joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8a0a4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x8a0c7
jne 0x8a0ce
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 1
jne 0x8a0dd
mov dl, 1
cmp dword [ebp - 4], 1
jne 0x8a0e5
xor edx, edx
mov eax, edx
pop ecx
pop ecx
pop ebp
ret

Function at 0x93188
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x93319
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00083590
push 0x93328
call fcn.00086a2c
mov esi, eax
test esi, esi
je 0x931ca
push 0x93334
push esi
call fcn.000869cc
mov edi, eax
test edi, edi
je 0x932eb
mov dword [ebp - 4], 0x400
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00083ae4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00083974
push eax
push 0
call edi
test eax, eax
jne 0x932eb
mov edx, dword [ebp - 4]
dec edx
lea eax, [ebp - 8]
call fcn.00083ae4
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.000835e4
mov eax, dword [ebx]
call fcn.000837b0
cmp eax, 0xf5
jle 0x932eb
mov edx, dword [ebx]
mov eax, 0x93354
call fcn.00083a9c
test eax, eax
je 0x93246
mov eax, ebx
mov edx, 0x93364
call fcn.000835e4
jmp 0x932eb
mov edx, dword [ebx]
mov eax, 0x933b4
call fcn.00083a9c
test eax, eax
je 0x93267
mov eax, ebx
mov edx, 0x933c8
call fcn.000835e4
jmp 0x932eb
mov edx, dword [ebx]
mov eax, 0x93418
call fcn.00083a9c
test eax, eax
je 0x93285
mov eax, ebx
mov edx, 0x9342c
call fcn.000835e4
jmp 0x932eb
mov edx, dword [ebx]
mov eax, 0x9347c
call fcn.00083a9c
test eax, eax
je 0x932a3
mov eax, ebx
mov edx, 0x93490
call fcn.000835e4
jmp 0x932eb
mov edx, dword [ebx]
mov eax, 0x93528
call fcn.00083a9c
test eax, eax
je 0x932c1
mov eax, ebx
mov edx, 0x9353c
call fcn.000835e4
jmp 0x932eb
mov edx, dword [ebx]
mov eax, 0x935bc
call fcn.00083a9c
test eax, eax
je 0x932df
mov eax, ebx
mov edx, 0x935d0
call fcn.000835e4
jmp 0x932eb
mov eax, ebx
mov edx, 0x93364
call fcn.000835e4
mov eax, dword [ebx]
call fcn.000837b0
cmp eax, 0xa
jge 0x93303
mov eax, ebx
mov edx, 0x93364
call fcn.000835e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x93320
lea eax, [ebp - 8]
call fcn.00083590
ret
Function at 0x93874
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x939a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.000ccc14
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x9396d
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x9396d
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.00083ae4
lea eax, [ebp - 4]
call fcn.00083980
mov ecx, dword [ebx]
mov edx, esi
call fcn.00086ca0
lea eax, [ebp - 0x10]
call fcn.000937e0
mov eax, dword [ebp - 4]
call fcn.000837b0
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 1
lea ecx, [ebp - 0x1c]
mov edx, 0x939c0
mov eax, 0x939cc
call fcn.000cd7d4
lea eax, [ebp - 0x1c]
mov edx, dword [0xe2c54]
mov edx, dword [edx]
call fcn.000837b8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.000880d4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00083ce0
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00083980
mov ecx, eax
mov eax, dword [ebp - 8]
pop edx
call fcn.000c3acc
push 0x7530
push eax
call fcn.00086b2c
lea eax, [ebp - 0x20]
call fcn.000936f0
mov edx, dword [ebp - 0x20]
mov eax, dword [0xe2d70]
call fcn.000835e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x939af
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.000835b4
lea eax, [ebp - 0x14]
call fcn.00083b60
lea eax, [ebp - 0x10]
call fcn.00083590
lea eax, [ebp - 8]
call fcn.00083b60
lea eax, [ebp - 4]
call fcn.00083590
ret
Function at 0x93dd4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x93ddc
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x93f52
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00083590
lea eax, [ebp - 0xc]
call fcn.000ccc14
call fcn.000cdad8
mov ebx, eax
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x93f12
mov edi, ebx
mov esi, edi
add esi, dword [eax + 0x3c]
cmp dword [esi], 0x4550
jne 0x93f12
lea eax, [ebp - 0x18]
call fcn.00093cd8
mov eax, dword [esi + 0x50]
add eax, edi
mov edx, eax
add edx, 4
mov edi, edx
mov ebx, eax
mov edx, dword [ebx]
lea eax, [ebp - 8]
call fcn.00083ae4
lea eax, [ebp - 8]
call fcn.00083980
mov ecx, dword [ebx]
mov edx, edi
call fcn.00086ca0
mov eax, dword [ebp - 8]
call fcn.000837b0
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea ecx, [ebp - 0x24]
mov edx, 0x93f68
mov eax, 0x93f74
call fcn.000cd7d4
lea eax, [ebp - 0x24]
mov edx, dword [0xe2c54]
mov edx, dword [edx]
call fcn.000837b8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.000880d4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00083ce0
