joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d5f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d610
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43d62b
mov eax, 0xffffffff
jmp 0x43d62e
add eax, 0xa
push eax
call fcn.004086b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43d671
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43d660
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x20272625
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx + 0x28]
mov edi, ecx
and edi, 2
mov esi, edx
xor esi, 0x752dbdb9
add esi, edi
mov edi, esi
and edi, eax
lea ebx, [esi + eax]
not ebx
lea ebx, [ebx + edi*2]
mov edi, esi
not edi
or ebx, edi
add ebx, esi
lea ebx, [ebx*2 + 2]
xor esi, ebx
and edi, ebx
add edi, edi
sub esi, edi
add esi, eax
mov edi, esi
mov ebx, 0x9d
sub ebx, esi
and esi, 0xfffffffe
add esi, 0x62
xor esi, 0xfe
and ebx, 0xfe
or ebx, esi
and edi, 1
not ebx
add ebx, edi
mov byte [esp + edx + 0x28], bl
inc edx
add ecx, 2
cmp edx, 4
jne 0x43d6e0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x43d795
xor edx, edx
mov edi, dword [0x44a4b0]
cmp dword [edi + edx*8], 0x50dc24c7
je 0x43d770
inc edx
cmp ecx, edx
jne 0x43d760
jmp 0x43d795
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43d795
lea eax, [esp + 0x28]
lea edx, [esp + 0x10]
push eax
push edx
push 8
push ecx
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.004086c0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43d7ae
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0x20272625
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx]
mov esi, eax
and esi, 2
mov ebx, edx
xor ebx, 0x752dbdb9
add ebx, esi
mov esi, ebx
and esi, ecx
lea edi, [ebx + ecx]
not edi
lea edi, [edi + esi*2]
mov esi, ebx
not esi
or edi, esi
add edi, ebx
lea edi, [edi*2 + 2]
xor ebx, edi
and esi, edi
add esi, esi
sub ebx, esi
add ebx, ecx
mov esi, ebx
mov ecx, 0x9d
sub ecx, ebx
and ebx, 0xfffffffe
add ebx, 0x62
xor ebx, 0xfe
and ecx, 0xfe
or ecx, ebx
and esi, 1
not ecx
add ecx, esi
mov byte [esp + edx], cl
inc edx
add eax, 2
cmp edx, 4
jne 0x43d7e0
mov eax, dword [esp]
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x43d898
xor edx, edx
mov esi, dword [0x44a4b0]
nop
nop
nop
cmp dword [esi + edx*8], 0x7cde1e50
je 0x43d870
inc edx
cmp ecx, edx
jne 0x43d860
jmp 0x43d898
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43d898
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x43d8a5
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43d8b4
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [esp + 4], 0x20272625
xor eax, eax
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx + 4]
mov ecx, eax
and ecx, 2
mov ebp, ebx
xor ebp, 0x752dbdb9
add ebp, ecx
mov ecx, ebp
and ecx, edi
lea esi, [edi + ebp]
not esi
lea ecx, [esi + ecx*2]
mov esi, ebp
not esi
or ecx, esi
add ecx, ebp
lea ecx, [ecx*2 + 2]
xor ebp, ecx
and esi, ecx
add esi, esi
sub ebp, esi
add ebp, edi
mov edi, ebp
and edi, 1
mov ecx, 0x9d
sub ecx, ebp
and ebp, 0xfffffffe
add ebp, 0x62
xor ebp, 0xfe
and ecx, 0xfe
or ecx, ebp
not ecx
add ecx, edi
mov byte [esp + ebx + 4], cl
inc ebx
add eax, 2
cmp ebx, 4
jne 0x43d8e0
mov eax, dword [esp + 4]
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x43d9a1
xor edi, edi
mov ebx, dword [0x44a4b0]
cmp dword [ebx + edi*8], 0xc81e0bf6
je 0x43d970
inc edi
cmp ecx, edi
jne 0x43d960
jmp 0x43d9a1
mov edi, dword [ebx + edi*8 + 4]
cmp edi, eax
je 0x43d9a1
lea eax, [esp + 4]
push 0
push 0
push edx
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push edi
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x30
cmp eax, 0x103
jne 0x43da79
mov dword [esp], 0x20272625
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx]
mov esi, eax
and esi, 2
mov edx, ecx
xor edx, 0x752dbdb9
add edx, esi
mov esi, edx
and esi, edi
lea ebx, [edx + edi]
not ebx
lea esi, [ebx + esi*2]
mov ebx, edx
not ebx
or esi, ebx
add esi, edx
lea esi, [esi*2 + 2]
xor edx, esi
and ebx, esi
add ebx, ebx
sub edx, ebx
add edx, edi
mov esi, edx
and esi, 1
mov ebx, 0x9d
sub ebx, edx
and edx, 0xfffffffe
add edx, 0x62
xor edx, 0xfe
and ebx, 0xfe
or ebx, edx
not ebx
add ebx, esi
mov byte [esp + ecx], bl
inc ecx
add eax, 2
cmp ecx, 4
jne 0x43d9c0
mov eax, dword [esp]
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x43da71
xor edx, edx
mov esi, dword [0x44a4b0]
nop
nop
nop
cmp dword [esi + edx*8], 0x4e66b5a3
je 0x43da50
inc edx
cmp ecx, edx
jne 0x43da40
jmp 0x43da71
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43da71
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x18
test eax, eax
js 0x43da79
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43da90
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43da8e
mov ecx, dword [esp + 8]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43daa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [esp + 4], 0x20272625
xor eax, eax
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx + 4]
mov ecx, eax
and ecx, 2
mov ebp, ebx
xor ebp, 0x752dbdb9
add ebp, ecx
mov ecx, ebp
and ecx, edi
lea esi, [edi + ebp]
not esi
lea ecx, [esi + ecx*2]
mov esi, ebp
not esi
or ecx, esi
add ecx, ebp
lea ecx, [ecx*2 + 2]
xor ebp, ecx
and esi, ecx
add esi, esi
sub ebp, esi
add ebp, edi
mov edi, ebp
and edi, 1
mov ecx, 0x9d
sub ecx, ebp
and ebp, 0xfffffffe
add ebp, 0x62
xor ebp, 0xfe
and ecx, 0xfe
or ecx, ebp
not ecx
add ecx, edi
mov byte [esp + ebx + 4], cl
inc ebx
add eax, 2
cmp ebx, 4
jne 0x43dac0
mov eax, dword [esp + 4]
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x43db81
xor edi, edi
mov ebx, dword [0x44a4b0]
cmp dword [ebx + edi*8], 0x7e66a1b5
je 0x43db50
inc edi
cmp ecx, edi
jne 0x43db40
jmp 0x43db81
mov edi, dword [ebx + edi*8 + 4]
cmp edi, eax
je 0x43db81
lea eax, [esp + 4]
push 0
push 0
push edx
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push edi
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x30
cmp eax, 0x103
jne 0x43dc59
mov dword [esp], 0x20272625
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx]
mov esi, eax
and esi, 2
mov edx, ecx
xor edx, 0x752dbdb9
add edx, esi
mov esi, edx
and esi, edi
lea ebx, [edx + edi]
not ebx
lea esi, [ebx + esi*2]
mov ebx, edx
not ebx
or esi, ebx
add esi, edx
lea esi, [esi*2 + 2]
xor edx, esi
and ebx, esi
add ebx, ebx
sub edx, ebx
add edx, edi
mov esi, edx
and esi, 1
mov ebx, 0x9d
sub ebx, edx
and edx, 0xfffffffe
add edx, 0x62
xor edx, 0xfe
and ebx, 0xfe
or ebx, edx
not ebx
add ebx, esi
mov byte [esp + ecx], bl
inc ecx
add eax, 2
cmp ecx, 4
jne 0x43dba0
mov eax, dword [esp]
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x43dc51
xor edx, edx
mov esi, dword [0x44a4b0]
nop
nop
nop
cmp dword [esi + edx*8], 0x4e66b5a3
je 0x43dc30
inc edx
cmp ecx, edx
jne 0x43dc20
jmp 0x43dc51
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43dc51
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x18
test eax, eax
js 0x43dc59
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43dc67
mov ecx, dword [esp + 8]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dc70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x38]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ecx], 0
lea ecx, [ecx + 2]
jne 0x43dc90
add ecx, 0xfffffffe
and ecx, 0xfffe
mov word [esp + 4], cx
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0x20272625
xor eax, eax
xor edi, edi
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edi]
mov ecx, eax
and ecx, 2
mov ebx, edi
xor ebx, 0x752dbdb9
add ebx, ecx
mov ecx, ebx
and ecx, ebp
lea edx, [ebx + ebp]
not edx
lea ecx, [edx + ecx*2]
mov edx, ebx
not edx
or ecx, edx
add ecx, ebx
lea ecx, [ecx*2 + 2]
xor ebx, ecx
and edx, ecx
add edx, edx
sub ebx, edx
add ebx, ebp
mov ebp, ebx
and ebp, 1
mov ecx, 0x9d
sub ecx, ebx
and ebx, 0xfffffffe
add ebx, 0x62
xor ebx, 0xfe
and ecx, 0xfe
or ecx, ebx
not ecx
add ecx, ebp
mov byte [esp + edi], cl
inc edi
add eax, 2
cmp edi, 4
jne 0x43dcf0
mov eax, dword [esp]
mov ecx, dword [0x44a4ac]
test ecx, ecx
je 0x43dda7
xor edi, edi
mov ebx, dword [0x44a4b0]
nop
nop
nop
cmp dword [ebx + edi*8], 0x2df48de6
je 0x43dd80
inc edi
cmp ecx, edi
jne 0x43dd70
jmp 0x43dda7
mov edi, dword [ebx + edi*8 + 4]
cmp edi, eax
je 0x43dda7
lea eax, [esp + 0xc]
push esi
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x44a4b4]
call fcn.00439880
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x3733e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x373420
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x37e3d8]
test eax, eax
jne 0x373444
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0x2788995d
mov ecx, eax
call fcn.00373e60
mov dword [0x37e3d8], eax
call eax
mov ebx, eax
mov eax, dword [0x37e664]
test eax, eax
jne 0x37346c
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0xc7d427f1
mov ecx, eax
call fcn.00373e60
mov dword [0x37e664], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x373522
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x373512
cmp ebx, 8
jb 0x3734f7
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x3734b6
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x3734f7
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x3734d0
cmp edx, ebx
jae 0x373512
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x373500
mov edx, dword [esp + 0x18]
test edx, edx
je 0x373520
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x373590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x3735b9
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x37e3d8]
test eax, eax
jne 0x3735dd
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0x2788995d
mov ecx, eax
call fcn.00373e60
mov dword [0x37e3d8], eax
call eax
mov edi, eax
mov eax, dword [0x37e664]
test eax, eax
jne 0x373605
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0xc7d427f1
mov ecx, eax
call fcn.00373e60
mov dword [0x37e664], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x373685
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x37367a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x373640
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x373690
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x3736ba
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x37e3d8]
test eax, eax
jne 0x3736de
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0x2788995d
mov ecx, eax
call fcn.00373e60
mov dword [0x37e3d8], eax
call eax
mov edi, eax
mov eax, dword [0x37e664]
test eax, eax
jne 0x373706
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0xc7d427f1
mov ecx, eax
call fcn.00373e60
mov dword [0x37e664], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x373772
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x37376a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x373740
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x373c70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp + 4], 0x99a0
add dword [esp + 4], 0x7e22
mov eax, dword [esp + 4]
push ebx
mov ebx, ecx
lea eax, [eax + eax*8]
mov dword [esp + 8], eax
xor dword [esp + 8], 0x9d5d2
mov dword [esp + 4], 0xffb7
add dword [esp + 4], 0xffffc0e2
xor dword [esp + 4], 0xc09f
mov dword [esp + 4], 0x28c6
or dword [esp + 4], 0xecedb68f
add dword [esp + 4], 0xbdfb
shl dword [esp + 4], 0xb
xor dword [esp + 4], 0x73e65010
cmp byte [ebx], 0
je 0x373d55
push esi
push edi
lea ecx, [ecx]
mov edi, dword [esp + 0x10]
lea ebx, [ebx + 1]
mov dword [esp + 0xc], 0xffb7
add dword [esp + 0xc], 0xffffc0e2
xor dword [esp + 0xc], 0xc09f
movzx ecx, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], 0x28c6
or dword [esp + 0xc], 0xecedb68f
add dword [esp + 0xc], 0xbdfb
shl dword [esp + 0xc], 0xb
xor dword [esp + 0xc], 0x73e65010
shl esi, cl
movzx ecx, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
movsx eax, byte [ebx - 1]
mov dword [esp + 0x10], eax
add dword [esp + 0x10], esi
shl edx, cl
add dword [esp + 0x10], edx
sub dword [esp + 0x10], edi
cmp byte [ebx], 0
jne 0x373ce0
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret
Function at 0x373e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x373ebc
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.00373c70
xor eax, 0x63bd76f8
cmp eax, dword [esp + 0x10]
je 0x373ec6
inc esi
cmp esi, dword [edi + 0x18]
jb 0x373ea0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x373ef4
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x373ef4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x374050
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x374076
cmp al, 0x2e
je 0x374073
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x374063
jmp 0x374076
mov byte [edx], 0
mov eax, dword [0x37e414]
test eax, eax
jne 0x37409a
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0x9485c9cf
mov ecx, eax
call fcn.00373e60
mov dword [0x37e414], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x3740e1
mov eax, dword [0x37e590]
test eax, eax
jne 0x3740cb
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0xbc96cd14
mov ecx, eax
call fcn.00373e60
mov dword [0x37e590], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x3740e1
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.00373c70
xor eax, 0x63bd76f8
mov ecx, edi
mov edx, eax
call fcn.00373e60
pop edi
pop esi
add esp, 0x104
ret
Function at 0x373f00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], ecx
push ebx
push ebp
mov ecx, dword [eax + 0xc]
add ecx, 0xc
push esi
push edi
mov dword [esp + 0x18], ecx
mov ebp, dword [ecx]
cmp ebp, ecx
je 0x374030
mov edx, dword [ebp + 0x30]
mov dword [esp + 0x14], 0x99a0
add dword [esp + 0x14], 0x7e22
mov eax, dword [esp + 0x14]
lea eax, [eax + eax*8]
mov dword [esp + 0x14], eax
xor dword [esp + 0x14], 0x9d5d2
mov dword [esp + 0x10], 0xffb7
add dword [esp + 0x10], 0xffffc0e2
xor dword [esp + 0x10], 0xc09f
mov dword [esp + 0x10], 0x28c6
or dword [esp + 0x10], 0xecedb68f
add dword [esp + 0x10], 0xbdfb
shl dword [esp + 0x10], 0xb
xor dword [esp + 0x10], 0x73e65010
cmp word [edx], 0
je 0x374016
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 0xffb7
add dword [esp + 0x10], 0xffffc0e2
xor dword [esp + 0x10], 0xc09f
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], 0x28c6
or dword [esp + 0x10], 0xecedb68f
add dword [esp + 0x10], 0xbdfb
shl dword [esp + 0x10], 0xb
xor dword [esp + 0x10], 0x73e65010
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edi, dword [esp + 0x14]
movzx eax, word [edx]
shl edi, cl
cmp eax, 0x41
jb 0x373ff9
cmp eax, 0x5a
ja 0x373ff9
add eax, 0x20
mov dword [esp + 0x14], eax
add edx, 2
add dword [esp + 0x14], esi
add dword [esp + 0x14], edi
sub dword [esp + 0x14], ebx
cmp word [edx], 0
jne 0x373f92
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor eax, 0x3808cc1b
cmp eax, dword [esp + 0x1c]
je 0x37403a
mov ebp, dword [ebp]
cmp ebp, ecx
jne 0x373f25
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x374310
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x3744ae
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x3744ae
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x3744ae
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x3744ae
mov eax, dword [0x37dc0c]
test eax, eax
jne 0x37437b
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0x5a6cd0b2
mov ecx, eax
call fcn.00373e60
mov dword [0x37dc0c], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x3744a5
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x37decc]
test eax, eax
jne 0x3743db
mov ecx, 0xea26ec0f
call fcn.00373f00
mov edx, 0x5e00a98f
mov ecx, eax
call fcn.00373e60
mov dword [0x37decc], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x37445e
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x37decc]
test eax, eax
jne 0x374446
mov ecx, 0xea26ec0f
call fcn.00373f00
mov edx, 0x5e00a98f
mov ecx, eax
call fcn.00373e60
mov dword [0x37decc], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x374405
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.003745e0
mov edx, edi
mov ecx, ebx
call fcn.003744f0
pop esi
test eax, eax
jne 0x3744a5
mov eax, dword [0x37df10]
test eax, eax
jne 0x374499
mov ecx, 0xb7762a69
call fcn.00373f00
mov edx, 0x994fa9af
mov ecx, eax
call fcn.00373e60
mov dword [0x37df10], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret