joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5958d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x128
push esi
mov esi, ecx
mov dword [esp + 0x1c], 0
push edi
mov edi, edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
mov edx, dword [esi + 0xc]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0
test edx, edx
je 0x595bf4
test edi, edi
je 0x595bf4
movzx eax, byte [edi]
lea ecx, [eax + 1]
add eax, 0xffffffed
xor ecx, 1
dec ecx
mov dword [esp + 0x2c], ecx
cmp eax, 0x7f
ja 0x595b48
movzx eax, byte [eax + 0x28401c]
jmp dword [eax*4 + 0x283ffc]
lea eax, [esp + 0x20]
mov edx, edi
push eax
mov ecx, esi
call fcn.00596540
xor ecx, ecx
add esp, 4
cmp dword [ebp + 0xc], ecx
mov edx, 0x1b
setne cl
push ecx
push dword [ebp + 8]
mov ecx, dword [esp + 0x2c]
push eax
call fcn.005a86f0
add esp, 0xc
cmp dword [esp + 0x20], 0
je 0x595bb4
mov al, byte [esi + 0x15]
mov byte [esp + 0x17], al
cmp al, 8
jae 0x595bb4
xor ecx, ecx
lea eax, [esi + 0x60]
nop
mov edx, dword [esp + 0x20]
cmp dword [eax + 0x10], edx
je 0x595bb0
inc ecx
add eax, 0x18
cmp ecx, 0xa
jl 0x595b90
movzx eax, byte [esp + 0x17]
mov dword [esi + eax*4 + 0x18], edx
inc byte [esi + 0x15]
jmp 0x595bb4
mov byte [eax + 9], 1
mov edx, dword [esp + 0x28]
test edx, edx
je 0x595bf4
mov al, byte [esi + 0x15]
mov byte [esp + 0x17], al
cmp al, 8
jae 0x595bf4
xor ecx, ecx
lea eax, [esi + 0x60]
nop dword [eax]
cmp dword [eax + 0x10], edx
je 0x595bf0
inc ecx
add eax, 0x18
cmp ecx, 0xa
jl 0x595bd0
movzx eax, byte [esp + 0x17]
mov dword [esi + eax*4 + 0x18], edx
inc byte [esi + 0x15]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [eax + 9], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x599a30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov eax, edx
mov dword [esp + 4], eax
push esi
push edi
mov edi, ecx
test eax, eax
je 0x599bc4
test edi, edi
je 0x599a9e
cmp byte [edi + 0x1e], 0
jne 0x599bc4
cmp byte [edi + 0xe2], 0
je 0x599a9e
mov eax, 0x44
cmp ax, word [edi + 0xe0]
ja 0x599a9e
mov ebx, dword [edi + 0xec]
test ebx, ebx
je 0x599a9e
mov eax, dword [ebx]
mov dword [edi + 0xec], eax
mov eax, dword [edi + 0xe4]
inc eax
mov dword [edi + 0xe4], eax
cmp eax, dword [edi + 0xe8]
jle 0x599abe
mov dword [edi + 0xe8], eax
jmp 0x599abe
push 0x44
call fcn.005bbcf0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x599abe
test edi, edi
je 0x599ab6
mov byte [edi + 0x1e], 1
test ebx, ebx
je 0x599bc4
mov edx, dword [esp + 0xc]
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
mov edx, dword [edx]
call fcn.0059a300
mov dword [ebx], eax
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, edi
push esi
mov edx, dword [eax + 8]
call fcn.00599ea0
add esp, 4
mov dword [ebx + 8], eax
mov eax, dword [esp + 0xc]
mov ecx, edi
push 0
mov edx, dword [eax + 0xc]
push esi
call fcn.0059a730
mov dword [ebx + 0xc], eax
mov ecx, edi
mov eax, dword [esp + 0x14]
push esi
mov edx, dword [eax + 0x10]
call fcn.0059a300
add esp, 0xc
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, edi
push 0
mov edx, dword [eax + 0x14]
push esi
call fcn.0059a730
mov dword [ebx + 0x14], eax
mov ecx, edi
mov eax, dword [esp + 0x14]
push esi
mov edx, dword [eax + 0x18]
call fcn.0059a300
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [ebx + 0x18], eax
mov al, byte [ecx + 4]
mov byte [ebx + 4], al
mov edx, dword [ecx + 0x1c]
mov ecx, edi
push esi
call fcn.00599a30
add esp, 4
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0xc]
mov ecx, edi
push 0
mov edx, dword [eax + 0x28]
push esi
call fcn.0059a730
push 0
push esi
mov esi, dword [esp + 0x1c]
mov ecx, edi
mov dword [ebx + 0x28], eax
mov edx, dword [esi + 0x2c]
call fcn.0059a730
mov dword [ebx + 0x2c], eax
add esp, 0x10
mov dword [ebx + 0x30], 0
mov eax, 0xfff7
mov dword [ebx + 0x34], 0
mov cx, word [esi + 6]
and cx, ax
mov dword [ebx + 0x24], 0
mov word [ebx + 6], cx
mov eax, ebx
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x3c], 0xffffffff
mov dword [ebx + 0x40], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b7cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x5b7d24
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x5b7d14
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x2cc740]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x5b7cf4
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x5b7d26
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.005b7db0
add esp, 8
test eax, eax
je 0x5b7d40
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x5b8030
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x5b805d
nop dword [eax]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x2cc740]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x5b8040
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4016e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
and dword [esi + 0x30], 0
push edi
call fcn.004015ad
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov ebx, dword [edi]
jmp 0x40172c
push 0xa
push 0xa
push 0xfbd204
push 0x3114b604
call fcn.00401dd2
add esp, 0xc
push eax
push dword [ebx + 0x30]
call fcn.0040161c
add esp, 0xc
test eax, eax
je 0x401735
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x401704
jmp 0x4017c7
mov ebx, dword [ebx + 0x18]
test ebx, ebx
je 0x4017c7
mov eax, dword [ebx + 0x3c]
mov edi, dword [eax + ebx + 0x78]
and dword [esp + 0xc], 0
add edi, ebx
mov eax, dword [edi + 0x1c]
add eax, ebx
push ebp
mov ebp, dword [edi + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x24]
add eax, ebx
add ebp, ebx
cmp dword [edi + 0x18], 0
mov dword [esp + 0x18], eax
jbe 0x4017c3
mov eax, dword [esp + 0x10]
mov eax, dword [ebp + eax*4]
push 0x16
add eax, ebx
push 0xfbd1ec
push 0x40704011
mov dword [esp + 0x20], eax
call fcn.00401d84
push eax
push dword [esp + 0x24]
call fcn.00401648
add esp, 0x14
test eax, eax
je 0x4017ab
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [edi + 0x18]
jb 0x40176c
jmp 0x4017c3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4]
add eax, ebx
mov dword [esi + 4], eax
mov dword [esi + 0x30], ebx
pop ebp
cmp dword [esi + 0x30], 0
je 0x40192e
push 0xa
push 0xfbd1e0
push 0x29a1a909
call fcn.00401d84
add esp, 0xc
push eax
push esi
mov ecx, esi
call fcn.004016be
push 0xc
push 0xfbd1d0
push 0x13cbcee9
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 8]
push eax
mov ecx, esi
call fcn.004016be
push 0x18
push 0xfbd1b4
push 0x17ce53be
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0xc]
push eax
mov ecx, esi
call fcn.004016be
push 0xf
push 0xfbd1a4
push 0x26b30b69
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x10]
push eax
mov ecx, esi
call fcn.004016be
push 0x12
push 0xfbd190
push 0x3d924530
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x14]
push eax
mov ecx, esi
call fcn.004016be
push 7
push 0xfbd188
push 0x2236409a
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x18]
push eax
mov ecx, esi
call fcn.004016be
push 0x14
push 0xfbd170
push 0x149ccd04
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x1c]
push eax
mov ecx, esi
call fcn.004016be
push 0x11
push 0xfbd15c
push 0x673ebfe9
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x20]
push eax
mov ecx, esi
call fcn.004016be
push 0x11
push 0xfbd148
push 0x68d29b96
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x24]
push eax
mov ecx, esi
call fcn.004016be
push 0x16
push 0xfbd130
push 0x7db65c79
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x28]
push eax
mov ecx, esi
call fcn.004016be
push 0x13
push 0xfbd11c
push 0x65fa79df
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x2c]
push eax
mov ecx, esi
call fcn.004016be
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x401937
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, section..data
mov ecx, 0xde6
mov esi, 0x395ba6
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov edx, ecx
shr edx, 0xc
xor byte [eax], dl
inc eax
dec esi
jne 0x401947
pop esi
ret

Function at 0x401aa3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, eax
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x401aea
push 7
push str..custom
push edi
call fcn.0040161c
add esp, 0xc
test eax, eax
je 0x401af1
movzx eax, word [esi + 6]
inc dword [ebp - 4]
add edi, 0x28
cmp dword [ebp - 4], eax
jl 0x401ac7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0xc]
mov esi, dword [eax + ebx]
lea edi, [eax + ebx + 8]
mov ebx, dword [eax + ebx + 4]
push esi
call fcn.00401e30
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push 1
push 5
push edi
lea ecx, [ebp - 0xc]
push ecx
add edi, 5
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], 0x401960
mov dword [ebp - 0x14], 0x40196b
call fcn.0040379c
add esp, 0x28
test eax, eax
je 0x401b51
push dword [ebp - 4]
call fcn.00401e47
pop ecx
jmp 0x401aea
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 4]
jmp 0x401aec

Function at 0x401d84
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
je 0x401dc3
push edi
mov edi, dword [esp + 0x14]
sub edi, 0x1353bb0
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov eax, edx
shr eax, 0xc
xor al, byte [edi + esi + 0x1353bb0]
inc esi
mov byte [esi + 0x1353baf], al
cmp esi, ebx
jb 0x401d9f
pop edi
pop esi
mov byte [ebx + 0x1353bb0], 0
mov eax, 0x1353bb0
pop ebx
ret

Function at 0x401dd2
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x401e10
mov eax, dword [esp + 0x10]
sub eax, 0x1353bb0
push ebx
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov ebx, edx
shr ebx, 0xc
xor bl, byte [eax + esi + 0x1353bb0]
inc esi
mov byte [esi + 0x1353baf], bl
cmp esi, edi
jb 0x401dec
pop ebx
mov byte [edi + 0x1353bb0], 0
mov byte [edi + 0x1353bb1], 0
pop edi
mov eax, 0x1353bb0
pop esi
ret
Function at 0x401eec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401f05
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x401f28
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401f2d
inc edi
cmp edi, dword [ebp - 4]
jb 0x401f1f
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x402025
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x401f84
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x401f58
cmp cl, 0xff
jne 0x401faf
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x401fbd
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x401fc4
dec ecx
shl edx, cl
and edx, 7
je 0x401f49
movzx ecx, byte [edx + 0xfbd294]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0xfbd28c], 0
mov cl, byte [ebx + 4]
je 0x401fac
test cl, cl
je 0x401fac
cmp cl, 0xff
jne 0x401f49
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401f1a
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x401ff8
movzx esi, byte [edx + 0xfbd294]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x401fe3
cmp al, 0xff
jne 0x401ff5
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x401f76
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401f1a
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x65c2a0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x65c2a6
pop ebp
sub ebp, 0x45854c
lea edi, [ebp + 0x45a155]
mov esi, edi
mov ecx, 0x92
xor ebx, ebx
lodsb al, byte [esi]
xor al, 0x44
sub al, bl
rol al, 2
stosb byte es:[edi], al
inc ebx
loop 0x65c2bc
mov eax, dword [esp + 0x20]
inc eax
js 0x65c2d9
mov dword [ebp + 0x45a159], 1
cmp dword [ebp + 0x45a159], 0
jne 0x65c2e4
jmp 0x65c2fa
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c389
pop ebp
jmp 0x65c30e
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c616
pop ebp
mov ecx, 0x17a7
lea edi, [ebp + 0x4589ae]
mov esi, edi
lodsb al, byte [esi]
sub eax, 0xc261ebd2
mov eax, 0x96ba634
mov ebp, ebp
test eax, 0x10e4cac0
dec edx
mov eax, dword [0x5ef629c3]
inc eax
imul ebx, dword [eax - 0x4202be9a], 0xc5c02091
add al, 0x31
jle 0x65c320
ret 0x34b8
loop 0x65c313
and eax, dword [0x219f87be]
and byte [ebp - 0x7c331d56], dl
mov ebp, 0x45a159
add byte [ebp + 2], dh
jmp 0x65c370
push ebp
lea eax, [ebp + 0x4591ce]
push eax
mov eax, 0x30
push eax
call fcn.0065c616
pop ebp
jmp 0x65c708
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov cl, 0
xor ebx, ebx
mov bx, dx
and bx, 1
shl bl, cl
xor al, bl
shl dx, 1
mov bx, dx
and bx, 0x8000
mov ch, 0x80
cmp bh, ch
jne 0x65c6ed
xor dx, 0x8003
inc cl
mov ch, 8
cmp cl, ch
jne 0x65c6ca
pop ecx
pop ebx
mov byte [esi], al
inc esi
inc ebx
cmp ecx, ebx
jne 0x65c675
invalid
mov esp, ebp
ret 8
lcall 0x44ec, 0x43222f2e
adc ch, byte [eax]
sub dl, byte [eax + 0x17]
stosd dword es:[edi], eax
sbb edx, eax
shr dword [esi - 0x64], 0xd1
push ds
outsd dx, dword [esi]
les ebx, [eax]
jl 0x65c6d7
outsd dx, dword [esi]
fmul qword [0xd01c4589]
shr dword [edx - 0x30375760], 0x23
mov es, word [edx + 0xd793058]
jl 0x65c701
ror dword [edx - 0x7f], 1
outsb dx, byte [esi]
pop edi
push esp
retf
Function at 0x65c389
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
dec ebp
add al, 3
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ecx + 0x7d8b0300]
or al, 6
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ebx]
fild dword [ebx]
mov bx, dx
add al, 0x66
and ebx, 1
add dl, dl
jecxz 0x65c4d1
xor al, bl
add esp, dword [esi - 0x2f]
loop 0x65c4d9
mov bx, dx
add eax, 0xe38166
add byte [edx], 0xb5
add byte [ebx], 0x8b
jge 0x65c4f2
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
cmp bh, ch
jne 0x65c556
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add eax, 0x3f28166
add byte [ebx], 0x8b
jge 0x65c54a
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add bh, dh
rol dword [edx], 0xb5
or byte [ebx], al
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp cl, ch
jne 0x65c48d
pop ecx
pop ebx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [eax + 0x1460106]
inc ebx
add ecx, dword [ebx - 0x72f9f383]
mov edi, 0x45a155
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp ecx, ebx
jne 0x65c3e9
mov esp, ebp
ret 8
Function at 0x65c616
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
jge 0x65c666
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov ecx, dword [ebp + 4]
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0xd8275f8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0xfad1ba5
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001fd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x1008dcc0]
mov edx, 0x210
push ebx
push esi
push edi
call fcn.10014520
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax], 0
je 0x1000206a
mov ecx, dword [0x1008dcc0]
mov edx, 0x210
call fcn.10005510
cmp byte [eax + 8], 0
jne 0x1000206a
push 0xa0
call ebx
shr eax, 0xf
test al, 1
jne 0x1000206a
cmp dword [0x1008dcc0], 0
jne 0x10002035
push 0x10d1
push str.C:UsersPCDesktopVisual_StudioVisual_StudioImguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x1008dcc0]
cmp byte [esi + 0x48a1], 0
je 0x10002056
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.10005c90
mov dword [esi + 0x1344], 0x210
mov dword [esi + 0x1904], 0xa0
mov ecx, dword [0x1008dcc0]
mov edx, 0x214
call fcn.10014520
cmp byte [eax], 0
je 0x100020f5
mov ecx, dword [0x1008dcc0]
mov edx, 0x214
call fcn.10005510
cmp byte [eax + 8], 0
jne 0x100020f5
push 0xa1
call ebx
shr eax, 0xf
test al, 1
jne 0x100020f5
cmp dword [0x1008dcc0], 0
jne 0x100020c0
push 0x10d1
push str.C:UsersPCDesktopVisual_StudioVisual_StudioImguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x1008dcc0]
cmp byte [esi + 0x48a1], 0
je 0x100020e1
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.10005c90
mov dword [esi + 0x1348], 0x214
mov dword [esi + 0x1914], 0xa1
mov ecx, dword [0x1008dcc0]
mov edx, 0x212
call fcn.10014520
cmp byte [eax], 0
je 0x1000217d
mov ecx, dword [0x1008dcc0]
mov edx, 0x212
call fcn.10005510
cmp byte [eax + 8], 0
jne 0x1000217d
push 0x5b
call ebx
shr eax, 0xf
test al, 1
jne 0x1000217d
cmp dword [0x1008dcc0], 0
jne 0x10002148
push 0x10d1
push str.C:UsersPCDesktopVisual_StudioVisual_StudioImguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x1008dcc0]
cmp byte [esi + 0x48a1], 0
je 0x10002169
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.10005c90
mov dword [esi + 0x1230], 0x212
mov dword [esi + 0x190c], 0x5b
mov ecx, dword [0x1008dcc0]
mov edx, 0x216
call fcn.10014520
cmp byte [eax], 0
je 0x10002206
mov ecx, dword [0x1008dcc0]
mov edx, 0x216
call fcn.10005510
cmp byte [eax + 8], 0
jne 0x10002206
push 0x5c
call ebx
shr eax, 0xf
test al, 1
jne 0x10002206
mov esi, dword [0x1008dcc0]
test esi, esi
jne 0x100021d7
push 0x10d1
push str.C:UsersPCDesktopVisual_StudioVisual_StudioImguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x1008dcc0]
add esp, 0xc
cmp byte [esi + 0x48a1], 0
je 0x100021f2
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.10005c90
mov dword [esi + 0x1234], 0x216
mov dword [esi + 0x191c], 0x5c
pop edi
pop esi
pop ebx
ret