joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488210
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x49a265
call fcn.0049202e
push 0xffffffffffffffff
push dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x14], edi
call fcn.004907a4
test eax, eax
je 0x488334
push 0xffffffffffffffff
push dword [ebp + 0x10]
call fcn.004907a4
test eax, eax
je 0x488334
cmp dword [ebp + 0x14], edi
je 0x488334
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
je 0x4882ab
lea eax, [ebp - 0x1c]
push eax
call fcn.0048833f
pop ecx
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
mov ecx, 0x7f6050
push dword [eax]
mov eax, SysReAllocString
push str.CEMFRegistry::GetEntry__s___s___s__RegOpenKeyEx____lu_n
call fcn.004012c0
lea ecx, [ebp - 0x1c]
add esp, 0x14
call dword [0x4a2ee8]
mov eax, 0x80004005
jmp 0x488339
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x18], 4
je 0x4882d4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4882a1
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x488330
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.0048833f
pop ecx
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
mov ecx, 0x7f6050
push dword [eax]
mov eax, SysReAllocString
push str.CEMFRegistry::GetEntry__s___s___s__RegQueryValueEx____lu_n
call fcn.004012c0
lea ecx, [ebp - 0x20]
jmp 0x488298
xor eax, eax
jmp 0x488339
mov eax, 0x80070057
call fcn.00492106
ret
Function at 0x489b7f
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
push 0x4b3e9c
mov dword [esi], vtable.CSCSITransport.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x489c0a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetASPI32SupportInfo
push eax
call edi
push str.SendASPI32Command
push dword [esi + 4]
mov dword [esi + 8], eax
call edi
push str.GetASPI32Buffer
push dword [esi + 4]
mov dword [esi + 0xc], eax
call edi
push str.FreeASPI32Buffer
push dword [esi + 4]
mov dword [esi + 0x10], eax
call edi
push str.TranslateASPI32Address
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 8]
cmp eax, ebx
pop edi
je 0x489bfc
call eax
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1c], eax
mov eax, esi
pop ebx
ret

Function at 0x48dd3c
Capabilities:
Check mutex on windows

Disassembly:
push dword [esp + 4]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [0x7f6258], eax
jne 0x48dd5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x48dd7e
push dword [0x7f6258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x7f6258], 0
jmp 0x48dd59
xor eax, eax
inc eax
ret

Function at 0x48dd87
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x4925ef
call fcn.0049202e
xor edi, edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
push eax
push 1
push edi
mov dword [ebp - 4], 2
push dword [ebp + 0x10]
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48ddcb
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x18]
push eax
call dword [0x4a2bf4]
jmp 0x48de63
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x14]
call esi
mov ebx, eax
cmp ebx, 0xea
je 0x48ddee
cmp ebx, edi
jne 0x48de0b
push dword [ebp - 0x10]
call fcn.004903b4
pop ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
push edi
push edi
push dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call esi
mov ebx, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x48ddb9
cmp dword [ebp - 0x10], edi
push dword [ebp - 0x18]
jne 0x48de37
call fcn.004903a8
mov ecx, dword [ebp + 8]
mov dword [esp], method.CDlgPage.virtual_288
call dword [0x4a2bf8]
jmp 0x48de63
lea ecx, [ebp - 0x1c]
call dword [0x4a2bf8]
push dword [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.004903a8
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call dword [0x4a2bf4]
lea ecx, [ebp - 0x1c]
call dword [0x4a2d9c]
lea ecx, [ebp + 0x10]
call dword [0x4a2d9c]
lea ecx, [ebp + 0x14]
call dword [0x4a2d9c]
lea ecx, [ebp + 0x18]
call dword [0x4a2d9c]
mov eax, dword [ebp + 8]
call fcn.00492106
ret
Function at 0x48de87
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48dec5
lea ecx, [ebp + 0xc]
call dword [0x4a2d9c]
lea ecx, [ebp + 0x10]
call dword [0x4a2d9c]
mov eax, dword [ebp + 0x14]
leave
ret
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x48df09
mov esi, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
call dword [0x4a2d9c]
lea ecx, [ebp + 0x10]
call dword [0x4a2d9c]
mov eax, esi
pop esi
leave
ret
mov esi, dword [ebp - 0x10]
jmp 0x48def2

Function at 0x48df0e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x48df4e
lea ecx, [ebp + 0xc]
call dword [0x4a2d9c]
lea ecx, [ebp + 0x10]
call dword [0x4a2d9c]
xor al, al
pop ebx
leave
ret
push esi
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop esi
je 0x48df8a
lea ecx, [ebp + 0xc]
call dword [0x4a2d9c]
lea ecx, [ebp + 0x10]
call dword [0x4a2d9c]
mov al, bl
jmp 0x48df4b
mov bl, 1
jmp 0x48df74

Function at 0x48e141
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push 0
push 0x4a4090
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48e1a6
cmp dword [ebp + 8], 1
je 0x48e17f
cmp dword [ebp + 8], 2
je 0x48e17f
push 0xd
pop eax
jmp 0x48e1a6
test edi, edi
mov eax, dword [ebp - 4]
je 0x48e1a0
test eax, eax
je 0x48e19c
test al, 1
jne 0x48e17a
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x48e1a0
jmp 0x48e17a
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 4
Function at 0x48e1cc
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [esi + 0xd], 1
mov eax, dword [esi + 8]
test eax, eax
je 0x48e1e6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x48e22f
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x48e222
push 0x3e8
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x48e222
push 0x2a
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
xor eax, eax
leave
ret

Function at 0x48e62e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x7f5b70]
cmp eax, 0x1c00
jle 0x48e664
push esi
push 0
lea eax, [ebp - 4]
push eax
mov esi, 0x7f1570
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
mov dword [0x7f5b70], eax
pop esi
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
lea eax, [eax*2 + 0x7f1570]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
add dword [0x7f5b70], eax
leave
ret
Function at 0x48ea9c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x44]
xor edx, edx
mov eax, 0x40000000
div ebx
push 0
pop edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], 1
mov esi, eax
shl esi, 2
je 0x48eb28
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov eax, edi
imul eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test eax, eax
je 0x48eb1b
mov eax, dword [ebp - 0x18]
test eax, eax
jbe 0x48eb1b
div ebx
add edi, eax
cmp dword [ebp - 0x14], 0x1000
jne 0x48eb24
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 8]
jbe 0x48eb24
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], edx
call fcn.0048e783
test al, al
pop ecx
je 0x48eb24
inc dword [ebp - 4]
jmp 0x48eb24
mov eax, 0x10000
div ebx
add edi, eax
cmp edi, esi
jb 0x48eacf
pop edi
pop esi
pop ebx
leave
ret
Function at 0x490f79
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d4028]
jne 0x490f83
repz ret
jmp fcn.004914b4
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10003890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x100038b4
push eax
push eax
push eax
push 0x100029a0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100038b4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100038bd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000c040]
jne 0x100038c7
repz ret
jmp fcn.10003d71

Function at 0x10006f02
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10004218
and dword [ebp - 0x14], 0
cmp dword [0x1000d8ac], 0
mov dword [ebp - 0x18], eax
jne 0x10006fb5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000705d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000705d
mov esi, dword [0x1000cb94]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000d8ac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000d8b0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000d8b4], eax
call edi
push eax
call esi
mov dword [0x1000d8bc], eax
test eax, eax
je 0x10006fb5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000d8b8], eax
mov eax, dword [0x1000d8b8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x1000cb90]
cmp eax, ecx
je 0x1000700e
cmp dword [0x1000d8bc], ecx
je 0x1000700e
push eax
call esi
push dword [0x1000d8bc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000700e
test ebx, ebx
je 0x1000700e
call edi
test eax, eax
je 0x10007005
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10007005
test byte [ebp - 8], 1
jne 0x1000700e
or dword [ebp + 0x10], 0x200000
jmp 0x10007041
mov eax, dword [0x1000d8b0]
cmp eax, dword [ebp - 0x18]
je 0x10007041
push eax
call esi
test eax, eax
je 0x10007041
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10007041
mov eax, dword [0x1000d8b4]
cmp eax, dword [ebp - 0x18]
je 0x10007041
push eax
call esi
test eax, eax
je 0x10007041
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000d8ac]
call esi
test eax, eax
je 0x1000705d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000705f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100038bd
leave
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
mov eax, dword [edx + 0x45ab560c]
mov byte [esi - 0x17a9af88], dh
push 0x4d8b0000
or byte [edi - 0x3d], ch
enter 0x401e, 0
movsb byte es:[edi], byte [esi]
push ecx
cmp dword [eax + eax*2 - 0x61], 0xffffffac
aam 0x40
add byte [edx - 1], dl
adc eax, sym.imp.MSVCRT.dll_fprintf
mov ebp, 0x3902ac
imul eax, esp, 0x14
xor eax, 0x502674c0
push esp
adc al, 0x35
sal byte [esi + 0x50], 0x26
push esp
loopne 0x401e78
add bh, bh
adc eax, 0x8bc164
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
xchg byte [eax - 0x6f6f6f70], dl
nop
nop

Function at 0x40a340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov eax, dword [ecx + 4]

Function at 0x40a3a0
Capabilities:
Terminate process

Disassembly:
add eax, 0xa4680
pop esi
pop ebp
mov dl, 0xca
add byte [eax - 0x6f6fae70], dl
xchg esp, eax
nop
nop
nop
dec esi
nop
nop
nop
test eax, eax
call 0xd022662
push ecx
call dword [0xcb40c02c]
xor eax, eax
sbb bl, byte [ebp - 0x3e]
add al, 0
cmp eax, 1
js 0x40a370
mov eax, dword [ecx + 8]
push eax
ficom dword [0x58c041]
jmp 0x40a37f
adc dword [edx + eax - 0x50741c8b], 3
push ecx
adc eax, sym.imp.KERNEL32.dll_ReleaseMutex
xchg eax, eax
jne 0x40a329
mov esi, dword [0x403798]
call esi
and dl, byte [edi - 0x2900368c]
add eax, 0x120afc80
xor dword [ebp - 0x3e], ebx
add al, 0
nop
nop
nop
nop
aam 0x35
xor eax, 0x458becd4
or byte [eax - 0x80], ch
cmovo eax, dword [eax]
push eax
mov eax, dword [eax]
push eax
call fcn.004056c0
cmp al, 0xc2
cli
add byte [esi - 0x6f6f0170], cl
Function at 0x2349a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x278e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x292014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x2930ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.002480c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x292a8c
push eax
call fcn.002480c0
mov esi, dword [0x2930fc]
xor ebx, ebx
mov edi, dword [0x293100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x296390], bl
mov eax, ebx
mov ecx, 0x2930ec
cmovae ecx, dword [0x2930ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x2964a0], al
inc ebx
cmp ebx, 0x100
jl 0x234a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x296390]
movzx eax, byte [esi + 0x2964a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x234a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x296390]
mov byte [esi + 0x296390], al
inc esi
mov byte [edi + 0x296390], dl
cmp esi, 0x100
jl 0x234a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00234690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x234ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x234abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x234b1f
push edx
push ecx
call fcn.0024d663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x234b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x234b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x234b1f
push edx
push ecx
call fcn.0024d663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00266c6a
int3
Function at 0x2370a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x292014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x5340131
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x237289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x237289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.002640f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x534019d
nop
test eax, eax
je 0x237289
push 4
push 0x1000
push 4
push 0
call 0x5330e3e
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x5320006
nop
test eax, eax
je 0x237289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x288df8
push dword [esp + 0x30]
call 0x5320452
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x2371ac
push 0x288dfc
push 0x288e14
call 0x5330aeb
nop
push eax
call 0x53200f0
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x53202dd
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x237289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x5340000
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x237243
mov dword [esp + 0xc], eax
call fcn.00236ef0
push eax
call 0x53309fd
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x5340000
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x2371f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x5340000
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x5320514
nop
push dword [esp + 0x24]
call 0x5330bb9
nop
push 0x8000
push 0
push esi
call 0x5330f05
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0024cff1
mov esp, ebp
pop ebp
ret
Function at 0x23af20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x279726
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x292014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.00268b63
push eax
call fcn.00266660
add esp, 8
call fcn.0026663f
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.0026663f
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.0026663f
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.002345b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x23afd0
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x23afe6
push 0x40
push 0
push 0x298560
sub esi, ecx
call fcn.002640f0
add esp, 0xc
mov dword [0x298554], 0
mov edx, esi
mov dword [0x298550], 0
lea ecx, [ebp - 0x410]
mov dword [0x298540], 0x67452301
mov dword [0x298544], 0xefcdab89
mov dword [0x298548], 0x98badcfe
mov dword [0x29854c], 0x10325476
call fcn.00235530
call fcn.002355f0
mov ecx, 0x2965a0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x23b071
sub ecx, edx
push ecx
push 0x2965a0
lea ecx, [ebp - 0x42c]
call fcn.002480c0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x23b0cc
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x23b0c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x23b18c
push edx
push ecx
call fcn.0024d663
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0x23b187
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.002480c0
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x23b169
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x23b15f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x23b18c
push edx
push ecx
call fcn.0024d663
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0024cff1
mov esp, ebp
pop ebp
ret
call fcn.00248200
call fcn.00266c6a
int3
Function at 0x24dcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x5350d68
nop
test eax, eax
je 0x24dd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x24dd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x24dd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x24dd07
cmp dword [ecx + 0x74], 0xe
jbe 0x24dd07
cmp dword [ecx + 0xe8], 0
je 0x24dd07
mov al, 1
ret
xor al, al
ret