joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ad46
Capabilities:
Contain obfuscated stackstrings

Disassembly:
wait
mov esi, 0x50a8458d
call fcn.0040aab0
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040aa65
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40ad8e
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040aaa0
xor dword [ecx + 0x458d7029], eax
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x40b9fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040aab0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040aa65
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040aaa0
aas
sub byte [edx - 0x4e], bl
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.0040aaa0
mul dword [ebp + 0x65802b27]
loopne 0x40babe
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
in eax, dx
xchg esi, eax
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.0040aab0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040aa65
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c

Function at 0x40ca7d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add eax, 0xfff9bfe9
inc dword [ebx - 0x37b43]
inc dword [eax]
je 0x40ca91
jmp 0x40cb46
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
invalid
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x405a12
pop dword [ebp - 0x1c]
mov eax, 0x5713976a
sub eax, 0x56d33d58
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x9aa69e05
add dword [ebp - 0x2c], 0xb3aba746
mov dword [ebp - 0x28], 0xc48ee0d
add dword [ebp - 0x28], 0x25ea5e38
mov dword [ebp - 0x24], 0xda635166
add dword [ebp - 0x24], 0x71e8f2c8
mov dword [ebp - 0x20], 0x819d5d55
add dword [ebp - 0x20], 0x7e62a2ab
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x4d017338
add eax, 0xb33f0dcc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xa5d22de2
add dword [ebp - 0x2c], 0xcea03b74
mov dword [ebp - 0x28], 0x984c341f
sub dword [ebp - 0x28], 0x56dfd2aa
mov dword [ebp - 0x24], 0xfb82174d
sub dword [ebp - 0x24], 0x9812aae1
mov dword [ebp - 0x20], 0x4d15c75d
sub dword [ebp - 0x20], 0x4d15c75d
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35430
push 0
call eax
mov ecx, 0x4da719db
add ecx, 0xb2592745
xor edx, edx
add edx, eax
mov ebx, 0xd8d7a2a9
sub ebx, 0xd890bea9
add ebx, dword [ebp - 0x1c]
mov edi, 0xa516db1a
add edi, 0x5407bdaf
xor dword [ebp - 0xc], eax
mov esi, dword [ebx]
mov dword [ebp - 0x14], 0xf5c8b9eb
sub esi, edi
xor dword [ebp - 0x18], 0x5b091eaa
mov dword [edx], esi
xor dword [ebp - 8], 0xaf808d1
add edx, 0x3b887979
sub edx, 0x3b887975
add ebx, 4
loop 0x405b31
add eax, 0xf753
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6b764902
sub ecx, 0x6b364902
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x343f19f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x343f6b04]
jne 0x34415a46
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x34419cd8], eax
mov dword [0x34419cd4], ecx
mov dword [0x34419cd0], edx
mov dword [0x34419ccc], ebx
mov dword [0x34419cc8], esi
mov dword [0x34419cc4], edi
mov word [0x34419cf0], ss
mov word [0x34419ce4], cs
mov word [0x34419cc0], ds
mov word [0x34419cbc], es
mov word [0x34419cb8], fs
mov word [0x34419cb4], gs
pushfd
pop dword [0x34419ce8]
mov eax, dword [ebp]
mov dword [0x34419cdc], eax
mov eax, dword [ebp + 4]
mov dword [0x34419ce0], eax
lea eax, [ebp + 8]
mov dword [0x34419cec], eax
mov eax, dword [ebp - 0x320]
mov dword [0x34419c28], 0x10001
mov eax, dword [0x34419ce0]
mov dword [0x34419bdc], eax
mov dword [0x34419bd0], 0xc0000409
mov dword [0x34419bd4], 1
mov eax, dword [0x343f6b04]
mov dword [ebp - 0x328], eax
mov eax, dword [0x34417ca0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x34419c20], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x34415b4c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x34419c20], 0
jne 0x34415b36
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x3440ca66
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x3440ca75
pop dword [ebp - 4]
mov eax, 0x9db4ef94
sub eax, 0x6974251f
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x397c28eb
add dword [ebp - 0x14], 0x14d61c60
mov dword [ebp - 0x10], 0xe1d08332
sub dword [ebp - 0x10], 0xaf9d36ed
mov dword [ebp - 0xc], 0xde28a27b
add dword [ebp - 0xc], 0x6e23a1b3
mov dword [ebp - 8], 0xd40d720f
sub dword [ebp - 8], 0xd40d720f
lea eax, [ebp - 0x14]
push eax
mov eax, 0x59ffe62
sub eax, 0xd160ed36
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x2f170e1d
add dword [ebp - 0x14], 0x455b5b39
mov dword [ebp - 0x10], 0xf8889787
sub dword [ebp - 0x10], 0xb71c3612
mov dword [ebp - 0xc], 0xbe089532
sub dword [ebp - 0xc], 0x5a9928c6
mov dword [ebp - 8], 0x7c542ac8
sub dword [ebp - 8], 0x7c542ac8
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x3c7416c8
sub eax, 0x83505a0
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x4205f
push 0
call eax
mov ecx, 0x195f69bc
sub ecx, 0x195f15cc
mov edi, eax
mov esi, 0xadf56301
sub esi, 0x79b39301
add esi, dword [ebp - 4]
mov ebx, 0xca859cd5
mov edx, dword [esi]
xor edx, ebx
mov dword [edi], edx
add edi, 4
add esi, 4
loop 0x3440cb91
add eax, 0x56f62596
add eax, 0xa90b1cfd
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x343f0000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10008e45
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10008e54
pop dword [ebp - 0x18]
mov eax, 0x8d1d163e
add eax, 0x82e37816
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x68a14ab8
sub dword [ebp - 0x28], 0x1a4f056d
mov dword [ebp - 0x24], 0xd6688aa3
add dword [ebp - 0x24], 0x5bcac1a2
mov dword [ebp - 0x20], 0x4859f538
add dword [ebp - 0x20], 0x3f24ef6
mov dword [ebp - 0x1c], 0xd7ec04fb
add dword [ebp - 0x1c], 0x2813fb05
lea eax, [ebp - 0x28]
push eax
mov eax, 0x2964b211
add eax, 0xe69c0e13
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xe1cdd628
add dword [ebp - 0x28], 0x92a4932e
mov dword [ebp - 0x24], 0xbd12ec13
sub dword [ebp - 0x24], 0x7ba68a9e
mov dword [ebp - 0x20], 0x884a555b
sub dword [ebp - 0x20], 0x24dae8ef
mov dword [ebp - 0x1c], 0x7d822df8
sub dword [ebp - 0x1c], 0x7d822df8
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x35183
push 0
call eax
mov ecx, 0x3c9b
xor esi, esi
add esi, eax
mov edi, 0x1938511e
add edi, 0xf6cc22e2
add edi, dword [ebp - 0x18]
mov edx, 0xdc2680c
sub dword [ebp - 0xc], 0xc55ae03c
mov ebx, dword [edi]
add dword [ebp - 0x14], 0x3567c266
add ebx, edx
add dword [ebp - 8], ebx
mov dword [esi], ebx
xor dword [ebp - 0xc], eax
add esi, 0xb7016bf0
add esi, 0x48fe9414
add edi, 4
loop 0x10008f67
add eax, 0xb7765188
add eax, 0x488a93b7
xor ebx, ebx
add ebx, eax
add eax, 0x944376a8
add eax, 0x6bbc895d
mov ecx, 0x42cb5b49
add ecx, 0xcd34a4b7
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x100045ae
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
call fcn.10004c60
cmp eax, 0xffffffff
je 0x100045d6
test al, 0x10
jne 0x100045d6
test al, 1
je 0x100045d6
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x100045d6
xor al, al
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop esi
setne al
ret

Function at 0x100045e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x20c]
push eax
call fcn.100021f4
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
pop edi
sbb eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004c60
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
ret
Function at 0x1000706d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100dbcc6
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov dword [esi], 0x100e5540
mov dword [esi + 4], 0x100e5550
mov dword [esi + 8], 0x100e5560
mov dword [esi + 0xc], 0x100e5570
mov dword [esi + 0x10], 0x100e5584
mov dword [esi + 0x14], 0x100e5594
mov dword [esi + 0x18], 0x100e55a8
mov dword [esi + 0x1c], 0x100e55b8
mov dword [esi + 0x20], 0x100e55c8
mov dword [esi + 0x24], 0x100e55dc
mov dword [esi + 0x28], 0x100e55ec
mov dword [esi + 0x2c], 0x100e5600
mov dword [esi + 0x30], 0x100e5610
mov dword [esi + 0x34], 0x100e5620
mov dword [esi + 0x38], 0x100e5630
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x94]
test ecx, ecx
je 0x10007104
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x90]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x1000711b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x8c]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x10007132
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x88]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x10007149
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x84]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x10007160
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x80]
mov dword [ebp - 4], 5
test ecx, ecx
je 0x10007177
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x7c]
mov dword [ebp - 4], 6
test ecx, ecx
je 0x1000718b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x6c]
mov dword [ebp - 4], 7
test ecx, ecx
je 0x1000719f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x68]
mov dword [ebp - 4], 8
test ecx, ecx
je 0x100071b3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea ecx, [esi + 0x40]
call fcn.1000703a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a5b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
add byte [eax], al
add byte [eax - 0x7ab5b], al
inc dword [eax]
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
Function at 0x100182d1
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100dcf1c
call fcn.100cce18
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x100e7e78
mov dword [esi + 8], 0x100e5874
mov dword [esi + 0xc], eax
mov dword [esi], 0x100e7e94
mov dword [esi + 4], 0x100e7ec8
mov dword [esi + 8], 0x100e7ee4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push 0x1000b1d9
push 0x10009dee
push 6
push 8
lea eax, [esi + 0x160]
mov byte [ebp - 4], 6
push eax
call fcn.100ccf2f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10025fe2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
xor edi, edi
lea eax, [edx + esi]
cmp edx, eax
cmova esi, ebx
test esi, esi
je 0x10026014
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
movzx eax, word [eax*2 + 0x1010adb8]
xor ecx, eax
inc edx
inc edi
cmp edi, esi
jne 0x10025ff9
pop edi
pop esi
mov eax, ecx
pop ebx
ret 4

Function at 0x100289c8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100de03e
call fcn.100cce18
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x100e5874
mov dword [esi + 8], eax
mov dword [esi], 0x100e95b0
mov dword [esi + 4], 0x100e95e4
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.1000202e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10035d0f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100e2598
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
lea ecx, [esi + 0x158]
mov dword [esi], 0x100ead80
mov dword [esi + 4], 0x100eadb4
call fcn.100c9690
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x85c]
test ecx, ecx
je 0x10035d56
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x850]
call fcn.100ccdee
pop ecx
mov ecx, dword [esi + 0x154]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x10035d79
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x14c]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x10035d90
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x144]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x10035da7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x128]
call fcn.100ccdee
push dword [esi + 0x11c]
call fcn.100ccdee
push dword [esi + 0x110]
call fcn.100ccdee
add esp, 0xc
mov ecx, dword [esi + 0xf8]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x10035de2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x7c]
call fcn.100ccdee
pop ecx
lea ecx, [esi + 0x5c]
call fcn.10035cf0
lea ecx, [esi + 0x3c]
call fcn.10035cf0
push dword [esi + 0x30]
call fcn.100ccdee
push dword [esi + 0x24]
call fcn.100ccdee
push dword [esi + 0x18]
call fcn.100ccdee
push dword [esi + 0xc]
call fcn.100ccdee
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003aa77
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100df1bc
call fcn.100cce18
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x100e5874
mov dword [esi + 8], eax
mov dword [esi], 0x100ebacc
mov dword [esi + 4], 0x100ebb00
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.1000202e
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003ab5b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ddbc7
call fcn.100cce18
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.10001df7
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.10001df7
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov al, byte [esi + 0x28]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x28], al
mov al, byte [esi + 0x29]
mov byte [edi + 0x29], al
mov al, byte [esi + 0x2a]
mov byte [edi + 0x2a], al
mov al, byte [esi + 0x2b]
mov byte [edi + 0x2b], al
mov al, byte [esi + 0x2c]
mov byte [edi + 0x2c], al
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003f340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100df6ad
call fcn.100cce18
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.1003f2e8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10041782
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100df896
call fcn.100cce18
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push ebx
mov dword [ebp - 0x10], edi
call fcn.10001df7
and dword [ebp - 4], 0
lea eax, [ebx + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.10001df7
mov eax, dword [ebx + 0x18]
lea ecx, [edi + 0x4c]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [ebx + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [ebx + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [ebx + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [ebx + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [ebx + 0x48]
mov dword [edi + 0x48], eax
lea eax, [ebx + 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.10001df7
lea eax, [ebx + 0x58]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x58]
call fcn.10001df7
mov al, byte [ebx + 0x64]
lea esi, [ebx + 0x68]
mov byte [edi + 0x64], al
mov al, byte [ebx + 0x65]
mov byte [edi + 0x65], al
mov al, byte [ebx + 0x66]
mov byte [edi + 0x66], al
mov al, byte [ebx + 0x67]
mov byte [edi + 0x67], al
add edi, 0x68
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x7c]
pop edi
pop esi
mov dword [ecx + 0x7c], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004185d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100df896
call fcn.100cce18
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10001e4a
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10001e4a
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10001e4a
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10001e4a
or dword [esi + 0x7c], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x64], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret