joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6d70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4a6d7b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4a6e7e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x11fc624]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x11fc624]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x11fc624]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x11fc624]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x11fc624]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x11fc624]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x11fc624]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x11fc624]
xor eax, edx
inc ecx
dec edi
jne 0x4a6d96
pop edi
test esi, esi
je 0x4a6ea0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x11fc624]
xor eax, edx
inc ecx
dec esi
jne 0x4a6e82
pop esi
pop ebx
not eax
ret

Function at 0x4a7650
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x4a7691
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a7686
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x4a76a4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x4ac320
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x126b618]
xor edx, edx
cmp eax, edx
jne 0x4ac346
xor eax, eax
mov byte [eax + 0x126b518], al
inc eax
cmp eax, 0x100
jl 0x4ac32e
mov dword [0x126b618], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x126b518
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4ac3d7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4ac3aa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4ac378
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4ac450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4ac4a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4ac48a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b2e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e331e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004b3780
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x11fcc9c
call fcn.004d21ba
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4b2ef3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004d21ba
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4b2eec
push 0
mov ecx, eax
call fcn.004a9f60
mov dword [esi + 0xc], eax
jmp 0x4b2ef5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b2ef5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4c2b05
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4c2b25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004c250a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4c2b48
test byte [esp + 8], 2
je 0x4c2b48
call fcn.004c257d
mov dword [eax], 0xd
call fcn.004c2586
mov dword [eax], 5
jmp 0x4c2b21
xor eax, eax
ret

Function at 0x4d485c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d4894
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004d28d4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004d28ac
jmp 0x4d48a0
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d6057
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d6099
call fcn.004dc289
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d6099
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d6090
xor eax, eax
jmp 0x4d60a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d60a7
pop edi
pop esi
pop ebx
ret 4

Function at 0x4dc7b9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4dc7e7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4dc805
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004dc71f
jmp 0x4dc805
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4dc805
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004dc71f
test edi, edi
mov eax, edi
jne 0x4dc7ef
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x420393
Capabilities:
Encode data using xor

Disassembly:
test byte [eax], cl
mov ch, 0x21
stc
cdq
adc ah, byte [esi + 0x3553b5ee]
pop ds
test byte [ebx], cl
inc esp
jns 0x4203fa
test dword [esi - 0x17], esp
clc
pop esp
cmp dword [ebp - 0x17d0e026], 0x513aff35
mov cl, 0xad
mov ebp, 0xe82f1fda
xor eax, 0xb1513aff
lodsd eax, dword [esi]
sub esi, dword [eax]
xchg esp, eax
inc esp
mov eax, dword [0x46af40f4]
js 0x42039b
push eax
insd dword es:[edi], dx
cwde
pop es
adc al, 0x51
adc eax, 0x7fcd871d
push ebp
pop eax
xchg edx, eax
salc
inc ebx
and eax, 0x6c77d380
sub al, 0
pop ecx
mov ch, 0xb8
pop ebp
out 0xa5, eax
jb 0x4203cd
and edx, dword [ebx + 0x2f85b78]
nop
loopne 0x420382
add byte [eax - 0x45], 0xfd
sub eax, 0x9c477570
shl dword ss:[edi - 7], 0xa1
push ebp
pop esp
iretd
out dx, al
jbe 0x420425
dec ecx
sub dh, byte [ebx]
leave
and ch, cl
Function at 0x493db3
Capabilities:
Encode data using xor

