dword [0x6c1e9014]
mov dword [0x6c1e900c], eax
jmp 0x6b9879d0
jmp 0x6b987a32
jmp 0x6b987a94
jmp 0x6b987af6
jmp 0x6b987b58
jmp 0x6b987bba
jmp 0x6b987c1c
jmp 0x6b987c7e
jmp 0x6b987ce0
jmp 0x6b987d42
jmp 0x6b987da4
jmp 0x6b987e06
jmp 0x6b987e68
jmp 0x6b987eca
jmp 0x6b987f2c
jmp 0x6b987f8e
jmp 0x6b987ff0
jmp 0x6b988052
jmp 0x6b9880b4
jmp 0x6b988116
jmp 0x6b988178
jmp 0x6b9881da
jmp 0x6b98823c
jmp 0x6b98829e
jmp 0x6b988300
jmp 0x6b988362
jmp 0x6b9883c4
jmp 0x6b988426
jmp 0x6b988488
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x6c1e9008], eax
jmp 0x6b9884fa
jmp 0x6b98855c
jmp 0x6b9885be
jmp 0x6b988620
jmp 0x6b988682
jmp 0x6b9886e4
jmp 0x6b988746
jmp 0x6b9887a8
jmp 0x6b98880a
jmp 0x6b98886c
jmp 0x6b9888ce
jmp 0x6b988930
jmp 0x6b988992
jmp 0x6b9889f4
jmp 0x6b988a56
jmp 0x6b988ab8
jmp 0x6b988b1a
jmp 0x6b988b7c
jmp 0x6b988bde
jmp 0x6b988c40
jmp 0x6b988ca2
jmp 0x6b988d04
jmp 0x6b988d66
jmp 0x6b988dc8
jmp 0x6b988e2a
jmp 0x6b988e8c
jmp 0x6b988eee
jmp 0x6b988f50
jmp 0x6b988fb2
mov eax, dword [0x6c1e9008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x6b98901f
jmp 0x6b989081
jmp 0x6b9890e3
jmp 0x6b989145
jmp 0x6b9891a7
jmp 0x6b989209
jmp 0x6b98926b
jmp 0x6b9892cd
jmp 0x6b98932f
jmp 0x6b989391
jmp 0x6b9893f3
jmp 0x6b989455
jmp 0x6b9894b7
jmp 0x6b989519
jmp 0x6b98957b
jmp 0x6b9895dd
jmp 0x6b98963f
jmp 0x6b9896a1
jmp 0x6b989703
jmp 0x6b989765
jmp 0x6b9897c7
jmp 0x6b989829
jmp 0x6b98988b
jmp 0x6b9898ed
jmp 0x6b98994f
jmp 0x6b9899b1
jmp 0x6b989a13
jmp 0x6b989a75
jmp 0x6b989ad7
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x6c1e9004], eax
jmp 0x6b989b66
jmp 0x6b989bc8
jmp 0x6b989c2a
jmp 0x6b989c8c
jmp 0x6b989cee
jmp 0x6b989d50
jmp 0x6b989db2
jmp 0x6b989e14
jmp 0x6b989e76
jmp 0x6b989ed8
jmp 0x6b989f3a
jmp 0x6b989f9c
nop
leave
ret
Function at 0x6b98bc99
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6c1e9008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6c1e9008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6b98bd1b
jmp 0x6b98bd7d
jmp 0x6b98bddf
jmp 0x6b98be41
jmp 0x6b98bea3
jmp 0x6b98bf05
jmp 0x6b98bf67
jmp 0x6b98bfc9
jmp 0x6b98c02b
jmp 0x6b98c08d
jmp 0x6b98c0ef
jmp 0x6b98c151
jmp 0x6b98c1b3
jmp 0x6b98c215
jmp 0x6b98c277
jmp 0x6b98c2d9
jmp 0x6b98c33b
jmp 0x6b98c39d
jmp 0x6b98c3ff
jmp 0x6b98c461
jmp 0x6b98c4c3
jmp 0x6b98c525
jmp 0x6b98c587
jmp 0x6b98c5e9
jmp 0x6b98c64b
jmp 0x6b98c6ad
jmp 0x6b98c70f
jmp 0x6b98c771
jmp 0x6b98c7d3
mov dword [ebp - 0x14], 0
jmp 0x6b98c83c
jmp 0x6b98c89e
jmp 0x6b98c900
jmp 0x6b98c962
jmp 0x6b98c9c4
jmp 0x6b98ca26
jmp 0x6b98ca88
jmp 0x6b98caea
jmp 0x6b98cb4c
jmp 0x6b98cbae
jmp 0x6b98cc10
jmp 0x6b98cc72
jmp 0x6b98ccd4
jmp 0x6b98cd36
jmp 0x6b98cd98
jmp 0x6b98cdfa
jmp 0x6b98ce5c
jmp 0x6b98cebe
jmp 0x6b98cf20
jmp 0x6b98cf82
jmp 0x6b98cfe4
jmp 0x6b98d046
jmp 0x6b98d0a8
jmp 0x6b98d10a
jmp 0x6b98d16c
jmp 0x6b98d1ce
jmp 0x6b98d230
jmp 0x6b98d292
jmp 0x6b98d2f4
mov dword [ebp - 0x18], 0
jmp 0x6b98d35d
jmp 0x6b98d3bf
jmp 0x6b98d421
jmp 0x6b98d483
jmp 0x6b98d4e5
jmp 0x6b98d547
jmp 0x6b98d5a9
jmp 0x6b98d60b
jmp 0x6b98d66d
jmp 0x6b98d6cf
jmp 0x6b98d731
jmp 0x6b98d793
jmp 0x6b98d7f5
jmp 0x6b98d857
jmp 0x6b98d8b9
jmp 0x6b98d91b
jmp 0x6b98d97d
jmp 0x6b98d9df
jmp 0x6b98da41
jmp 0x6b98daa3
jmp 0x6b98db05
jmp 0x6b98db67
jmp 0x6b98dbc9
jmp 0x6b98dc2b
jmp 0x6b98dc8d
jmp 0x6b98dcef
jmp 0x6b98dd51
jmp 0x6b98ddb3
jmp 0x6b98de15
mov dword [ebp - 0x10], 0
jmp 0x6b98de7e
jmp 0x6b98dee0
jmp 0x6b98df42
jmp 0x6b98dfa4
jmp 0x6b98e006
jmp 0x6b98e068
jmp 0x6b98e0ca
jmp 0x6b98e12c
jmp 0x6b98e18e
jmp 0x6b98e1f0
jmp 0x6b98e252
jmp 0x6b98e2b4
jmp 0x6b98e316
jmp 0x6b98e378
jmp 0x6b98e3da
jmp 0x6b98e43c
jmp 0x6b98e49e
jmp 0x6b98e500
jmp 0x6b98e562
jmp 0x6b98e5c4
jmp 0x6b98e626
jmp 0x6b98e688
jmp 0x6b98e6ea
jmp 0x6b98e74c
jmp 0x6b98e7ae
jmp 0x6b98e810
jmp 0x6b98e872
jmp 0x6b98e8d4
jmp 0x6b98e936
mov dword [ebp - 0x10], 0
jmp 0x6b99210a
jmp 0x6b98e9a4
jmp 0x6b98ea06
jmp 0x6b98ea68
jmp 0x6b98eaca
jmp 0x6b98eb2c
jmp 0x6b98eb8e
jmp 0x6b98ebf0
jmp 0x6b98ec52
jmp 0x6b98ecb4
jmp 0x6b98ed16
jmp fcn.6b98ed78
mov eax, dword [0x6c1e9008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6b98e942
nop
leave
ret

Function at 0x6b9b1bb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6c1e8040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6b9b1c10