joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x48d6fd
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x48d676
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x48d676
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x48d65d
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x48d65d
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.0048e7b0
mov ebp, eax
test ebp, ebp
je 0x48d655
push ebp
mov ecx, esi
call fcn.0048fc30
test eax, eax
je 0x48d655
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x48d655
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x48d616
xor eax, eax
jmp 0x48d61e
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.00490600
inc ebx
xor ebp, ebp
jmp 0x48d5a7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x48d580
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.0048eac0
test eax, eax
pop ebx
je 0x48d6fd
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.0048e7b0
mov edi, eax
cmp edi, ebp
je 0x48d6fd
push edi
mov ecx, esi
call fcn.0048fc30
test eax, eax
je 0x48d6fd
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.0048ed00
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.0048ed70
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.00490600
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x496240
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d5891
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x49627d
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.004cccdd
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.004cc025
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.0048f0c0
lea ecx, [esp + 8]
call fcn.004ccf4c
lea ecx, [esp + 0x30]
call fcn.004cc189
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.004cc025
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.0048f530
lea ecx, [esp + 0x74]
call fcn.004cc189
lea ecx, [esp + 8]
call fcn.004ccf4d
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.0048cce0
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.0048efd0
mov ecx, esi
call fcn.0048fb70
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.0048efd0
mov ecx, esi
call fcn.0048fb70
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.0048efd0
mov ecx, esi
call fcn.0048fb70
mov ecx, dword [edi + 0x5c]
call fcn.0048c4c0
push eax
mov ecx, esi
call fcn.0048c4d0
mov ecx, dword [edi + 0x5c]
call fcn.0048ca80
push eax
mov ecx, esi
call fcn.0048ca20
mov ecx, dword [edi + 0x5c]
call fcn.0048cba0
push eax
mov ecx, esi
call fcn.0048cb50
mov ecx, dword [edi + 0x5c]
push 0
call fcn.0048bda0
push eax
mov ecx, esi
call fcn.0048bdb0
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.004cc101
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.004cc101
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.004ccd66
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x497ac0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4d5ab7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.004c3128
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.004c3128
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004985e0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x498630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d5b90
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004cecd0
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x498663
xor al, al
jmp 0x49878f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x498685
xor al, al
jmp 0x49878f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x498698
xor al, al
jmp 0x49878f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x4986ac
xor al, al
jmp 0x49878f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.004c31ed
test eax, eax
jne 0x4986e0
xor al, al
jmp 0x49878f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x6b4294
mov dword [esp + 0x20], ebp
call fcn.004cecd0
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.004cbcda
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.004cbd31
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x498774
mov ax, word [ebx]
test ax, ax
je 0x498766
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.004987b0
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x49874a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.004cbd31
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x498cb0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004cd38a
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x498cf6
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.004b3298
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x6d31f0
push ecx
call fcn.004b5212
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x49e4d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x70ae60]
xor edx, edx
cmp eax, edx
jne 0x49e4f6
xor eax, eax
mov byte [eax + 0x70ad60], al
inc eax
cmp eax, 0x100
jl 0x49e4de
mov dword [0x70ae60], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x70ad60
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x49e587
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x49e55a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x49e528
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x49e600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x49e653
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x49e63a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a4fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d5ffe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004a58f0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x6b4664
call fcn.004c4c01
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4a5063
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004c4c01
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4a505c
push 0
mov ecx, eax
call fcn.0049c100
mov dword [esi + 0xc], eax
jmp 0x4a5065
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4a5065
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4c72a0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c72d8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c531b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c52f3
jmp 0x4c72e4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c8a9e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c8ae0
call fcn.004cecd0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c8ae0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c8ad7
xor eax, eax
jmp 0x4c8ae8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c8aee
pop edi
pop esi
pop ebx
ret 4

Function at 0x4cf200
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4cf22e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4cf24c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004cf166
jmp 0x4cf24c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4cf24c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004cf166
test edi, edi
mov eax, edi
jne 0x4cf236
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10005e78
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
push dword [esp + 0x2c]
push edx
push ecx
call fcn.1000dd01
and dword [esp + 0x2c], 0
lea edi, [edx + 4]
and dword [esp + 0x30], 0
mov dword [esp + 0x28], 0x8d008f
mov dword [esp + 0x1c], 0xb6a64f
shl dword [esp + 0x1c], 0xc
xor dword [esp + 0x1c], 0x6a696ce6
mov dword [esp + 0x18], 0xfb4db3
shr dword [esp + 0x18], 2
add dword [esp + 0x18], 0x46d8
xor dword [esp + 0x18], 0x3c76f9
mov ecx, dword [edx]
mov eax, dword [edi]
add edi, 4
xor eax, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add esp, 8
mov edx, esi
call fcn.10015a10
mov ebx, eax
mov dword [esp + 0x14], ebx
pop ecx
test ebx, ebx
je 0x10005f67
shr esi, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x10005f5e
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc ebp
mov byte [edx - 1], cl
cmp ebp, esi
jb 0x10005f35
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
pop ebp
mov byte [ebx + eax], 0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x1c
ret

Function at 0x100064d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
push dword [esp + 0x2c]
push ebx
push ebp
push edx
push ecx
call fcn.1000dd01
and dword [esp + 0x2c], 0
add esp, 0x18
and dword [esp + 0x18], 0
mov dword [esp + 0x10], 0xdf1676
mov dword [esp + 0x20], 0x1034a0
add dword [esp + 0x20], 0xffff2748
imul eax, dword [esp + 0x20], 0x12
mov dword [esp + 0x20], eax
shr dword [esp + 0x20], 7
xor dword [esp + 0x20], 0x228e9
mov ecx, dword [ebx + 0x3c]
mov eax, dword [esp + 0x20]
add ecx, ebx
sub ebp, dword [ecx + 0x34]
mov edx, dword [ecx + eax*8 + 0x78]
mov dword [esp + 0x20], ebp
add edx, ebx
mov ebp, dword [ecx + eax*8 + 0x7c]
add ebp, edx
mov dword [esp + 0xc], ebp
cmp edx, ebp
jae 0x1000659b
push esi
push edi
mov edi, dword [edx + 4]
lea esi, [edx + 8]
add edi, edx
cmp esi, edi
jae 0x10006592
mov ebp, dword [esp + 0x28]
movzx eax, word [esi]
mov ecx, eax
mov dword [esp + 0x10], 0x3000
and ecx, 0xfff
and eax, 0xf000
add ecx, dword [edx]
add ecx, ebx
cmp ax, word [esp + 0x10]
jne 0x10006587
add dword [ecx], ebp
add esi, 2
cmp esi, edi
jb 0x10006562
mov ebp, dword [esp + 0x14]
add edx, dword [edx + 4]
cmp edx, ebp
jb 0x10006552
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x100075a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
push edi
push dword [esp + 0x30]
push ebx
push edx
push ecx
call fcn.1000dd01
mov dword [esp + 0x2c], 0xfa8e23
add esp, 0x10
imul eax, dword [esp + 0x1c], 0x46
mov dword [esp + 0x1c], eax
xor dword [esp + 0x1c], 0x4482dd93
mov dword [esp + 0x24], 0x36bdde
xor dword [esp + 0x24], 0x53899f9c
xor dword [esp + 0x24], 0x53ba54ae
mov dword [esp + 0x20], 0x98b1fe
shl dword [esp + 0x20], 0xc
xor dword [esp + 0x20], 0x8b1b9cc2
mov dword [esp + 0x10], 0x3a0529
imul eax, dword [esp + 0x10], 0x79
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xffff6ac3
xor dword [esp + 0x10], 0x1b6e088f
mov dword [esp + 0x2c], 0xcdcb08
shr dword [esp + 0x2c], 1
shr dword [esp + 0x2c], 0xf
xor dword [esp + 0x2c], 0xe1ce9
mov dword [esp + 0x18], 0xc7936d
shr dword [esp + 0x18], 0xa
shr dword [esp + 0x18], 0xe
xor dword [esp + 0x18], 0x9f505
mov dword [esp + 0x14], 0xab1413
shl dword [esp + 0x14], 5
shr dword [esp + 0x14], 0xc
xor dword [esp + 0x14], 0x6c652
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esp + 0x1c]
add eax, ebx
mov edx, dword [eax + ecx*8 + 0x78]
test edx, edx
je 0x10007703
cmp dword [eax + ecx*8 + 0x7c], 0
je 0x10007703
lea esi, [edx + ebx]
jmp 0x100076fc
add eax, ebx
push eax
push dword [esp + 0x30]
push dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
call fcn.10012393
mov ecx, eax
add esp, 0xc
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x1000770e
mov edi, dword [esi]
mov ebp, dword [esi + 0x10]
add edi, ebx
add ebp, ebx
jmp 0x100076f3
jns 0x100076cb
movzx eax, ax
jmp 0x100076d0
add eax, 2
add eax, ebx
push dword [esp + 0x14]
mov edx, ecx
mov ecx, dword [esp + 0x1c]
push eax
call fcn.10013094
pop ecx
pop ecx
test eax, eax
je 0x1000770e
mov ecx, dword [esp + 0x1c]
add edi, 4
mov dword [ebp], eax
add ebp, 4
mov eax, dword [edi]
test eax, eax
jne 0x100076c4
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x10007694
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor eax, eax
jmp 0x10007706
Function at 0x1000ee8b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
push ebp
push dword [esp + 0x40]
push edx
push ecx
call fcn.1000dd01
mov dword [esp + 0x38], 0x88aba1
xor esi, esi
mov dword [esp + 0x3c], 0x4ff546
add esp, 0x10
mov dword [esp + 0x30], 0x390980
xor edx, edx
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], 0x99a2b2
add dword [esp + 0x40], 0x11b9
add dword [esp + 0x40], 0xffff9c32
shl dword [esp + 0x40], 7
xor dword [esp + 0x40], 0x4ca84e80
mov dword [esp + 0x10], 0xc5c2fe
xor dword [esp + 0x10], 0x7a68255d
xor dword [esp + 0x10], 0x91a4960
shl dword [esp + 0x10], 0x10
xor dword [esp + 0x10], 0xaec0b2a5
mov dword [esp + 0x14], 0x8fe442
mov eax, dword [esp + 0x14]
push 0x61
pop ecx
div ecx
mov dword [esp + 0x14], eax
xor dword [esp + 0x14], 0xa9da7
mov eax, dword [ebp + 0x3c]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x24], eax
mov ebx, dword [eax + ebp + 0x78]
add ebx, ebp
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
add eax, ebp
mov dword [esp + 0x20], eax
add ecx, ebp
mov eax, dword [ebx + 0x24]
add eax, ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
jmp 0x1000ef7c
mov eax, dword [ecx + edi*4]
push dword [esp + 0x14]
mov edx, dword [esp + 0x14]
add eax, ebp
mov ecx, dword [esp + 0x40]
push eax
call fcn.1001a38b
pop ecx
pop ecx
test eax, eax
je 0x1000ef83
mov ecx, dword [esp + 0x18]
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x1000ef5a
jmp 0x1000efa9
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
movzx eax, word [eax + edi*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, ebx
jb 0x1000efa9
mov ecx, dword [esp + 0x24]
xor eax, eax
mov ecx, dword [ecx + ebp + 0x7c]
add ecx, ebx
cmp esi, ecx
cmovb esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x1000f9d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
mov esi, edx
push esi
push ecx
call fcn.1000dd01
add esp, 0xc
mov dword [ebp - 4], 0x423eb4
mov eax, dword [ebp - 4]
xor edx, edx
push 0x62
pop ecx
div ecx
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x36
mov dword [ebp - 4], eax
xor dword [ebp - 4], 0x248183
cmp dword [esi + 4], 0x40
jae 0x1000fa10
xor eax, eax
jmp 0x1000fa37
mov ecx, dword [esi]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1000fa0c
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1000fa0c
movzx edx, word [eax + 0x18]
xor esi, esi
mov ecx, dword [ebp - 4]
cmp edx, ecx
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10016189
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
push ebx
push esi
push dword [esp + 0x38]
push dword [esp + 0x38]
push edx
push ecx
call fcn.1000dd01
mov dword [esp + 0x34], 0xdd1462
xor edi, edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x28], 0x8a2be1
imul eax, dword [esp + 0x28], 0x3f
mov dword [esp + 0x28], eax
xor dword [esp + 0x28], 0x220b805a
mov dword [esp + 0x4c], 0x5a6f89
add dword [esp + 0x4c], 0xffffb4a8
or dword [esp + 0x4c], 0x44db16a4
xor dword [esp + 0x4c], 0x44d980a4
mov eax, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
xor edx, eax
mov dword [esp + 0x2c], eax
mov eax, edx
mov dword [esp + 0x30], edx
and eax, 0xfffffffc
mov ecx, edx
add eax, 4
mov ebp, edx
and cl, 3
cmovne ebp, eax
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x28]
add esp, 0x14
mov edx, ebp
call fcn.10015a10
mov dword [esp + 0x38], eax
pop ecx
test eax, eax
je 0x10016273
shr ebp, 2
lea ecx, [esi + ebp*4]
xor ebp, ebp
mov edx, ecx
sub edx, esi
add edx, 3
shr edx, 2
cmp esi, ecx
cmova edx, ebp
test edx, edx
je 0x10016269
mov ebp, dword [esp + 0x14]
mov ecx, eax
sub ecx, esi
mov eax, dword [esi]
xor eax, ebp
inc edi
mov dword [ecx + esi], eax
lea esi, [esi + 4]
cmp edi, edx
jb 0x10016256
mov eax, dword [esp + 0x34]
test ebx, ebx
je 0x10016273
mov ecx, dword [esp + 0x18]
mov dword [ebx], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret