joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002dd19
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x100d74f5
call fcn.100d39f0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0x18]
mov dword [ebx], eax
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.1002de10
and dword [ebp - 4], 0
lea eax, [esi + 0x24]
push eax
lea ecx, [ebx + 0x24]
call fcn.1002ded8
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.100799c2
mov eax, dword [ebp + 8]
push 8
add esi, 0x40
lea edi, [ebx + 0x40]
pop ecx
add eax, 0x60
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x60]
mov byte [ebp - 4], 2
call fcn.10016f42
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100370a6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d7f01
call fcn.100d39f0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100e4fa8
mov dword [esi + 4], 0x100e4f98
lea ecx, [esi + 0x158]
mov dword [ebp - 4], 0xf
call fcn.100cd030
mov eax, dword [esi + 0x88c]
test eax, eax
je 0x100370e6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x880]
call fcn.10003419
mov eax, dword [esi + 0x154]
pop ecx
test eax, eax
mov byte [ebp - 4], 0xd
je 0x10037106
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x14c]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1003711a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x144]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1003712e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x128]
call fcn.10003419
push dword [esi + 0x11c]
call fcn.10003419
push dword [esi + 0x110]
call fcn.10003419
mov eax, dword [esi + 0xf8]
add esp, 0xc
test eax, eax
mov byte [ebp - 4], 7
je 0x10037166
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x7c]
call fcn.10003419
pop ecx
mov byte [ebp - 4], 5
lea ecx, [esi + 0x5c]
call fcn.100371b7
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 4
call fcn.100371b7
push dword [esi + 0x30]
call fcn.10003419
push dword [esi + 0x24]
call fcn.10003419
push dword [esi + 0x18]
call fcn.10003419
push dword [esi + 0xc]
call fcn.10003419
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x1003beb1
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d8238
call fcn.100d39f0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10001d91
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.10001d91
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x28]
mov byte [esi + 0x28], al
mov al, byte [edi + 0x29]
mov byte [esi + 0x29], al
mov al, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
mov al, byte [edi + 0x2b]
mov byte [esi + 0x2b], al
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1003d22d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100d83ac
call fcn.100d39f0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100dfa34
mov dword [esi + 4], 0x100df7f0
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.100024c7
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov dword [esi], 0x100e5d28
mov dword [esi + 4], 0x100e5d18
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1003d2c3
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x100d83e2
call fcn.100d39f0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [esi + 0x30]
mov dword [ebp - 4], 2
call fcn.10003419
pop ecx
lea ecx, [esi + 0x24]
call fcn.100045be
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.1003d439
and byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.1003d3ac
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10044226
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100d8a95
call fcn.100d39f0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov byte [esi], al
mov byte [esi + 1], al
mov byte [esi + 2], al
mov byte [esi + 3], al
mov byte [esi + 4], al
mov byte [esi + 5], al
mov byte [esi + 6], al
mov byte [esi + 7], al
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10043fb2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10044c67
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d8b9a
call fcn.100d39f0
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10001d35
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10001d35
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10001d35
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10001d35
or dword [esi + 0x7c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x64], bl
mov byte [esi + 0x65], bl
mov byte [esi + 0x66], bl
mov byte [esi + 0x67], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100461e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d8d6e
call fcn.100d39f0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10001d91
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10001d91
mov eax, dword [esi + 0x18]
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.10001d91
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
mov byte [ebp - 4], 2
call fcn.10001d91
mov al, byte [esi + 0x64]
push 5
mov byte [ebx + 0x64], al
mov al, byte [esi + 0x65]
mov byte [ebx + 0x65], al
mov al, byte [esi + 0x66]
mov byte [ebx + 0x66], al
mov al, byte [esi + 0x67]
mov byte [ebx + 0x67], al
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x7c], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1004e71c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100d988b
call fcn.100d39f0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.100024c7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1005292e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d9de8
call fcn.100d39f0
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.1005efa7
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.1004ed1d
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.1004ed1d
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.1004ed1d
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.1004ed1d
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.1004ed1d
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.1004ed1d
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.1004ed1d
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.1004ed1d
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10057642
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x1005769e
cmp word [ecx], 0x5a4d
jne 0x1005769e
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x1005769e
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x1005769e
test al, 7
jne 0x1005769e
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1005769e
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x100576b8
sub ecx, 0x74
je 0x100576b1
dec ecx
dec ecx
je 0x100576b1
dec ecx
dec ecx
je 0x100576aa
sub ecx, 0x3c
je 0x100576a3
sub ecx, 0x8464
je 0x100576b8
xor eax, eax
ret 4
mov ecx, 0x3030401
jmp 0x100576bd
mov ecx, 0x3030701
jmp 0x100576bd
mov ecx, 0x3030501
jmp 0x100576bd
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x1005769e
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x100576d7
cmp eax, 0x20b
jne 0x1005769e
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x100576a0

Function at 0x1005b160
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100da42f
call fcn.100d39f0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.1005b38d
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.10079939
mov al, byte [edi + 0x18]
add edi, 0x34
mov byte [esi + 0x18], al
mov al, byte [edi - 0x1b]
mov byte [esi + 0x19], al
mov eax, dword [edi - 0x18]
mov dword [esi + 0x1c], eax
mov al, byte [edi - 0x14]
mov byte [esi + 0x20], al
mov al, byte [edi - 0x13]
mov byte [esi + 0x21], al
mov eax, dword [edi - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x2c], eax
mov al, byte [edi - 4]
mov byte [esi + 0x30], al
mov al, byte [edi - 3]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x31], al
call fcn.1000257a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1005bb03
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x1005bb22
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x1005bb11
pop edi
cmp esi, 4
jb 0x1005bb2c
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x1005bb3d
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x1005bb49
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x1005bb53
movzx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x100680c3
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [ecx + 0x3c]
cmp edx, 2
jge 0x100680dc
cmp byte [ecx + 0x42], 0
mov eax, dword [esp + 4]
je 0x10068141
cmp eax, 0x3f
jb 0x10068141
jmp 0x10068130
mov eax, dword [esp + 4]
cmp eax, 0x2c
jb 0x10068141
cmp edx, 3
jl 0x100680f4
cmp eax, 0x2c
jne 0x100680f3
push 0x48
jmp 0x10068140
dec eax
cmp edx, 4
jl 0x10068103
cmp eax, 0x2c
jne 0x10068102
push 0x49
jmp 0x10068140
dec eax
cmp eax, 0x3a
jb 0x10068141
cmp byte [ecx + 0x14], 0
je 0x10068122
cmp eax, 0x3a
jne 0x10068117
push 0x44
jmp 0x10068140
cmp eax, 0x3b
jne 0x10068120
push 0x45
jmp 0x10068140
dec eax
dec eax
cmp eax, 0x3f
jb 0x10068139
cmp byte [ecx + 0x42], 0
je 0x10068139
cmp eax, 0x3f
jne 0x10068136
push 0x46
jmp 0x10068140
dec eax
jmp 0x10068141
cmp eax, 0x44
jne 0x10068141
push 0x47
pop eax
ret 4

Function at 0x10069618
Capabilities:
Parse pe header

Disassembly:
cmp edx, 2
jb 0x1006965c
cmp byte [ecx], 0x4d
jne 0x1006965c
cmp byte [ecx + 1], 0x5a
jne 0x1006965c
cmp edx, 0x40
jb 0x1006965c
mov eax, dword [ecx + 0x3c]
cmp eax, 0x40
jb 0x1006965c
cmp eax, 0x1000
ja 0x1006965c
test al, 7
jne 0x1006965c
push esi
lea esi, [eax + 0x18]
cmp esi, edx
pop esi
ja 0x1006965c
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006965c
cmp word [ecx + 0x14], 0x60
sbb eax, eax
inc eax
ret
xor al, al
ret

Function at 0x10069785
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100db02f
call fcn.100d39f0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi + 0x24], 0xffffffff
lea ecx, [esi + 0x30]
mov byte [esi], 1
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ebx
call fcn.10001d35
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.100024c7
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100698e6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100db0cb
call fcn.100d39f0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10001d35
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.100024c7
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.10069987
lea eax, [esi + 0xb8]
mov dword [eax], edi
mov dword [eax + 4], edi
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 6
call fcn.10001d35
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 7
call fcn.10001d35
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea eax, [esi + 0xfc]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1006d319
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100db597
call fcn.100d39f0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x38]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ax, word [edi + 0x30]
mov word [esi + 0x30], ax
mov al, byte [edi + 0x32]
mov byte [esi + 0x32], al
mov al, byte [edi + 0x33]
mov byte [esi + 0x33], al
mov al, byte [edi + 0x34]
mov byte [esi + 0x34], al
mov al, byte [edi + 0x35]
mov byte [esi + 0x35], al
mov al, byte [edi + 0x36]
mov byte [esi + 0x36], al
lea eax, [edi + 0x38]
push eax
call fcn.10001d91
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
push eax
lea ecx, [esi + 0x44]
call fcn.1000257a
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov ax, word [edi + 0x64]
mov word [esi + 0x64], ax
mov ax, word [edi + 0x66]
mov word [esi + 0x66], ax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10071d2b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100db981
call fcn.100d39f0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100dfa34
mov dword [esi + 4], 0x100e1f84
mov dword [esi + 8], 0x100e6f00
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 5
call fcn.100024c7
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 6
call fcn.10048eec
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100e8374
mov dword [esi + 4], 0x100e8358
mov dword [esi + 8], 0x100e8348
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1007215c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100dba47
call fcn.100d39f0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov al, byte [edi + 8]
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.10001d91
mov eax, dword [edi + 0x1c]
and dword [ebp - 4], 0
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
lea eax, [edi + 0x34]
push eax
lea ecx, [esi + 0x34]
call fcn.10016f42
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10077d46
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, ecx
test esi, esi
mov ecx, edx
jbe 0x10077d75
push ebx
push edi
movzx edi, byte [ecx]
xor edx, edx
xor ebx, ebx
mov dl, ah
mov bh, al
xor edx, edi
movzx eax, bx
movzx edx, word [edx*2 + 0x100fed28]
xor eax, edx
inc ecx
dec esi
jne 0x10077d55
pop edi
pop ebx
pop esi
ret 4