joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10058bb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0x20], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x14]
push 0
push 4
push eax
push esi
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 4
push esi
call edi
push 4
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push eax
call edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0x40
push dword [esp + 0x2c]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call ebp
push eax
call ebx
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
lea eax, [ebx + 4]
pop ebx
add esp, 8
ret 0xc
Function at 0x10058c70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c09d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 8
mov dword [ebp - 0x10], ecx
call fcn.1007b2fb
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [edi], vtable.MemoryAllocator.0
test esi, esi
je 0x10058cb3
and esi, 0xfffff000
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi + 4], 0
push 0x40
push 0x3000
push 0x200
add esi, 0x1000
push esi
call ebx
mov dword [edi + 4], eax
test eax, eax
je 0x10058cc0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 8]
mov dword [ebp - 0x18], edi
cmp eax, dword [ecx + 8]
je 0x10058cf5
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x10058cff
lea edx, [ebp - 0x18]
push edx
push eax
call fcn.1005b450
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
mov esi, dword [edi + 4]
imul ecx, eax, 0x1000193
movzx eax, dh
mov dword [ebp - 0x18], edx
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [ebx + 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1005b240
mov eax, dword [eax + 4]
test eax, eax
jne 0x10058d54
mov eax, dword [ebx + 0x38]
cmp eax, dword [ebx + 0x38]
je 0x10058d5e
add eax, 0xc
jne 0x10058dab
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebx + 0x34]
call fcn.10059790
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x10058d98
push 0
push 0
mov ecx, eax
call fcn.1005a230
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x34]
call fcn.10059790
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], esi
cmp ecx, dword [eax + 8]
je 0x10058dbe
mov dword [ecx], esi
add dword [eax + 4], 4
jmp 0x10058dca
lea edx, [ebp - 0x18]
push edx
push ecx
mov ecx, eax
call fcn.1005b2b0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10059580
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [esp + 4], ebx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push ebp
mov ebp, ecx
xor edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
push esi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [ebp + 0x34]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1005b240
mov eax, dword [eax + 4]
test eax, eax
jne 0x100595e8
mov eax, dword [ebp + 0x38]
xor ebx, ebx
lea ecx, [eax + 0xc]
cmp eax, dword [ebp + 0x38]
cmovne ebx, ecx
test ebx, ebx
jne 0x10059602
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
mov eax, dword [ebx + 4]
cmp dword [ebx], eax
je 0x100596ba
push edi
nop
mov edi, dword [eax - 4]
lea eax, [esp + 0x10]
push eax
push 0x40
mov dword [esp + 0x18], 0
mov esi, dword [edi]
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push esi
lea eax, [edi + 4]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x100596a8
mov ecx, dword [esi]
cmp dword [ecx + 4], edi
je 0x10059687
add esi, 4
cmp esi, eax
jne 0x10059677
jmp 0x100596a8
test ecx, ecx
je 0x10059691
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 4]
sub eax, ecx
push eax
push ecx
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
add dword [ebp + 0xc], 0xfffffffc
mov eax, dword [ebx + 4]
add eax, 0xfffffffc
mov dword [ebx + 4], eax
cmp dword [ebx], eax
jne 0x10059610
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 8
Function at 0x100599c0
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push ebp
mov ebp, ecx
cmp edx, eax
je 0x10059b4c
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor ecx, eax
mov dword [esp + 0x20], ebx
movzx eax, byte [edx + 0xa]
mov esi, edx
imul ecx, ecx, 0x1000193
push edi
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebp + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebx + eax*8]
mov dword [esp + 0x18], ecx
lea eax, [ebx + eax*8]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10059730
push 0x18
push edi
call fcn.1007b75a
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x20]
je 0x10059a91
mov eax, dword [esp + 0x30]
cmp esi, eax
jne 0x10059a40
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
jne 0x10059b40
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x2c]
jne 0x10059aa9
mov eax, dword [esp + 0x1c]
mov ecx, eax
mov dword [edx], eax
jmp 0x10059aad
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x10059b40
nop dword [eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebp + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esp + 0x24]
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10059730
push 0x18
push edi
call fcn.1007b75a
dec dword [ebp + 8]
add esp, 8
mov eax, dword [esp + 0x30]
cmp ebx, dword [esp + 0x20]
je 0x10059b53
cmp esi, eax
jne 0x10059b10
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10059ac0
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
Function at 0x10059b80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x10059d25
cmp dword [ebx + 0x1c], 0x10
mov eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
push esi
mov dword [esp + 0x2c], eax
lea esi, [ebx + 8]
jb 0x10059bba
mov esi, dword [ebx + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x18], ecx
jbe 0x10059bd8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x18]
jb 0x10059bc6
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edx
mov esi, dword [ebx]
mov edx, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
call fcn.1005a8f0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
je 0x10059c25
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x10059c37
mov edx, esi
mov esi, dword [esi]
call fcn.1005a8f0
dec dword [edi + 8]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x24], eax
jne 0x10059c07
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x18], ebx
jne 0x10059c5c
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x10059c60
cmp dword [esp + 0x18], ebx
jne 0x10059d1b
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x10059d1b
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea ebx, [esi + 8]
mov dword [esp + 0x14], esi
jb 0x10059c80
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov edx, 0x811c9dc5
test eax, eax
je 0x10059ca9
mov ebp, eax
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebp
jb 0x10059c94
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edx
mov ebx, dword [ecx + eax*8 + 4]
lea eax, [ecx + eax*8]
mov edx, esi
mov dword [esp + 0x18], eax
mov esi, dword [esi]
mov dword [esp + 0x24], ebx
call fcn.1005a8f0
dec dword [edi + 8]
cmp dword [esp + 0x14], ebx
je 0x10059ceb
mov ebx, esi
cmp esi, ebp
je 0x10059d15
mov edx, esi
mov esi, dword [esi]
call fcn.1005a8f0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x24]
jne 0x10059cd3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], ecx
cmp esi, ebp
jne 0x10059c70
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x18]
mov dword [eax], esi
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x1005a960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0
sub esi, edi
je 0x1005a989
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1005a978
pop edi
mov eax, edx
pop esi
ret 8

Function at 0x1005aea0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x10], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x1005aff5
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
lea ebp, [ebx + 0xc]
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.10059d30
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1005afcf
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebp]
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov dword [esp + 0x1c], ebp
cmp edi, esi
jne 0x1005af55
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x1005afc2
mov edx, dword [ebp + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1005af8f
mov edx, dword [edx]
mov dword [esp + 0x14], edx
cmp edx, eax
je 0x1005af8a
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x14]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x1c]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x1005afbe
cmp edi, edx
je 0x1005af9f
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x1005afd9
cmp edi, edx
jne 0x1005af93
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [esp + 0x10]
lea ebp, [ebx + 0xc]
mov eax, ecx
cmp ecx, esi
jne 0x1005af01
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1005afbe
push str.invalid_hash_bucket_count
call fcn.10079b2b
int3
Function at 0x1006e400
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor eax, eax
mov dword [0x100e64a0], eax
mov word [0x100e64a4], ax
movzx eax, cl
lea ecx, [ecx + ecx*2]
imul eax, eax, 0xd
add ecx, ecx
push ebx
push esi
mov bl, al
mov dword [esp + 8], eax
xor bl, 0x6e
xor eax, eax
sub ecx, 0x100e64a0
lea esi, [ecx + 0x100ae510]
mov dl, byte [esi + eax + 0x100e64a0]
mov cl, dl
add dl, byte [esp + 8]
xor cl, bl
add dl, al
mov byte [eax + 0x100e64a0], cl
add bl, dl
inc eax
cmp eax, 6
jl 0x1006e432
pop esi
pop ebx
mov eax, 0x100e64a0
pop ecx
ret
Function at 0x10071680
Capabilities:
Encode data using xor

Disassembly:
push esi
xorps xmm0, xmm0
lea edx, [ecx + 0x100c9748]
mov esi, 0x100e64bc
movups xmmword [0x100e64bc], xmm0
sub esi, ecx
movups xmmword [0x100e64cc], xmm0
nop
mov al, byte [edx]
lea edx, [edx + 1]
xor al, cl
xor al, 0x6e
mov byte [esi + ecx], al
inc ecx
test al, al
jne 0x100716a0
pop esi
mov eax, 0x100e64bc
ret
Function at 0x10073655
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x100736c0
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0c0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0c0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0c0]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0c0]
sub edi, 1
jne 0x10073669
pop edi
test esi, esi
je 0x100736dc
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0c0]
inc edx
sub esi, 1
jne 0x100736c4
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x1007948c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
mov eax, dword [0x100c901c]
xor eax, esp
mov dword [esp + 0x460], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x100794b9
or eax, 0xffffffff
jmp 0x100795a7
cmp dword [esi + 0x14], 1
je 0x100794c7
push 0xfffffffffffffffc
pop eax
jmp 0x100795a7
cmp edi, dword [esi + 0x10]
jb 0x100794d0
push 0xfffffffffffffff6
jmp 0x100794c1
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
add eax, dword [ecx]
jne 0x100794e1
push 0xfffffffffffffff5
jmp 0x100794c1
movzx ebx, word [eax + 0x1c]
add eax, 0x2e
cmp dword [esi + 0x5c], 0
mov dword [esp + 0xc], eax
je 0x10079504
push dword [esi + 0x5c]
call dword [sym.imp.msvcrt.dll_free]
and dword [esi + 0x5c], 0
mov eax, dword [esp + 0x10]
pop ecx
push ecx
push ecx
mov edx, ebx
mov ecx, eax
call fcn.10079347
mov dword [esi + 0x5c], eax
pop ecx
pop ecx
test eax, eax
jne 0x1007951c
push 0xfffffffffffffffe
jmp 0x100794c1
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.10079317
pop ecx
test eax, eax
jne 0x10079533
push 0xfffffffffffffffd
jmp 0x100794c1
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x50]
mov dword [esi + 0x6c], ecx
mov ecx, dword [esp + 0x44]
mov dword [esi + 0xa0], eax
mov ax, word [esp + 0x26]
mov dword [esi + 0x64], ecx
mov ecx, dword [esp + 0x1c]
mov word [esi + 0xa8], ax
mov eax, dword [esp + 0x4c]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x4e008], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0xa4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x4e010], eax
xor eax, eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x4e014], ecx
mov ecx, dword [esp + 0x46c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1007bc25
mov esp, ebp
pop ebp
ret
Function at 0x1007c7f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x100c901c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1007c817
mov ecx, 5
int 0x29
push 2
call fcn.1007c35c
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1007c922
test esi, esi
jne 0x1007c922
push 2
call fcn.1007c35c
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1007bc25
mov esp, ebp
pop ebp
ret
Function at 0x10085290
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100c901c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0x1008f3a0
push edi
mov dword [ebp - 0x210], edi
call sub.msvcrt.dll_wcspbrk
add esp, 8
test eax, eax
jne 0x100852d0
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bc25
mov esp, ebp
pop ebp
ret
push ebx
push esi
xor esi, esi
call sub.msvcrt.dll__errno
mov ebx, dword [eax]
call sub.msvcrt.dll__errno
push 0x104
push edi
mov dword [eax], esi
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll__wfullpath
add esp, 0xc
mov edi, eax
call sub.msvcrt.dll__errno
test edi, edi
je 0x1008530c
mov dword [eax], ebx
mov ebx, dword [ebp - 0x210]
jmp 0x1008533b
cmp dword [eax], 0x22
jne 0x1008544a
call sub.msvcrt.dll__errno
push 0
mov dword [eax], ebx
mov ebx, dword [ebp - 0x210]
push ebx
push 0
call sub.msvcrt.dll__wfullpath
mov esi, eax
add esp, 0xc
mov edi, esi
test edi, edi
je 0x1008544a
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10085340
sub ecx, edx
sar ecx, 1
cmp ecx, 3
je 0x10085422
mov ecx, edi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10085360
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jb 0x1008544a
movzx eax, word [edi]
cmp eax, 0x5c
je 0x10085389
cmp eax, 0x2f
jne 0x1008544a
movzx eax, word [edi + 2]
cmp eax, 0x5c
je 0x1008539b
cmp eax, 0x2f
jne 0x1008544a
movzx eax, word [edi + 4]
cmp eax, 0x5c
je 0x1008544a
cmp eax, 0x2f
je 0x1008544a
movzx eax, word [edi + 6]
lea edx, [edi + 6]
mov edi, eax
test ax, ax
je 0x100853e2
mov ecx, eax
cmp cx, 0x5c
je 0x100853df
cmp cx, 0x2f
je 0x100853df
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
mov edi, eax
test ax, ax
jne 0x100853c1
jmp 0x100853e2
movzx edi, cx
test di, di
je 0x1008544a
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
test ax, ax
je 0x1008544a
cmp cx, 0x5c
je 0x10085413
cmp cx, 0x2f
je 0x10085413
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
mov edi, eax
test ax, ax
jne 0x100853f5
jmp 0x10085416
movzx edi, cx
test di, di
je 0x10085422
cmp word [edx + 2], 0
jne 0x1008544a
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push esi
cmp eax, 1
jbe 0x1008544b
call sub.msvcrt.dll_free
add esp, 4
mov al, 1
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bc25
mov esp, ebp
pop ebp
ret
push esi
call sub.msvcrt.dll_free
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop esi
pop ebx
pop edi
call fcn.1007bc25
mov esp, ebp
pop ebp
ret