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
call fcn.00083980
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.000c3acc
mov ebx, eax
push 0xea60
push ebx
call fcn.00086b2c
push 0
push ebx
call fcn.00086afc
lea eax, [ebp - 0x14]
call fcn.00093b0c
mov edx, dword [ebp - 0x14]
mov eax, 0x93f84
call fcn.00083a9c
dec eax
jne 0x93f12
mov eax, dword [ebp - 0x14]
call fcn.000837b0
cmp eax, 0x100
jge 0x93f12
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 0x14]
call fcn.000839b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x93f59
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.000835b4
lea eax, [ebp - 0x1c]
call fcn.00083b60
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.000835b4
lea eax, [ebp - 0xc]
call fcn.00083b60
lea eax, [ebp - 8]
call fcn.00083590
ret
Function at 0xae990
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0xae998
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0xaeb28
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 3
call fcn.000ae8f0
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xaead0
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0xaead0
mov edi, dword [edx + 0x50]
add edi, ecx
add edi, 4
mov esi, dword [edx + 0x50]
add esi, eax
mov edx, dword [esi]
lea eax, [ebp - 4]
call fcn.00083ae4
lea eax, [ebp - 4]
call fcn.00083980
mov ecx, dword [esi]
mov edx, edi
call fcn.00086ca0
lea ecx, [ebp - 0x1c]
mov edx, 0xaeb40
mov eax, 0xaeb4c
call fcn.000cd7d4
lea eax, [ebp - 0x1c]
mov edx, dword [0xe2c54]
mov edx, dword [edx]
call fcn.000837b8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.000880d4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00083ce0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.000cc6d8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0008379c
mov eax, dword [esi]
push eax
mov eax, dword [0xe2d44]
push eax
push 0
push 0
lea eax, [ebp - 4]
call fcn.00083980
push eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.00083ce0
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
call fcn.000ccc14
mov eax, dword [ebp - 0x24]
pop edx
pop ecx
call fcn.000c3acc
mov esi, eax
test esi, esi
je 0xaeac7
push 0x6ddd00
push esi
call fcn.00086b2c
mov eax, dword [0xe2d44]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.00086984
neg eax
sbb eax, eax
neg eax
cmp al, 1
jne 0xaeac7
cmp dword [ebp - 0xc], 0xa
je 0xaeae1
cmp dword [ebp - 0xc], 0x14
mov eax, dword [0xe2d44]
xor edx, edx
mov dword [eax], edx
push 0x493e0
call fcn.00086af4
dec ebx
jne 0xae9b6
call fcn.000add84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xaeb2f
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00083b78
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.000835b4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00083b78
lea eax, [ebp - 8]
mov edx, 2
call fcn.000835b4
ret
Function at 0xb16c4
Capabilities:
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0xb16cd
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00083964
mov eax, dword [ebp - 8]
call fcn.00083964
mov eax, dword [ebp - 0xc]
call fcn.00083964
xor eax, eax
push ebp
push 0xb182d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00083590
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.000b0e98
lea eax, [ebp - 0x24]
call fcn.000b0fa0
push dword [ebp - 0x24]
push 0xb1844
push dword [ebp - 0x14]
push 0xb1874
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00083870
mov eax, 5
call fcn.000828bc
add eax, 4
lea edx, [ebp - 0x20]
call fcn.000cba40
push dword [ebp - 0x10]
push 0xb18a4
push dword [ebp - 0x14]
push 0xb18b0
push dword [ebp - 0x20]
push 0xb18d4
push dword [ebp - 4]
push 0xb18e4
lea eax, [ebp - 0x10]
mov edx, 8
call fcn.00083870
lea edx, [ebp - 0x1c]
mov eax, 4
call fcn.000b0e98
lea eax, [ebp - 0x28]
call fcn.000ae100
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.000b1060
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0xb18f0
push dword [ebp - 0x14]
push 0xb18fc
push dword [ebp - 0x18]
push 0xb190c
push dword [ebp - 0x20]
push 0xb1920
lea eax, [ebp - 0x10]
mov edx, 9
call fcn.00083870
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.000b15f0
cmp byte [ebp + 0xc], 0
je 0xb17fd
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.000c7be4
jmp 0xb1812
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000001
call fcn.000c7be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb1834
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.000835b4
ret
Function at 0xcbc3c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xcbcc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00083590
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xcbcb2
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0xcbcb2
mov esi, dword [edx + 0x50]
add esi, ecx
mov ecx, esi
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [esi]
lea eax, [ebp - 4]
call fcn.00083ae4
lea eax, [ebp - 4]
call fcn.00083980
mov ecx, dword [esi]
mov edx, dword [ebp - 8]
call fcn.00086ca0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.000835e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcbccf
lea eax, [ebp - 4]
call fcn.00083590
ret

Function at 0xcbcd8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.000840c0
xor eax, eax
push ebp
push 0xcbdab
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xcbd7e
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0xcbd7e
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 0x10]
call fcn.00083ae4
lea eax, [ebp - 0x10]
call fcn.00083980
mov ecx, dword [ebx]
mov edx, esi
call fcn.00086ca0
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.00083980
push eax
lea eax, [ebp - 0x14]
call fcn.000ccc14
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
pop ecx
call fcn.000c3acc
mov ebx, eax
test ebx, ebx
je 0xcbd85
mov dword [ebp - 0xc], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcbdb2
lea eax, [ebp - 0x14]
call fcn.00083b60
lea eax, [ebp - 0x10]
call fcn.00083590
lea eax, [ebp - 4]
call fcn.00083b60
ret
Function at 0xcbdbc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.000840c0
xor eax, eax
push ebp
push 0xcbe78
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xcbe53
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0xcbe53
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 0x10]
call fcn.00083ae4
lea eax, [ebp - 0x10]
call fcn.00083980
mov ecx, dword [ebx]
mov edx, esi
call fcn.00086ca0
mov eax, dword [ebp - 8]
push eax
push 0
push 1
lea eax, [ebp - 0x10]
call fcn.00083980
mov edx, eax
mov ecx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.000c11bc
mov ebx, eax
test ebx, ebx
je 0xcbe5a
mov dword [ebp - 0xc], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcbe7f
lea eax, [ebp - 0x10]
call fcn.00083590
lea eax, [ebp - 4]
call fcn.00083b60
ret

Function at 0xcbe88
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.000840c0
xor eax, eax
push ebp
push 0xcbf44
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xcbf1f
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0xcbf1f
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 0x10]
call fcn.00083ae4
lea eax, [ebp - 0x10]
call fcn.00083980
mov ecx, dword [ebx]
mov edx, esi
call fcn.00086ca0
mov eax, dword [ebp - 8]
push eax
push 0
push 1
lea eax, [ebp - 0x10]
call fcn.00083980
mov edx, eax
mov ecx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.000c11bc
mov ebx, eax
test ebx, ebx
je 0xcbf26
mov dword [ebp - 0xc], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcbf4b
lea eax, [ebp - 0x10]
call fcn.00083590
lea eax, [ebp - 4]
call fcn.00083b60
ret
Function at 0xcbf54
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.000840c0
xor eax, eax
push ebp
push 0xcc010
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xcbfeb
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0xcbfeb
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 0x10]
call fcn.00083ae4
lea eax, [ebp - 0x10]
call fcn.00083980
mov ecx, dword [ebx]
mov edx, esi
call fcn.00086ca0
mov eax, dword [ebp - 8]
push eax
push 0
push 1
lea eax, [ebp - 0x10]
call fcn.00083980
mov edx, eax
mov ecx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.000c11bc
mov ebx, eax
test ebx, ebx
je 0xcbff2
mov dword [ebp - 0xc], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcc017
lea eax, [ebp - 0x10]
call fcn.00083590
lea eax, [ebp - 4]
call fcn.00083b60
ret
Function at 0xcc020
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.000840c0
xor eax, eax
push ebp
push 0xcc1a0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xcc15e
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0xcc15e
mov esi, dword [edx + 0x50]
add esi, ecx
mov ebx, esi
add ebx, 4
mov edx, dword [esi]
lea eax, [ebp - 0x10]
call fcn.00083ae4
lea eax, [ebp - 0x10]
call fcn.00083980
mov ecx, dword [esi]
mov edx, ebx
call fcn.00086ca0
xor ebx, ebx
mov ecx, dword [0xe2c54]
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
mov edx, 0xcc1b8
call fcn.000837fc
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.000880d4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00083ce0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0008402c
test eax, eax
je 0xcc112
call fcn.000bf3ec
test al, al
je 0xcc0f2
call fcn.000cd69c
cmp eax, 1
jne 0xcc130
mov eax, dword [ebp - 8]
push eax
push 1
push 1
lea eax, [ebp - 0x10]
call fcn.00083980
mov edx, eax
mov ecx, dword [esi]
mov eax, dword [ebp - 4]
call fcn.000c1df4
mov ebx, eax
jmp 0xcc130
mov eax, dword [ebp - 8]
push eax
push 1
push 1
lea eax, [ebp - 0x10]
call fcn.00083980
mov edx, eax
mov ecx, dword [esi]
mov eax, dword [ebp - 4]
call fcn.000c1df4
mov ebx, eax
test ebx, ebx
jne 0xcc15e
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
push eax
push 1
push 0
lea eax, [ebp - 0x10]
call fcn.00083980
push eax
lea eax, [ebp - 0x20]
call fcn.000ccc14
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
pop ecx
call fcn.000c3acc
mov ebx, eax
test ebx, ebx
je 0xcc165
mov dword [ebp - 0xc], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcc1a7
lea eax, [ebp - 0x20]
call fcn.00083b60
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.000835b4
lea eax, [ebp - 0x14]
call fcn.00083b60
lea eax, [ebp - 0x10]
call fcn.00083590
lea eax, [ebp - 4]
call fcn.00083b60
ret

Function at 0xcc1bc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
xor edx, edx
push ebp
push 0xcc1fa
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xcc1ec
add eax, dword [edx + 0x3c]
cmp dword [eax], 0x4550
jne 0xcc1ec
test byte [eax + 0x17], 0x20
je 0xcc1ec
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcc201
ret
Function at 0xcc208
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.000840c0
xor eax, eax
push ebp
push 0xcc31f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xcc2ed
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0xcc2ed
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 0x14]
call fcn.00083ae4
lea eax, [ebp - 0x14]
call fcn.00083980
mov ecx, dword [ebx]
mov edx, esi
call fcn.00086ca0
mov eax, dword [ebp - 0xc]
call fcn.000cc1bc
test al, al
je 0xcc2ca
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
call fcn.00083980
push eax
lea eax, [ebp - 0x18]
call fcn.000ccc14
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
pop ecx
call fcn.000c3acc
mov ebx, eax
jmp 0xcc2ed
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
call fcn.000ccc14
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.000c3acc
mov ebx, eax
test ebx, ebx
je 0xcc2f4
mov dword [ebp - 0x10], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcc326
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00083b78
lea eax, [ebp - 0x14]
call fcn.00083590
lea eax, [ebp - 4]
call fcn.00083b60
ret

Function at 0xcc894
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0xcc96f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00083590
test esi, esi
je 0xcc8e6
mov eax, esi
and eax, 0xf
cdq
xor eax, edx
sub eax, edx
mov dl, byte [eax + 0xe2858]
lea eax, [ebp - 4]
call fcn.00083738
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.000837fc
shr esi, 4
test esi, esi
jne 0xcc8bb
cmp dword [ebx], 0
jne 0xcc908
jmp 0xcc8fb
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0xcc984
call fcn.000837fc
mov eax, dword [ebx]
call fcn.000837b0
cmp edi, eax
jg 0xcc8ed
jmp 0xcc959
mov eax, dword [ebx]
call fcn.000837b0
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x2d
jne 0xcc94e
mov eax, dword [ebx]
call fcn.000837b0
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.000839f8
mov edx, ebx
mov ecx, 1
mov eax, 0xcc990
call fcn.00083a40
jmp 0xcc94e
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0xcc984
call fcn.000837fc
mov eax, dword [ebx]
call fcn.000837b0
cmp edi, eax
jg 0xcc940
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcc976
lea eax, [ebp - 4]
call fcn.00083590
ret
Function at 0xd48f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0xd4997
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00083b60
call fcn.000cdad8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xd494b
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0xd494b
mov esi, dword [edx + 0x50]
add esi, ecx
mov ecx, esi
mov esi, dword [edx + 0x50]
add esi, eax
add esi, 4
add esi, dword [ecx]
lea eax, [ebp - 4]
mov edx, esi
call fcn.00083c88
mov eax, dword [ebp - 4]
call fcn.00083d00
cmp eax, 0xa
jge 0xd4972
call fcn.0008694c
mov edx, eax
lea eax, [ebp - 8]
call fcn.00083c88
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.000cc6d8
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.000cc6d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd499e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00083b78
ret