joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10819a4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
push 0x10299b8
call fcn.0106bf63
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push 0x1029948
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1081ab3
push 4
pop edi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x1029928
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x1081ab3
cmp dword [ebp - 0x24], edi
jne 0x1081ab3
cmp dword [ebp - 0x28], 1
jne 0x1081ab3
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x1029910
push dword [ebp - 0x1c]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x1081a49
cmp dword [ebp - 0x24], edi
jne 0x1081a49
mov eax, dword [ebp - 0x28]
mov dword [0x1099e74], eax
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x10298f8
push dword [ebp - 0x1c]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x1081a7b
cmp dword [ebp - 0x24], edi
jne 0x1081a7b
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x1081a7b
mov dword [0x1099e78], eax
or dword [ebp - 4], 0xffffffff
call fcn.01081ac6
push ebx
push 0x40000080
push 3
push ebx
push ebx
push 0xc0000000
push 0x10298e4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x1099e70], eax
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
call fcn.0106bf9e
ret
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.msvcrt.dll__local_unwind2
pop ecx
pop ecx
xor eax, eax
jmp 0x1081aad

Function at 0x1081f6a
Capabilities:
Enumerate services

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push 5
push esi
push esi
mov dword [ebp - 4], esi
mov dword [eax], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x1082003
push ebx
push edi
xor ebx, ebx
mov edi, 0x1000
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push ebx
call sub.msvcrt.dll_free
add edi, dword [ebp - 0xc]
push edi
call sub.msvcrt.dll_malloc
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x1081fee
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push 1
push 0x30
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
test eax, eax
jne 0x108200f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x108200b
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jb 0x1081f9d
push ebx
call sub.msvcrt.dll_free
pop ecx
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
cmp eax, esi
jne 0x1081fee
cmp dword [ebp - 4], esi
je 0x1081fee
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x1081ff8
Function at 0x10821e5
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0xd
pop ecx
xor ebx, ebx
push ebx
push ebx
push 0x1004
push dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 0x3c]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
call esi
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0x1007
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x1082232
or eax, eax
jmp 0x10822d5
mov edi, dword [ebp + 0xc]
push dword [edi + 4]
push dword [edi]
push dword [edi + 8]
push 0x1029b50
call fcn.01071ac0
add esp, 0x10
test byte [0x10bd0f0], 4
mov ebx, 0x102e
je 0x108228c
push dword [edi + 8]
push 0x1029b48
push 0x1106960
call sub.msvcrt.dll_sprintf
and dword [ebp - 0x68], 0
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 1
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x5c], 0x1106960
call esi
test byte [0x10bd0f0], 1
je 0x10822b0
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
mov dword [ebp - 0x68], eax
mov eax, dword [edi]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call esi
test byte [0x10bd0f0], 2
je 0x10822d2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x68], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x108874f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1099a38]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x214]
push eax
call fcn.01088615
test eax, eax
jne 0x108881c
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1088788
mov ecx, dword [ebp + 8]
sub eax, edx
push esi
mov esi, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x108879a
sub ecx, edx
lea eax, [ecx + esi + 1]
cmp eax, 0x104
jbe 0x10887b3
push 0x7a
pop eax
jmp 0x108881b
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10887be
lea eax, [ebp - 0x10c]
push 0x102b518
push eax
call sub.msvcrt.dll_strstr
test eax, eax
pop ecx
pop ecx
jne 0x10887e3
push 0x57
jmp 0x10887b0
push edi
mov edi, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
mov esi, 0x102b510
push eax
movsd dword es:[edi], dword [esi]
push 0x1020a90
push ebx
movsb byte es:[edi], byte [esi]
call sub.msvcrt.dll_sprintf
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop edi
jne 0x1088819
mov byte [ebx], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0106bc50
leave
ret 8

Function at 0x1088829
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1099a38]
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
call fcn.010886d9
test eax, eax
jne 0x1088873
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x108886e
test al, 0x50
jne 0x108886e
mov dword [esi], 1
jmp 0x1088871
and dword [esi], 0
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.0106bc50
leave
ret 4
Function at 0x101ba370
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x101c7b34], 0
mov byte [0x101c7b38], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x101c7b28], 0x25ec
mov dword [0x101c7b30], 0
mov dword [ebp - 0x1c], eax
jmp 0x101ba4d0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x1b14
mov edi, 0xfffff02c
mov ebx, 0x100
mov dword [0x101c7b3c], 0
mov dword [0x101c7b28], eax
mov eax, dword [0x101c7b34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + ecx]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x2c]
add eax, ecx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 0x38], edx
mov edx, ecx
mov ecx, dword [ebp - 0x10]
div ecx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
mov ecx, dword [ebp - 0x34]
add ecx, edx
mov dword [0x101c7b3c], ecx
mov eax, ecx
cdq
idiv ebx
mov dword [0x101c7b34], edx
mov dword [0x101c7b28], 0x1802
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x30]
mov cl, byte [ecx + ebx]
mov byte [0x101c7b38], cl
mov ecx, dword [ebp - 0x38]
mov dword [0x101c7b28], ecx
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], cl
mov cl, byte [0x101c7b38]
mov edx, dword [0x101c7b34]
mov ebx, dword [ebp - 0x18]
mov byte [ebx + edx], cl
mov dword [0x101c7b28], 0x2b4
mov dword [0x101c7b2c], 0xfffff6fd
mov edx, dword [0x101c7b30]
add edx, 1
mov dword [0x101c7b30], edx
cmp edx, 0x100
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edi
jl 0x101ba3ba
jmp 0x101ba51c
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov dword [0x101c7b30], 0
mov edx, eax
add edx, 0xffffd26b
add eax, 0x2417
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], edx
jmp 0x101ba3ba
mov eax, dword [ebp - 0x1c]
mov dword [0x101c7b2c], 0xaf6
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101c7b2c]
mov esi, eax
add esi, 0xffffe4f3
mov dword [0x101c7b28], esi
mov esi, dword [0x101c7b30]
add esi, 1
mov dword [0x101c7b30], esi
cmp esi, 0x100
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], esi
jl 0x101ba4d0
jmp 0x101ba4a6
mov dword [0x101c7b28], 0xffffeb3b
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101ba5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp eax, 0
sete bl
mov dword [0x101c7b30], 0
mov dword [0x101c7b34], 0
mov dword [0x101c7b40], 0
mov edi, dword [0x101c7b28]
add edi, 0x3c3
mov dword [0x101c7b28], edi
mov dword [0x101c7b2c], 0x5f1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x1d], bl
mov al, byte [ebp - 0x1d]
test al, 1
jne 0x101ba7aa
jmp 0x101ba656
mov eax, dword [0x101c7b30]
mov dword [ebp - 0x24], eax
mov eax, dword [0x101c7b34]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
jmp 0x101ba667
jmp 0x101ba7aa
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], eax
jmp 0x101ba667
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov esi, 0x100
mov dword [0x101c7b2c], 0x1cfd
add ecx, 1
mov dword [ebp - 0x38], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x101c7b30], edx
mov dword [0x101c7b28], 0x18db
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x3c]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x40], edx
cdq
idiv esi
mov dword [0x101c7b34], edx
mov dword [0x101c7b2c], 0x198a
mov esi, dword [ebp - 0x40]
mov cl, byte [ecx + esi]
mov byte [0x101c7b38], cl
mov dword [0x101c7b28], 0x13a5
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x101c7b2c], 0x1ce8
mov dword [0x101c7b28], 0x15f
mov cl, byte [0x101c7b38]
mov edx, dword [0x101c7b34]
mov byte [edi + edx], cl
mov edx, dword [0x101c7b28]
add edx, 0xffffedd6
mov dword [0x101c7b28], edx
mov edx, dword [0x101c7b30]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101c7b34]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101c7b40], ebx
mov dword [0x101c7b28], 0x2cc
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x38]
mov ch, byte [edx + ebx]
mov edx, dword [0x101c7b2c]
mov bl, cl
add bl, byte [0x101c7b45]
mov byte [0x101c7b44], bl
mov byte [0x101c7b45], ch
mov byte [0x101c7b46], cl
xor ch, cl
add edx, 0xffffee6e
mov dword [0x101c7b2c], edx
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x38]
mov byte [edx + esi], ch
mov dword [0x101c7b28], 0x13c3
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x28], esi
je 0x101ba651
jmp 0x101ba633
mov dword [0x101c7b28], 0xb60
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101bafb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x101c7b2c], 0x1626
mov ecx, dword [0x101c7b28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x31
mov dword [0x101c7b28], eax
call fcn.101ba970
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x101c7b28], 0xd6b
mov esi, dword [eax + esi + 0x78]
mov dword [0x101c7b28], 0x12
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x101c7b2c], 0x40a
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ecx
je 0x101bb12a
xor eax, eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
add ecx, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x20]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
mov byte [ebp - 0x4b], bl
je 0x101bb0be
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dl, byte [ebp - 0x4a]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x4b], dl
jne 0x101bb062
mov al, byte [ebp - 0x4b]
test al, 1
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x50], ecx
jne 0x101bb0f4
mov eax, dword [ebp - 0x3c]
add eax, 2
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
add eax, 1
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], eax
jb 0x101bb048
jmp 0x101bb123
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
mov dword [0x101c7b2c], 0x182a
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x20]
add esi, dword [ecx + eax*4]
mov dword [0x101c7b28], 0x274
mov dword [ebp - 0x2c], esi
jmp 0x101bb12a
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x101bb12a
mov eax, dword [ebp - 0x2c]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101bb140
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword [0x101c7b2c]
add eax, 0x1c78
mov dword [0x101c7b2c], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x101c7b2c], 0x19
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x101bb1b0
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x101bb183
mov eax, dword [ebp - 0x18]
mov dword [0x101c7b2c], 0x56e
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x101bb285
mov dword [0x101c7b28], 0x582
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x101bb285
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101bb285
mov dword [0x101c7b28], 0x7df
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x1e], dx
mov ax, word [ebp - 0x1e]
cmp ax, 0x64
jne 0x101bb285
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1f]
test al, 1
jne 0x101bb23f
jmp 0x101bb285
mov dword [0x101c7b28], 0x91c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x101bb285
mov dword [0x101c7b2c], 0x153e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x101bb285
mov eax, 1
mov dword [0x101c7b2c], 0x190e
mov dword [ebp - 0x24], eax
jmp 0x101bb296
mov dword [0x101c7b28], 0x10e3
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x101bb296
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x101bbbd0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov dword [0x101c7b28], 0x1594
call fcn.10001090
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
je 0x101bbc73
jmp 0x101bbd6a
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x40]
mov dword [esp + 0x84], eax
mov dword [0x101c7b2c], 0x2099
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x74], eax
mov dword [0x101c7b28], 0xa15
mov eax, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.101bacd0
mov ecx, dword [0x101c7b28]
add ecx, 0xbd7
mov dword [0x101c7b28], ecx
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x101c7b28], 0x1824
mov dword [esp + 0x20], eax
jmp 0x101bbd62
lea eax, [esp + 0x40]
mov dword [0x101c7b2c], 0x1aa1
mov dword [0x101c7b28], 0x17ad
mov dword [esp + 0x1c], eax
call fcn.101bb140
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x20], ecx
jne 0x101bbd62
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.101bb380
lea ecx, [0x101ba060]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x8c], edx
mov dword [0x101c7b2c], 0x1364
mov dword [esp + 0x7c], 0x12da00
mov edx, dword [0x101c7b14]
mov dword [esp + 0x94], edx
mov edx, dword [0x101c7b18]
mov dword [esp + 0x78], edx
mov edx, dword [0x101c7b1c]
mov dword [esp + 0x6c], edx
mov edx, dword [0x101c7b20]
mov dword [esp + 0x50], edx
mov edx, dword [0x101c7b24]
mov dword [esp + 0x44], edx
mov dword [0x101c7b28], 0x423
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x101bbd46
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
je 0x101bbbfd
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
jmp 0x101bbd1b
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x40b6b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e800c
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6780cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x48], edi
xor eax, eax
mov dword [edi], vtable.oobe::Logger.0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 7
mov word [edi + 8], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
mov dword [edi + 0x38], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], 7
mov word [edi + 0x38], ax
mov dword [edi + 0x50], eax
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], 7
mov word [edi + 0x50], ax
lea ecx, [edi + 0x68]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push 0x6457cc
mov byte [ebp - 4], 4
call fcn.00404650
call fcn.0042d890
mov dword [edi + 4], eax
push 4
mov dword [ebp - 4], 5
lea ecx, [edi + 0x20]
push 0x6457cc
mov dword [edi], vtable.C3Logger.0
call fcn.00404650
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0xa
push 0xa
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.005cc6b2
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], 0
add esp, 0x10
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b7b2
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00403460
mov byte [ebp - 4], 6
lea edx, [ebp - 0x44]
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x40b7e4
mov edx, dword [ebp - 0x44]
test edx, edx
je 0x40b80f
mov eax, edx
lea esi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b7f0
sub eax, esi
lea ecx, [edi + 8]
sar eax, 1
push eax
push edx
call fcn.00404650
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x40b83f
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40b835
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b85f
push ecx
push edx
call fcn.005a5f31
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a5aba
mov esp, ebp
pop ebp
ret 4
call fcn.005bd02a
int3