joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401df9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov byte [ebp - 0x1c], al
mov byte [ebp - 9], 0
jmp 0x401e83
mov byte [ebp - 0xa], 0
jmp 0x401e79
movzx ebx, byte [ebp - 9]
movzx edx, byte [ebp - 0xa]
movzx eax, byte [ebp - 9]
movzx ecx, byte [ebp - 0xa]
mov esi, dword [ebp + 0xc]
shl eax, 2
add eax, esi
add eax, ecx
movzx eax, byte [eax]
mov byte [ebp - 0x19], al
movzx eax, byte [ebp - 0x1c]
lea ecx, [eax*4]
movzx eax, byte [ebp - 9]
add eax, ecx
lea ecx, [eax*4]
movzx eax, byte [ebp - 0xa]
add eax, ecx
mov ecx, eax
mov eax, dword [ebp + 0x10]
add eax, ecx
movzx eax, byte [eax]
xor al, byte [ebp - 0x19]
mov byte [ebp - 0x19], al
mov ecx, dword [ebp + 0xc]
lea eax, [ebx*4]
add eax, ecx
add eax, edx
movzx edx, byte [ebp - 0x19]
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x401e13
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x401e0d
nop
add esp, 0x14
pop ebx
pop esi
pop ebp
ret

Function at 0x401e91
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x401eea
mov byte [ebp - 0xa], 0
jmp 0x401ee0
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ebx, dword [ebp + 8]
shl eax, 2
add eax, ebx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + str.cw]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x401ea5
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x401e9f
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x4029a5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x4029fe
mov byte [ebp - 0xa], 0
jmp 0x4029f4
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ebx, dword [ebp + 8]
shl eax, 2
add eax, ebx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + 0x521400]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x4029b9
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x4029b3
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402c47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov byte [ebp - 5], 0
jmp 0x402c7d
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp + 8]
add edx, ecx
movzx ebx, byte [edx]
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp + 0xc]
add edx, ecx
movzx edx, byte [edx]
xor edx, ebx
mov byte [eax], dl
add byte [ebp - 5], 1
cmp byte [ebp - 5], 0xf
jbe 0x402c54
nop
add esp, 0x10
pop ebx
pop ebp
ret
Function at 0x4343d0
Capabilities:
Access the windows event log

Disassembly:
push esi
push ebx
sub esp, 0x144
mov ebx, dword [esp + 0x150]
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
push edx
test eax, eax
je 0x434401
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileType
push esi
test eax, eax
jne 0x4344f0
lea eax, [esp + 0x154]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xff
lea ebx, [esp + 0x3c]
mov dword [esp], ebx
call fcn.0050f588
mov byte [esp + 0x13b], 0
call sub.KERNEL32.dll_GetVersion
test eax, eax
js 0x43443e
call fcn.00434290
test eax, eax
jg 0x434470
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
add esp, 0x144
pop ebx
pop esi
ret
mov dword [esp + 4], str.OPENSSL
mov dword [esp], 0
call sub.ADVAPI32.dll_RegisterEventSourceA
sub esp, 8
mov esi, eax
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x20], 0
lea eax, [esp + 0x13c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.ADVAPI32.dll_ReportEventA
sub esp, 0x24
mov dword [esp], esi
call sub.ADVAPI32.dll_DeregisterEventSource
push ecx
add esp, 0x144
pop ebx
pop esi
ret
lea eax, [esp + 0x154]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
add esp, 0x144
pop ebx
pop esi
ret
Function at 0x452170
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4521d0
mov al, byte [ebx]
test al, al
je 0x4521d0
mov esi, 0x100
xor edx, edx
mov esi, esi
lea edi, [edi]
movsx eax, al
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
mov ecx, edx
mov edx, eax
imul edx, eax
xor edx, ecx
inc ebx
mov al, byte [ebx]
test al, al
jne 0x452190
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret
Function at 0x50e500
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0050e560

Function at 0x50e560
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x55d3e0]
test esi, esi
jle 0x50e64d
mov edi, dword [0x55d3e4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x50e594
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x50e646
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x50e580
mov dword [esp], eax
mov ebx, eax
call fcn.0050ee90
test eax, eax
mov edi, eax
je 0x50e68a
lea ebx, [esi + esi*2]
mov esi, dword [0x55d3e4]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.0050ef90
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x55d3e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x50e66a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x50e63f
sub eax, 0x40
and eax, 0xffffffbf
je 0x50e63f
mov eax, dword [esp + 0x20]
add ebx, dword [0x55d3e4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x50e654
add dword [0x55d3e0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x50e59e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0050e500
mov eax, dword [0x55d3e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0050e500
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0050e500
lea esi, [esi]
Function at 0x50eb00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x55d3f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x55d3f0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x50eb55
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x50eb4e
test esi, esi
je 0x50eb4e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x50eb30
mov dword [esp], 0x55d3f8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x50edb0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x50ede8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x50edde
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x50edea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x50edd0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x7be1598a
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x703f13fb
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x402bc0
Capabilities:
Encode data using xor

Disassembly:
xor al, al
cmp dword [esp + 8], 0
push ebp
mov ebp, dword [esp + 8]
je 0x402c57
test ebp, ebp
je 0x402c57
mov eax, ebp
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402be0
sub eax, edx
push ebx
sar eax, 1
shr eax, 1
push esi
mov ebx, eax
push edi
lea edi, [ebx + 2]
push edi
call fcn.0040374f
mov esi, eax
add esp, 4
test esi, esi
je 0x402c52
push edi
push 0
push esi
call fcn.00406370
push esi
push ebp
mov eax, ebx
call fcn.004020d0
add esp, 0x14
xor eax, eax
test ebx, ebx
jbe 0x402c2b
xor byte [eax + esi], bl
inc eax
cmp eax, ebx
jb 0x402c23
mov ecx, dword [esp + 0x18]
lea eax, [ebx + ebx]
push eax
push ecx
push ebx
push esi
push 0
push 0
call dword [0x40f018]
push esi
mov bl, 1
call fcn.0040574e
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x384980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x3ab01c]
push edi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x5250397
nop
push eax
nop
call 0x77e35da0
mov ebx, eax
push 0x3b4fb0
mov dword [ebp - 4], ebx
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
mov byte [ebx + edi], 0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x384a9a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
call 0x768c97f0
nop
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x3b4fb0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x384a26
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
push 0x3b4fb0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x525039d
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x386e30
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x386ed1
mov eax, dword [ebx]
push 0x40
push eax
push esi
call 0x768c8cf0
nop
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x386f00
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x386f00
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x386ed1
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x768c8cf0
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0x386f00
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x386f00
movzx eax, word [esi + 0x46]
test ax, ax
je 0x386f00
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.005b90f4]
push eax
call dword [fcn.005b9088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x386ed7
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.003874d0
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x87a010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor eax, eax
push esi
push edi
cmp byte [0x3ad014], al
je 0x87a02d
inc eax
cmp byte [eax + 0x3ad014], 0
jne 0x87a023
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
inc eax
call fcn.00858a40
mov dword [esi], eax
test eax, eax
je 0x87a04b
push 0x3ad014
push eax
call dword [fcn.005b9134]
mov esi, dword [0x5b8aa4]
xor eax, eax
cmp byte [esi], al
je 0x87a05e
inc eax
cmp byte [esi + eax], 0
jne 0x87a057
inc eax
call fcn.00858a40
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x87a075
push esi
push ebx
call dword [fcn.005b9134]
lea eax, [ebp - 0x24]
push eax
call dword [0x5b9044]
mov eax, dword [ebp - 0x16]
xor edi, edi
lea esi, [eax + eax*4]
mov word [0x5b8ec0], si
cmp dword [ebp + 0xc], edi
jle 0x87a0e9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
mov edi, edi
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0x5b8ec4], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0x87a0a0
mov word [0x5b8ec0], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0x87a161
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0x87a131
cmp dword [ecx], 0
je 0x87a131
cmp dword [0x5b91c4], ecx
jne 0x87a11b
mov dword [0x5b91c4], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x87a131
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x87a161
cmp dword [ecx], 0
je 0x87a161
cmp dword [0x5b91c4], eax
jne 0x87a14b
mov dword [0x5b91c4], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0x87a161
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x87c520
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x5b90e0]
test esi, esi
jne 0x87c538
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x87c531
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x87c531
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x87c59a
jmp 0x87c580
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x5b8bf0]
add eax, esi
call fcn.00879fb0
test eax, eax
je 0x87c5a3
inc edi
cmp edi, dword [ebp - 4]
jb 0x87c580
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6bbf072e
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3a344893
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6fd819c1
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x1a3f248b
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x84980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0xab01c]
push edi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x4bd03dc
nop
push eax
nop
call 0x77b15da0
mov ebx, eax
push 0xb4fb0
mov dword [ebp - 4], ebx
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
mov byte [ebx + edi], 0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x84a9a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x771b97f0
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0xb4fb0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x84a26
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
push 0xb4fb0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x4bd03e2
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x86e30
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x86ed1
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x771b8cf0
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x86f00
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x86f00
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x86ed1
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x771b8cf0
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0x86f00
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x86f00
movzx eax, word [esi + 0x46]
test ax, ax
je 0x86f00
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.002b90f4]
push eax
call dword [fcn.002b9088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x86ed7
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.000874d0
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x579010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor eax, eax
push esi
push edi
cmp byte [0xad014], al
je 0x57902d
inc eax
cmp byte [eax + 0xad014], 0
jne 0x579023
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
inc eax
call fcn.00557a40
mov dword [esi], eax
test eax, eax
je 0x57904b
push 0xad014
push eax
call dword [fcn.002b9134]
mov esi, dword [0x2b8aa4]
xor eax, eax
cmp byte [esi], al
je 0x57905e
inc eax
cmp byte [esi + eax], 0
jne 0x579057
inc eax
call fcn.00557a40
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x579075
push esi
push ebx
call dword [fcn.002b9134]
lea eax, [ebp - 0x24]
push eax
call dword [0x2b9044]
mov eax, dword [ebp - 0x16]
xor edi, edi
lea esi, [eax + eax*4]
mov word [0x2b8ec0], si
cmp dword [ebp + 0xc], edi
jle 0x5790e9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
mov edi, edi
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0x2b8ec4], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0x5790a0
mov word [0x2b8ec0], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0x579161
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0x579131
cmp dword [ecx], 0
je 0x579131
cmp dword [0x2b91c4], ecx
jne 0x57911b
mov dword [0x2b91c4], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x579131
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x579161
cmp dword [ecx], 0
je 0x579161
cmp dword [0x2b91c4], eax
jne 0x57914b
mov dword [0x2b91c4], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0x579161
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57b520
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x2b90e0]
test esi, esi
jne 0x57b538
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x57b531
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x57b531
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x57b59a
jmp 0x57b580
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x2b8bf0]
add eax, esi
call fcn.00578fb0
test eax, eax
je 0x57b5a3
inc edi
cmp edi, dword [ebp - 4]
jb 0x57b580
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret