joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1157b20
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [eax]
sub esp, 0x50
cmp al, 2
push esi
mov esi, ecx
je 0x1157b3a
cmp al, 3
je 0x1157b3a
mov eax, 0xffffffff
pop esi
add esp, 0x50
ret
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx]
test al, 0xf
jne 0x1157c95
cmp eax, 0xc0
jg 0x1157c95
mov ecx, dword [edx]
sar eax, 4
lea edx, [eax + eax*8]
shl edx, 1
cmp ecx, edx
jge 0x1157b6d
cmp ecx, 0x100
jg 0x1157c95
test eax, eax
push ebx
push ebp
push edi
mov dword [esp + 0x10], 0
jle 0x1157c7e
mov ebx, dword [esp + 0x68]
mov al, byte [esi]
mov cl, byte [esi + 1]
inc esi
mov dl, byte [esi + 1]
inc esi
inc esi
inc esi
inc esi
mov byte [esp + 0x1e], al
mov al, byte [esi - 2]
inc esi
mov byte [esp + 0x24], cl
mov cl, byte [esi - 2]
inc esi
mov byte [esp + 0x1a], dl
mov dl, byte [esi - 2]
inc esi
mov byte [esp + 0x16], al
mov al, byte [esi - 2]
mov byte [esp + 0x1f], cl
mov cl, byte [esi - 1]
inc esi
mov byte [esp + 0x18], dl
mov dl, byte [esi - 1]
inc esi
mov byte [esp + 0x25], al
mov al, byte [esi - 1]
inc esi
mov byte [esp + 0x21], cl
mov cl, byte [esi - 1]
inc esi
mov byte [esp + 0x23], dl
mov dl, byte [esi - 1]
inc esi
mov byte [esp + 0x1c], al
mov al, byte [esi - 1]
mov byte [esp + 0x22], cl
mov cl, byte [esi]
inc esi
mov byte [esp + 0x15], dl
mov dl, byte [esi]
inc esi
mov byte [esp + 0x1d], al
mov al, byte [esi]
inc esi
mov byte [esp + 0x14], cl
mov cl, byte [esi]
inc esi
mov byte [esp + 0x19], dl
mov dl, byte [esi]
mov byte [esp + 0x20], cl
mov ecx, 0x12
lea edi, [esp + 0x14]
mov byte [esp + 0x17], al
mov byte [esp + 0x1b], dl
inc esi
call fcn.011570c0
mov edx, edi
mov ecx, 0xc1
mov edi, 0x12
xor byte [edx], cl
mov ebp, ecx
movzx cx, ch
and ebp, 0x1ff
or cx, word [ebp*2 + 0x14238c0]
inc edx
dec edi
jne 0x1157c28
test eax, eax
jne 0x1157c88
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1e]
mov dword [ebx], eax
mov eax, dword [esp + 0x22]
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x64]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + 8], edx
mov edx, dword [ecx]
inc eax
sar edx, 4
add ebx, 0x10
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x1157b84
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x50
ret
pop edi
pop ebp
pop ebx
mov eax, 0xfffffffe
pop esi
add esp, 0x50
ret
or eax, 0xffffffff
pop esi
add esp, 0x50
ret
Function at 0x1162d07
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x1162d35
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x1162d3c
cmp ebx, dword [eax + 4]
jae 0x1162d3c
xor eax, eax
jmp 0x1162f2c
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x1162d4d
xor eax, eax
inc eax
jmp 0x1162f2b
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1162d63
cmp ecx, edx
jae 0x1162ea8
cmp dword [eax + 4], 0
je 0x1162d6c
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x1162d54
cmp dword [ebp + 8], 0
je 0x1162d8e
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x1162ea8
cmp eax, esi
jae 0x1162ea8
mov eax, dword [0x14229c8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x1162db3
cmp dword [esi*4 + 0x14229d0], edi
je 0x1162eac
inc esi
cmp esi, eax
jl 0x1162da1
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x155761a]
test eax, eax
je 0x1162f28
cmp dword [ebp - 8], case.0x75f359.4
jne 0x1162f28
test byte [ebp - 0xc], 0xcc
je 0x1162e31
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x1162f28