Disassembly:
test byte [0xe7bd9e27], 0x91
sbb bh, byte [ebx + 0x1d]
push esi
pop ebp
add edi, dword [ebx]
sahf
mov ebp, 0x7b1a91e7
sbb eax, 0x3b035d56
loop 0x493d9f
mov ch, 0x91
xor edx, esi
salc
salc
xor eax, 0x511967fc
push ebx
or al, byte [ebx]
xor al, 0x7b
mov dh, 0x1e
add eax, ebx
lds ecx, [ecx + ebp*8 - 0x53]
in eax, dx
jae 0x493da2
aad 0xd
xchg ebp, eax
mov byte [0x1183a7eb], al
xchg dword [esi - 0x6e49836e], ebp
and dword [0x2713159d], eax
movsb byte es:[edi], byte [esi]
rol ebx, 1
mov esi, ebx
cmp eax, 0x5fd714e
setno byte [ebx + 0x4f174385]
pop ss
dec edi
movsb byte es:[edi], byte [esi]
wait
inc ebp
arpl word [ebp - 0x537a84e7], ax
xor ebx, dword [0x259b0543]
add eax, 0x8503bcc1
pop esi
jge 0x493e7d
les esp, [0x3dbd4cd0]
mov dh, 0xbe
clc
mov dword [0x974ab2b0], eax
or esp, dword [ebx]
loopne 0x493dcb
sub eax, edx
jno 0x493daf
jle 0x493dec
scasb al, byte es:[edi]
or eax, 0x55cf092b
aas
pushal
clc
mov eax, 0x65b71094
xor eax, 0x65bdad63
sub al, 0xe3
outsb dx, byte [esi]
ror eax, cl
fnstcw word [eax - 0x5a098bda]
salc
adc ah, byte [edx - 0x28]
mov edi, esi
adc eax, 0xd39087b3
leave
sbb ch, 0x2a
mov bh, 0x32
mov dword [edi + 0x5c], edi
popal
mov ebx, 0x75a09d9f
mov ch, 5
sub eax, dword [0x680275a1]
lodsb al, byte [esi]
scasd eax, dword es:[edi]
pop ss
test byte [ebx - 9], dl
push ecx
or ebx, ebp
xor al, 0x82
cmp byte [ecx], dl
add eax, 0xd7ba305
wait
aad 0x10
jne 0x493ea9
xor al, 0xf7
inc ebx
mov dl, byte [edi - 0x319a468d]
into
movsd dword es:[edi], dword [esi]
push ecx
dec ebx
inc ebp
wait
salc
add byte [eax - 0x26], dh
pop ss
out dx, al
mov ds, ebx
dec byte [edi - 0x1e]
jecxz 0x493e25
add byte [ebp + 0x35], dl
and dl, bh
mov esp, 0xef77c036
out dx, al
mov cs, edi
push dword [ecx + 0x60428dd6]
loope 0x493f0b
int 0x91
int1
or eax, 0xb8424817
das
xchg ebx, eax
sub dword [ebx], 0x40136247
dec ebp
jmp 0x493f2d
pop ecx
scasb al, byte es:[edi]
jecxz 0x493f54
ret 0x2355
push ebp
and ecx, eax
hlt
cmp edi, dword [ebp + 0x73]
inc edx
jmp 0x5abe72e3
jne 0x493f10
pushal
mov edi, 0xe3034261
mov edi, 0x7a50a633
insd dword es:[edi], dx
jp 0x493fcf
scasd eax, dword es:[edi]
push esi
xor dword [edx], esi
dec ebp
add dword [edi + 0x3a909442], 0x20
and ecx, dword [ecx - 0x62ca72d0]
adc ebp, eax
lodsd eax, dword [esi]
pushal
inc esi
adc cl, bl
xor al, 0xd9
shl dword es:[ebx + edx*2 + 0x14722b96], 1
add ebx, 0x5ed3abd9
mov dword [0xf4c12ea7], eax
faddp st(5)
and esi, eax
jb 0x493f60
invalid
shl esi, cl
mov cl, 0x65
invalid
Function at 0x40377f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403822
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00414eb5
pop ecx
pop ecx
test eax, eax
je 0x40380b
test ebx, ebx
je 0x4037ff
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00414eb5
pop ecx
pop ecx
test eax, eax
jle 0x40380b
push ebx
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x4037cc
xor edi, edi
cmp ebx, edi
jne 0x403826
xor eax, eax
jmp 0x403892
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403855
call fcn.0040473f
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403822
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403822
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403845
cmp dword [ebp - 0x70], edi
je 0x403888
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x9c
leave
ret
Function at 0x404934
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.004047a1
push 8
mov esi, eax
call fcn.004046d7
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40499f
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x4049a6
and dword [ebx + 4], 0
jmp 0x4049bb
xor eax, eax
jmp 0x404a86
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x404a6c
push edi
call fcn.00408090
pop ecx
cmp eax, 4
jl 0x404992
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x404992
add eax, 0xfffffffd
push 0x4197b4
push eax
mov dword [ebp - 0x74], eax
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
je 0x404a01
push 0x4197b0
push dword [ebp - 0x74]
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push 0x3b
push edi
call fcn.004097a0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push dword [ebp - 0x78]
call fcn.00408090
push edi
mov ebx, eax
call fcn.00408090
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.004046d7
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.00414eb5
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.00414eb5
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.004047f7
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x404992
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.0040473f
push ebx
call fcn.0040473f
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x214
leave
ret

Function at 0x4088d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420030]
jne 0x4088e3
repz ret
jmp fcn.00410778
Function at 0xc65820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0x48]
lea esi, [ebx + 0x28]
mov edx, dword [ebx + 4]
add eax, 0x28
mov ecx, dword [ebx]
add eax, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
test edx, edx
jne 0xc6586b
cmp ecx, 0x20
jae 0xc6586b
mov edi, dword [ebp + 8]
mov ebx, dword [ebx + 0x18]
add ebx, 0x165667c5
mov edi, dword [edi + 0x1c]
adc edi, 0x27d4eb2f
jmp 0xc65902
push dword [ebx + 0x24]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x12
push dword [ebx + 0x24]
push dword [ebx + 0x20]
call fcn.0139c8c8
push 0xc
push dword [ebx + 0x1c]
mov edi, eax
mov esi, edx
push dword [ebx + 0x18]
call fcn.0139c8c8
push 7
push dword [ebx + 0x14]
add edi, eax
push dword [ebx + 0x10]
adc esi, edx
call fcn.0139c8c8
push 1
push dword [ebx + 0xc]
add edi, eax
push dword [ebx + 8]
adc esi, edx
call fcn.0139c8c8
add esp, 0x30
add edi, eax
adc esi, edx
push esi
push edi
call fcn.01399ce8
add esp, 0x10
push edx
push eax
call fcn.01399ce8
add esp, 0x10
push edx
push eax
call fcn.01399ce8
add esp, 0x10
push edx
push eax
call fcn.01399ce8
mov esi, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
mov edi, edx
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov edx, dword [ebp - 0x10]
add ebx, ecx
lea ecx, [esi + 8]
adc edi, edx
jmp 0xc6595c
push 0x1b
push esi
call fcn.013a428c
push edx
push eax
push 0
push 0
call fcn.00c5e1b8
add esp, 0x14
xor edx, edi
xor eax, ebx
push edx
push eax
call fcn.0139c8c8
add esp, 0xc
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.013a5fe4
mov ecx, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0xc2b2ae63
mov edi, edx
adc edi, 0x85ebca77
add esi, 8
add ecx, 8
mov dword [ebp - 8], ecx
cmp ecx, eax
jbe 0xc6590b
lea ecx, [esi + 4]
mov dword [ebp - 0x10], ecx
cmp ecx, eax
ja 0xc659bf
push 0x17
push esi
call fcn.013a53b8
pop ecx
mov ecx, eax
mov eax, 0x9e3779b1
mul ecx
mov esi, eax
mov eax, 0x85ebca87
mul ecx
add esi, edx
xor eax, ebx
xor esi, edi
push esi
push eax
call fcn.0139c8c8
add esp, 0xc
push 0xc2b2ae3d
push 0x27d4eb4f
push edx
push eax
call fcn.013a5fe4
mov esi, dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0x9e3779f9
mov edi, edx
adc edi, 0x165667b1
cmp esi, eax
jae 0xc65a03
movzx eax, byte [esi]
push 0xb
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.013a5fe4
xor edx, edi
xor eax, ebx
push edx
push eax
call fcn.0139c8c8
add esp, 0xc
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.013a5fe4
inc esi
mov ebx, eax
mov edi, edx
cmp esi, dword [ebp - 4]
jb 0xc659c3
push 0xc2b2ae3d
xor eax, eax
mov ecx, edi
push 0x27d4eb4f
shr ecx, 1
xor eax, edi
xor ecx, ebx
push eax
push ecx
call fcn.013a5fe4
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.013a5fe4
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
leave
ret
Function at 0xc6711c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, dword [edx]
mov eax, dword [edx + 4]
test esi, esi
jle 0xc6717f
mov ecx, dword [ebp + 0x10]
sub dword [ebp + 0xc], ecx
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
push edi
inc bl
movzx ebx, bl
mov cl, byte [edx + ebx + 8]
add al, cl
movzx eax, al
mov dword [ebp + 8], eax
mov edi, dword [ebp + 8]
mov al, byte [edx + eax + 8]
mov byte [edx + ebx + 8], al
add al, cl
movzx eax, al
mov byte [edx + edi + 8], cl
mov cl, byte [eax + edx + 8]
mov eax, dword [ebp + 0x10]
xor cl, byte [esi + eax]
mov byte [eax], cl
inc eax
sub dword [ebp - 4], 1
mov dword [ebp + 0x10], eax
mov eax, edi
jne 0xc6713e
mov esi, dword [ebp + 0x14]
pop edi
mov dword [edx + 4], eax
mov eax, esi
pop esi
mov dword [edx], ebx
pop ebx
leave
ret
Function at 0x139dd58
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push edi
mov ebx, 0x13a88d8
mov eax, dword [eax + 0xc]
push ebx
mov edi, dword [eax + 0x18]
push dword [edi + 0x28]
call fcn.00c615b0
pop ecx
pop ecx
test eax, eax
jne 0x139dd7f
mov eax, dword [edi + 0x10]
jmp 0x139dd9e
push esi
mov esi, dword [edi + 4]
jmp 0x139dd97
push ebx
push dword [esi + 0x28]
call fcn.00c615b0
pop ecx
pop ecx
test eax, eax
je 0x139dda1
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x139dd85
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [esi + 0x10]
jmp 0x139dd9d

Function at 0x139f824
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
test ebx, ebx
je 0x139f87f
mov edi, dword [ebp + 0xc]
test edi, 0xffff0000
jne 0x139f849
sub edi, dword [ebx + esi + 0x10]
jmp 0x139f89a
mov ecx, dword [ebx + esi + 0x20]
xor eax, eax
add ecx, esi
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
cmp dword [ebx + esi + 0x18], eax
jbe 0x139f87f
mov eax, dword [ecx + eax*4]
add eax, esi
push edi
push eax
call fcn.00c5a454
pop ecx
pop ecx
test eax, eax
je 0x139f888
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebx + esi + 0x18]
jb 0x139f85d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 8]
test ecx, ecx
js 0x139f87f
mov eax, dword [ebx + esi + 0x24]
lea eax, [eax + ecx*2]
movzx edi, word [eax + esi]
cmp edi, 0xffffffff
je 0x139f87f
cmp edi, dword [ebx + esi + 0x14]
jae 0x139f87f
mov eax, dword [ebx + esi + 0x1c]
lea eax, [eax + edi*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x139f881