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1162f28
cmp word [eax + 0x18], 0x10b
jne 0x1162f28
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x1162f28
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x1162e31
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x1162e31
test byte [ecx + 0x27], 0x80
jne 0x1162ea8
push 1
push 0x1422a10
call dword [0x15577d2]
test eax, eax
jne 0x1162d45
mov ecx, dword [0x14229c8]
test ecx, ecx
mov edx, ecx
jle 0x1162e65
lea eax, [ecx*4 + 0x14229cc]
cmp dword [eax], edi
je 0x1162e65
dec edx
sub eax, 4
test edx, edx
jg 0x1162e59
test edx, edx
jne 0x1162e96
push 0xf
pop ebx
cmp ecx, ebx
jg 0x1162e72
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x1162e8a
lea eax, [edx*4 + 0x14229d0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x1162e78
cmp ecx, 0x10
jge 0x1162e96
inc ecx
mov dword [0x14229c8], ecx
push 0
push 0x1422a10
call dword [0x15577d2]
jmp 0x1162d45
xor eax, eax
jmp 0x1162f2b
test esi, esi
jle 0x1162d45
mov ebx, dword [reloc.KERNEL32.dll_InterlockedExchange]
push 1
push 0x1422a10
call ebx
test eax, eax
jne 0x1162d45
cmp dword [esi*4 + 0x14229d0], edi
je 0x1162f02
mov eax, dword [0x14229c8]
lea esi, [eax - 1]
test esi, esi
jl 0x1162ef0
cmp dword [esi*4 + 0x14229d0], edi
je 0x1162eec
dec esi
jns 0x1162ee0
test esi, esi
jge 0x1162f00
cmp eax, 0x10
jge 0x1162efb
inc eax
mov dword [0x14229c8], eax
lea esi, [eax - 1]
jmp 0x1162f02
je 0x1162f1a
xor ecx, ecx
test esi, esi
jl 0x1162f1a
lea eax, [ecx*4 + 0x14229d0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x1162f08
push 0
push 0x1422a10
call ebx
jmp 0x1162d45
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x11671c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret

Function at 0x1168320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov eax, dword [0x1422ac4]
add eax, 2
mov dword [ebp - 4], eax
jmp 0x116833d
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 4], ecx
mov edx, dword [0x1422ac8]
sub edx, 6
cmp dword [ebp - 4], edx
jae 0x11683a8
mov eax, dword [0x1422acc]
movzx esi, word [eax]
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 7
div ecx
mov ecx, edx
shl esi, cl
mov word [ebp - 8], si
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 4
div ecx
mov eax, dword [ebp - 4]
mov ecx, edx
shl eax, cl
mov word [ebp - 0xc], ax
movzx ecx, word [ebp - 8]
movzx edx, word [ebp - 0xc]
add ecx, edx
and ecx, 0xffff
mov eax, dword [0x1422ac0]
add eax, dword [ebp - 4]
movzx edx, word [eax]
xor edx, ecx
mov eax, dword [0x1422ac0]
add eax, dword [ebp - 4]
mov word [eax], dx
jmp 0x1168334
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x11da844
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xaf
push dword [esp]
sub dword [esp], 0xad
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x11da86e
mov ecx, 0x7be
xor eax, eax
je 0x11da873
call 0x176e0114
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x11da886
mov ecx, 0x7be
xor eax, eax
je 0x11da88b
call 0xeda1012c
and al, 0xc7
inc esp
and al, 0x20
fcomi st(2)
jnp 0x11da912
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0x7a7bf2db
mov dword [esp + 0x1c], 0x20040
mov dword [esp + 0x18], ebx
mov ebx, 0x11da814
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], ebx
nop
xor ebx, ebx
nop
mov edi, dword [esp + 0x20]
nop
mov edi, dword [edi]
xor ebx, edi
nop
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x11da8b5
mov edi, dword [esp + 0x14]
lea eax, [eax]
add edx, ebx
xchg edx, edx
mov ebx, dword [esp + 0x18]
add esp, 0x24
nop
xchg dword [esp], edx
mov dword [esp + 4], 0x3c0004c2
jmp 0x11da8e4
ret 4
sub esp, 4
mov dword [esp], 0x114a623
add dword [esp], 0x904c3
jmp 0x11da91f
ret
Function at 0x11f68a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x12d4d76
mov eax, dword fs:[0]
sub esp, 4
mov dword [esp], eax
mov dword fs:[0], esp
sub esp, 4
mov dword [esp], 0x8d
xor dword [esp], 0xe5
sub esp, dword [esp]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 4], 0
push 0
mov ecx, 0xfff47cdf
lea ecx, [ecx + ebp + 0xb82cd]
call fcn.00e3c0e0
mov byte [ebp - 4], 1
mov eax, 0xfff5c2df
mov eax, dword [eax + ebp + 0xa3d29]
sub esp, 4
mov dword [esp], eax
mov ecx, 0xfffb5bb9
lea ecx, [ecx + ebp + 0x4a3e7]
sub esp, 4
mov dword [esp], ecx
mov ecx, 0xfff82d03
mov ecx, dword [ecx + ebp + 0x7d291]
call fcn.011da800
mov edx, 0xfffb0153
mov edx, dword [edx + eax + 0x4fead]
mov dword [ebp - 0x1c], edx
mov ecx, 0xfff6362b
mov ecx, dword [ecx + eax + 0x9c9d9]
mov dword [ebp - 0x18], ecx
mov edx, 0xfff9b577
mov edx, dword [edx + eax + 0x64a91]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0
mov eax, 0xfff584bf
mov eax, dword [eax + ebp + 0xa7b25]
mov dword [ebp - 0x70], eax
sub esp, 4
mov dword [esp], edi
mov edi, dword [ebp - 0x70]
sub edi, 6
pop edi
push 0x3745
je 0x11f6995
add dword [esp], 0x117de3c
add dword [esp], 0x754c3
jmp 0x11f698d
ret
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x11f69a6
mov ecx, 0x7be
xor eax, eax
je 0x11f69ab
call 0x176fc24c
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x11f69be
mov ecx, 0x7be
xor eax, eax
je 0x11f69c3
call 0x176fc264
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x11f69d6
mov ecx, 0x7be
xor eax, eax
je 0x11f69db
call 0xeda2c27c
sbb bh, al
inc esp
and al, 0x14
cmp dword [ebx - 0x55], edx
invalid
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0xf0ab5339
mov dword [esp + 0x10], 0x20078
mov dword [esp + 0xc], edi
mov edi, 0x11f6964
mov dword [esp + 8], esi
mov dword [esp + 0x14], edi
xor edi, edi
nop
mov esi, dword [esp + 0x14]
mov esi, dword [esi]
xchg esi, esi
xor edi, esi
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x11f6a03
sub edi, 0xfb1
nop
jle 0x11f6a26
leave
ret
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x18
nop
add dword [esp], 0x11b26d8
add dword [esp], 0x40cc3
jmp 0x11f6a3c
ret
Function at 0x1290826
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xae
push dword [esp]
sub dword [esp], 0xab
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1290850
mov ecx, 0x7be
xor eax, eax
je 0x1290855
call 0x177960f6
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1290868
mov ecx, 0x7be
xor eax, eax
je 0x129086d
call 0xedac610e
sbb al, 0xc7
inc esp
and al, 0x18
pop ss
push esp
js 0x12908c6
popfd
pop eax
sub esp, 0x1c
mov dword [esp + 0x18], 0x4c785417
mov dword [esp + 0x14], 0x20053
mov dword [esp + 0x10], eax
mov eax, 0x12907f4
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], eax
nop
xor eax, eax
lea edx, [edx]
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp]
nop
xor eax, ebp
nop
add dword [esp + 0x18], 4
nop
dec word [esp + 0x14]
jne 0x1290898
mov ebp, dword [esp + 0xc]
add edx, eax
mov eax, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], edx
mov dword [esp + 4], 0x8c0004c2
jmp 0x12908c4
ret 4
add byte [ebx + ebp*8 + 0x2404c7fa], cl
pop ecx
add eax, dword [eax]
add byte [ecx + 0x3552434], al
add byte [eax], al
add esp, dword [esp]
sub esp, 4
mov dword [esp], edi
mov edi, eax
and edi, eax
pop edi
push 0x396f
jne 0x12908fe
add dword [esp], 0x1233edd
add dword [esp], 0x590c3
jmp 0x12908f7
ret
add dword [esp], 0x11faa73
add dword [esp], 0x927c3
jmp 0x1290908
ret
Function at 0x1297640
Capabilities:
Encode data using xor

Disassembly:
jns 0x12978b1
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov eax, 0xfff1e197
mov eax, dword [eax + ebp + 0xe1e65]
sub esp, 4
mov dword [esp], ebp
mov ebp, dword [eax + 8]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x129767d
mov ecx, 0x7be
xor eax, eax
je 0x1297682
add eax, ebp
call 0x1779cf23
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1297695
mov ecx, 0x7be
xor eax, eax
je 0x129769a
call 0xedaccf3b
sbb bh, al
inc esp
and al, 0x14
js 0x1297680
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0xae81db78
mov dword [esp + 0x10], 0x20e36
sub dword [esi + 0x102444c7], 0x20e36
mov dword [esp + 0xc], esi
mov esi, 0x1297610
mov dword [esp + 8], eax
mov dword [esp + 0x14], esi
xor esi, esi
nop
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
xor esi, eax
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x12976c2
mov eax, dword [esp + 8]
mov dword [esp + 8], esp
add dword [esp + 8], 0x18
sub ebp, esi
mov ebp, ebp
mov esi, dword [esp + 0xc]
mov esp, dword [esp + 8]
or al, 0x8b
and al, 8
pop ebp
push 0x1549
jne 0x1297708
add dword [esp], 0x11fcebc
add dword [esp], 0x993c3
jmp 0x1297702
ret
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1297719
mov ecx, 0x7be
xor eax, eax
je 0x129771e
call 0x1779cfbf
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1297731
mov ecx, 0x7be
xor eax, eax
je 0x1297736
call 0x1779cfd7
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1297749
mov ecx, 0x7be
xor eax, eax
je 0x129774e
call 0xedaccfef
sbb al, 0xc7
inc esp
and al, 0x18
jg 0x12976eb
popfd
pop eax
sub esp, 0x1c
mov dword [esp + 0x18], 0x4df1927f
int1
dec ebp
mov dword [esp + 0x14], 0x20066
mov dword [esp + 0x10], ebx
mov ebx, 0x12976d8
mov dword [esp + 0xc], ecx
nop
mov dword [esp + 0x18], ebx
xor ebx, ebx
nop
mov ecx, dword [esp + 0x18]
nop
mov ecx, dword [ecx]
xchg ebp, ebp
xor ebx, ecx
add dword [esp + 0x18], 4
nop
dec word [esp + 0x14]
jne 0x1297778
clc
sbb ebx, 0xfb5
jle 0x12977aa
cmp dword [esp + 0x16], 0x2c
je 0x129779f
call dword [eax + 0x24548bcc]
sbb byte [ebx - 0x742fccee], cl
dec esp
and al, 0xc
nop
int3
mov ecx, dword [esp + 0xc]
nop
mov ebx, dword [esp + 0x10]
add esp, 0x1c
add dword [esp], 0x11f1be4
add dword [esp], 0xa48c3
jmp 0x12977c0
ret
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov eax, 0xfff2ebd5
mov eax, dword [eax + ebp + 0xd1427]
sub esp, 4
mov dword [esp], ebx
mov ebx, dword [eax + 8]
sub ebx, 0
pop ebx
push 0x3912
jne 0x12978f4
add dword [esp], 0x1265231
add dword [esp], 0x2edc3
jmp 0x12978ec
ret
add dword [esp], 0x1289c1b
add dword [esp], 0xa4c3
jmp 0x12978fe
ret
Function at 0x1297ff5
Capabilities:
Encode data using xor

Disassembly:
jle 0x1297f9c
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov eax, 0xfff68c63
mov eax, dword [eax + ebp + 0x973ad]
sub esp, 4
mov dword [esp], eax
mov ecx, 0xffffb9e1
mov ecx, dword [ecx + ebp + 0x462b]
sub esp, 4
mov dword [esp], ecx
mov edx, 0xfff837f9
mov edx, dword [edx + ebp + 0x7c803]
mov ecx, 0xfff78473
mov ecx, dword [ecx + edx + 0x87b91]
call fcn.01297de0
invalid
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov eax, 0xfff6f38f
mov eax, dword [eax + ebp + 0x90c81]
sub esp, 4
mov dword [esp], eax
mov ecx, 0xfff22a8b
mov ecx, dword [ecx + ebp + 0xdd581]
sub esp, 4
mov dword [esp], ecx
mov edx, 0xfff7649f
mov edx, dword [edx + ebp + 0x89b5d]
mov ecx, 0xfff65231
mov ecx, dword [ecx + edx + 0x9add3]
call 0x1297ff5
dec ebp
enter 0x3ac, 0x23
add ecx, esi
add dword [esp], 0xaf
push dword [esp]
sub dword [esp], 0xad
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x129801f
mov ecx, 0x7be
xor eax, eax
je 0x1298024
call 0x1779d8c5
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1298037
mov ecx, 0x7be
xor eax, eax
je 0x129803c
call 0xedacd8dd
adc al, 0xc7
inc esp
and al, 0x10
aas
and dword [edx + 0x2444c7e5], eax
or al, 0x3e
add byte [edx], al
add byte [ecx - 0x46f7dbb4], cl
les edi, [edi + 0x29]
add dword [ecx - 0x76fbdbac], ecx
dec esp
and al, 0x10
popfd
pop eax
sub esp, 0x14
mov dword [esp + 0x10], 0xe582213f
mov dword [esp + 0xc], 0x2003e
mov dword [esp + 8], ecx
mov ecx, 0x1297fc4
mov dword [esp + 4], edx
mov dword [esp + 0x10], ecx
mov ecx, ecx
xor ecx, ecx
lea ebp, [ebp]
mov edx, dword [esp + 0x10]
mov edx, dword [edx]
xor ecx, edx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x1298069
nop
nop
mov edx, dword [esp + 4]
add ebx, ecx
xchg ebp, ebp
mov ecx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ebx
mov dword [esp + 4], 0xe70004c2
jmp 0x1298095
ret 4
Function at 0x12a5a40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x12a5a74
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jae 0x12a5ae4
cmp dword [ebp + 0x10], 0
je 0x12a5aaf
cmp dword [ebp - 8], 1
jbe 0x12a5aaf
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
movzx eax, byte [edx - 2]
cmp eax, 0xff
jne 0x12a5aaf
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx - 1]
cmp edx, 0x15
jne 0x12a5aaf
mov dword [ebp - 4], 4
cmp dword [ebp - 4], 0
ja 0x12a5ad9
mov eax, dword [ebp - 0x10]
shr eax, 8
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx]
xor edx, dword [ebp - 0x10]
and edx, 0xff
xor eax, dword [edx*4 + 0x1535810]
mov dword [ebp - 0x10], eax
jmp 0x12a5ae2
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x12a5a6b
mov ecx, dword [ebp - 0x10]
xor ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x12a9f10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0115c14d
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax - 1]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0
jne 0x12a9f51
xor eax, eax
jmp 0x12aa005
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0115b060
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 4]
jae 0x12a9fd8
mov edx, dword [ebp - 0x14]
push edx
call fcn.012a5610
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x12a9f8a
jmp 0x12a9fd8
mov eax, dword [ebp - 0x18]
sub eax, 1
test eax, eax
jle 0x12a9fac
mov ecx, dword [ebp - 0x18]
sub ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call fcn.0115ae00
add esp, 0xc
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 0xcc
je 0x12a9fc7
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx]
cmp eax, 0x90
jne 0x12a9fcd
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
jmp 0x12a9f6b
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
push ecx
call fcn.012a5a40
add esp, 0xc
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.0115be08
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1460cec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41cae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0145ea2c
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x41e138
push 0x40a4c0
push 0x20
push 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
push ecx
call fcn.0146088c
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1b4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1b0], 0x20
push 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x1b0
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x30
push edx
call fcn.014623ec
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 3
call fcn.0146263c
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
push 0x20
push 0x41e124
mov edx, dword [ebp - 0x10]
add edx, 0xc
push edx
call fcn.0146980c
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x146e16d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x146e19b
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x146e1a2
cmp ebx, dword [eax + 4]
jae 0x146e1a2
xor eax, eax
jmp 0x146e392
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x146e1b3
xor eax, eax
inc eax
jmp 0x146e391
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x146e1c9
cmp ecx, edx
jae 0x146e30e
cmp dword [eax + 4], 0
je 0x146e1d2
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x146e1ba
cmp dword [ebp + 8], 0
je 0x146e1f4
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x146e30e
cmp eax, esi
jae 0x146e30e
mov eax, dword [0x427870]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x146e219
cmp dword [esi*4 + 0x427878], edi
je 0x146e312
inc esi
cmp esi, eax
jl 0x146e207
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x41d140]
test eax, eax
je 0x146e38e
cmp dword [ebp - 8], case.0x75f359.4
jne 0x146e38e
test byte [ebp - 0xc], 0xcc
je 0x146e297
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x146e38e
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x146e38e
cmp word [eax + 0x18], 0x10b
jne 0x146e38e
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x146e38e
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x146e297
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x146e297
test byte [ecx + 0x27], 0x80
jne 0x146e30e
push 1
push 0x4278b8
call dword [0x41d178]
test eax, eax
jne 0x146e1ab
mov ecx, dword [0x427870]
test ecx, ecx
mov edx, ecx
jle 0x146e2cb
lea eax, [ecx*4 + 0x427874]
cmp dword [eax], edi
je 0x146e2cb
dec edx
sub eax, 4
test edx, edx
jg 0x146e2bf
test edx, edx
jne 0x146e2fc
push 0xf
pop ebx
cmp ecx, ebx
jg 0x146e2d8
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x146e2f0
lea eax, [edx*4 + 0x427878]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x146e2de
cmp ecx, 0x10
jge 0x146e2fc
inc ecx
mov dword [0x427870], ecx
push 0
push 0x4278b8
call dword [0x41d178]
jmp 0x146e1ab
xor eax, eax
jmp 0x146e391
test esi, esi
jle 0x146e1ab
mov ebx, dword [0x41d178]
push 1
push 0x4278b8
call ebx
test eax, eax
jne 0x146e1ab
cmp dword [esi*4 + 0x427878], edi
je 0x146e368
mov eax, dword [0x427870]
lea esi, [eax - 1]
test esi, esi
jl 0x146e356
cmp dword [esi*4 + 0x427878], edi
je 0x146e352
dec esi
jns 0x146e346
test esi, esi
jge 0x146e366
cmp eax, 0x10
jge 0x146e361
inc eax
mov dword [0x427870], eax
lea esi, [eax - 1]
jmp 0x146e368
je 0x146e380
xor ecx, ecx
test esi, esi
jl 0x146e380
lea eax, [ecx*4 + 0x427878]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x146e36e
push 0
push 0x4278b8
call ebx
jmp 0x146e1ab
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret