joyce8/EMBER2024-capa huggingface dataset:
Function at 0x594efa
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1007e2c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.005c4b48
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x10085698
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x100855e0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x1007f0c0]
push eax
mov ecx, edi
call fcn.005ca1b0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.005cb6cc
test eax, eax
je 0x595016
mov ecx, dword [esp + 0x3c]
call fcn.005ca1dd
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x1007f3c0]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x594fda
push edi
mov ecx, esi
call fcn.005c7833
mov ecx, esi
call fcn.005951ba
cmp dword [esp + 0x38], 1
jne 0x59500f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.005c796e
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x5971fa
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x59722d
push esi
call fcn.005a55ba
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x597226
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x5972b3
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x59729c
mov eax, dword [esi + 8]
test eax, eax
je 0x597251
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x597298
cmp eax, 2
je 0x59729c
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x597244
cmp eax, 3
je 0x597277
cmp eax, 1
jne 0x597244
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x597244
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x597244
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.005972da
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x5972c2
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.005972da
add esp, 4
pop esi
ret
Function at 0x8f8be5
Capabilities:
Execute anti-debugging instructions

Disassembly:
js 0x8e60cf
ljmp 0x9fa:0x9f0f8705
mov eax, dword [0xfd9a0497]
or al, 0xe5
and esi, dword [ecx + 0x16b34021]
and esi, dword [edx + 0x43b24720]
daa
mov bh, 0x27
inc edx
mov cl, 0xa
aas
test al, 0x3e
pop ecx
test al, 1
push ebx
lds edx, [ebp + 0x3c]
iretd
mov dword [esp], edi
mov byte [esp], dh
mov dword [esp], esp
call fcn.008f8bb5
mov ax, word [esp]
bsf ebx, eax
jmp 0x8f8c30
pushfd
cmp bl, ah
jnp 0x8f8c40
jp 0x8f8c40
push 0xf08ea490
jmp 0x8fbc55
mov bh, 0x63
lea edi, [esp]
lea edx, [eax + 0x9e]
mov edx, dword [esp]
jmp 0x8f8c1a
sub esp, 0xbc
jmp 0x8f8c90
rol ax, cl
jmp 0x8f8c73
sub esp, 0x19
cpuid
lea esp, [esp + 2]
jmp 0x8f8ca9
mov esi, esp
sub esp, 0x11
jo 0x8f8c6a
rol ax, cl
sub esp, 0x19
cpuid
lea esp, [esp + 2]
call fcn.008f8d35
inc eax
mov ecx, ebp
neg bx
jae 0x8f8d1a
jb 0x8f8d82
and eax, dword [edi + 0x8817217]
mov edx, 0x9eb70495
jmp 0x8e60ae
invalid
sar esi, cl
invalid
mov dx, 0x6124
not bx
bts ax, bp
not ax
xchg edx, eax
bswap edx
xor ax, bp
jmp 0x8f8d63
call fcn.008f8da5
add al, 0x8b
sbb edi, dword [esi - 0x73]
aas
stosb byte es:[edi], al
sub al, 0xa2
lds esi, [esi*8 - 0x2d046747]
dec ebp
not ax
xchg edx, eax
jmp 0x8f8d2a
jns 0x8f8d46
js 0x8f8d46
sub esp, 0xd
bswap eax
lea esp, [esp + 1]
jmp 0x8f93b0
mov dx, 0x6124
not bx
bts ax, bp
jmp 0x8f8d5c
mov dl, cl
stc
mov bx, 0xaffd
jmp 0x8f9270
not bl
lea edx, [edi*4]
rdtsc
bsr eax, edx
jmp 0x8f923e
mov dl, cl
stc
mov bx, 0xaffd
sub esp, 0x19
lea esp, [esp + 1]
rol ebp, 0
mov eax, dword [esp]
jmp 0x8f9211
jns 0x8f9254
lea eax, [edx + 0x1f]
jmp 0x8f9257
lea eax, [edx + 0x1f]
call fcn.008f930e
mov dh, 0x3a
test al, 0xcf
cmp bh, bh
xchg esp, eax
pop ds
invalid
sub esp, 0x19
lea esp, [esp + 1]
jmp 0x8f9236
lea esp, [esp + 0x10]
xor ebp, 0x2db0d3bb
rol eax, cl
jg 0x8f9228
jle 0x8f9208
mov ah, 0x21
bswap eax
cmp bl, 2
jl 0x8fbc70
xchg dl, bh
jmp 0x8fbcdf
jmp 0x8fbcdd
jae 0x8fbcc6
xchg cl, bl
jmp 0x8fbd6a
xchg cl, bl
jmp 0x8fbd6a
xchg dl, bh
mov ebp, dword [esp + 0x2c]
xchg dx, di
dec cx
jmp 0x8fbcb0
sub esp, 0xc0
jmp 0x8fbd27
jmp 0x8fbcea
call fcn.008fbd3d
xchg dx, ax
neg bh
jns 0x8fbe36
mov dh, 7
jmp 0x8fbe03
mov esi, esp
xchg dx, bx
mov ebx, esp
neg ax
je 0x8fbd05
jne 0x8fbd53
leave
pop edi
iretd
mov ecx, ebp
rdtsc
mov ax, 0xfaa8
jmp 0x8fbd0a
lea edi, [esp]
mov esi, dword [esp]
adc dh, 0x9d
jae 0x8fbd03
jb 0x8fbd03
add eax, edi
lea eax, [edx - 0x85c6]
mov edx, esi
bsr ax, cx
lea ecx, [ecx + 0x49]
xor bx, 0xde13
jmp 0x8fbdd5
mov ah, 0xeb
neg bh
mov al, byte [esp]
push dword [esp]
ret 4
ror ax, cl
rdtsc
mov bx, cx
xchg dword [esp], ecx
xchg ah, bl
mov ax, si
jmp 0x8fbdbb
add ah, ah
jmp 0x8fbe47
mov ebx, 0x38c0b992
sub esp, 0xe
mov ax, word [esp + 0xa]
jmp 0x8fbde7
mov dh, 7
mov ebx, 0x38c0b992
sub esp, 0xe
mov ax, word [esp + 0xa]
add ah, ah
xchg byte [esp + 2], bl
call int.008fbdeb
xchg ah, bh
jmp 0x8fbecb
mov ax, di
sete dl
call fcn.008fbe54
pop edx
fmul dword [esi + 0x29]
fcomp dword [esi]
mov ch, 0xa4
xlatb
invalid
invalid
Function at 0x8fefdb
Capabilities:
Check for software breakpoints

Disassembly:
jg 0x8feff6
xchg byte [esp + 1], bl
push word [esp]
jge 0x8fefc5
jl 0x8fefef
jo 0x8fefd9
add ax, si
xor dword [ebp + 0x7c], ebp
mov bl, 0x55
mov ebx, dword [esp + 5]
lea esp, [esp + 2]
and al, 2
jmp 0x8ff0a2

Function at 0x906e76
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x8ed43f
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x8ed459
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x8ed448
pop esi
jmp 0x8ed464
ret 4
jmp 0x8ed432

Function at 0x9072b2
Capabilities:
Encode data using xor

Disassembly:
jmp 0x90729c
jmp 0x8eaa3c
mov ebx, dword [esp + 0x25]
not eax
mov ax, 0x6078
mov ax, word [esp]
jmp 0x906490
jmp 0x906462
mov eax, dword [esp + 0x3c]
lea esp, [esp + 0x48]
jmp 0x8eaad6
call fcn.0091953e
or eax, 0x8b781989
dec eax
lodsd eax, dword [esi]
sub bh, byte [eax - 0x346ad521]
bound ebx, qword [ebp + 0x19ebffec]
jmp 0x9072cd
mov dword [0xce44d934], eax
cli
lcall 0x7338, 0x9eb24841
invalid

Function at 0xa91b3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebx
pop dx
jmp 0xa91c1d
mov dh, al
mov ebp, edx
mov cl, 0x13
lea esp, [esp]
bsr bp, dx
setne ah
jmp 0xa91b62
mov esi, esp
mov cl, al
lea eax, [ecx + 0xd99f]
lea esi, [esi + 0x1bf58548]
mov bl, bh
xchg cl, al
jmp 0xa91b78
shl edx, 0x10
mov edi, esp
mov ebp, dword [esp + 0x18]
add esp, 0x19
rdtsc
mov dl, byte [esp + 4]
jmp 0xa91bc2
Function at 0xa92607
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
sub edx, esi
mov ebx, eax
mov ebp, dword [esp + 1]
add esp, 0xe
sub esp, 0xd
jmp 0xa92613
setbe dl
bsr ebx, edi
mov bl, byte [esp + 8]
jmp 0xa925e8
not bx
btr edi, edi
lea ecx, [edi*4]
sbb di, sp
cld
push esi
jmp 0xa9264a

Function at 0xa928b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc esi, ebx
cpuid
mov edx, dword [esp]
push edi
mov dword [esp], eax
xchg byte [esp + 5], dh
jmp 0xa9283c
add esp, 0x12
bsf si, di
clc
mov word [esp], ax
lea ecx, [ebx*4]
cpuid
jmp 0xa9280f
rdtsc
pop word [esp]
xchg edi, ebx
xchg byte [esp + 2], ch
rdtsc
mov cl, byte [esp + 1]
jmp 0xa92886
mov cl, 0x5a
cpuid
mov bp, si
sub esp, 0x19
inc eax
popal
jmp 0xa92825
mov edi, edx
push word [esp + 2]
rcl bl, 4
mov word [esp + 3], di
jmp 0xa92920
mov dword [esp], esi
lea edx, [eax*4]
lea edx, [eax*4]
rdtsc
mov di, 0xfca3
xchg ebx, ebp
jmp 0xa92870
pop word [esp + 1]
sub esp, 0x11
push bp
push word [esp + 0xe]
bsr dx, cx
jmp 0xa92862
mov word [esp + 2], dx
xchg bh, al
bts cx, ax
add esp, 6
lea esp, [esp + 1]
popal
jmp 0xa92903
mov cx, word [esp + 1]
mov edi, dword [esp + 2]
xchg di, bp
mov word [esp + 3], si
xchg word [esp + 3], bp
lea edx, [edx*4]
jmp 0xa928c7
std
std
popfd
jmp 0xa92941
push dword [esp + 0x1c]
pop dword [esp + 0xe]
pop dword [esp + 9]
push dword [esp + 0x15]
jmp 0xa9297f
btr bx, sp
not edx
cpuid
inc cx
xchg byte [esp], bh
mov ah, 0xc1
jmp 0xa928e4
push 0x6cdb76c3
add dword [esp], 0x93b2be07
pushal
pop word [esp + 0x19]
jmp 0xa92908
pop word [esp + 3]
mov dword [esp + 0xb], eax
mov dword [esp + 0xc], esi
jmp 0xa92c31
mov word [esp + 0x14], cx
mov word [esp + 0xd], bp
mov dword [esp + 0x11], edx
mov dword [esp + 8], ecx
jmp 0xa92969
push word [esp + 0x11]
call 0xa92a43

Function at 0xa943a1
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Packed with generic packer
Parse pe header

Disassembly:
mov dword [esp], ebx
mov dword [esp + 0x64], esi
jmp 0xa943c9
pushfd
mov dword [esp], edx
mov dword [esp + 0x64], edi
lea esp, [esp + 0x64]
jmp 0xa94411
mov eax, dword [eax]
jmp 0xa9444f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xa943fb
mov eax, dword [eax + 8]
push eax
jmp 0xa9400d
Function at 0x828f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0xd3044], 0x8088405
inc edx
mov dword [0xd3044], edx
mul edx
mov eax, edx
ret

Function at 0x88708
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x93440
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x935d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0008364c
push 0x935e0
call fcn.00086ab0
mov esi, eax
test esi, esi
je 0x93482
push 0x935ec
push esi
call fcn.00086a48
mov edi, eax
test edi, edi
je 0x935a3
mov dword [ebp - 4], 0x400
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00083bdc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00083a6c
push eax
push 0
call edi
test eax, eax
jne 0x935a3
mov edx, dword [ebp - 4]
dec edx
lea eax, [ebp - 8]
call fcn.00083bdc
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.000836a0
mov eax, dword [ebx]
call fcn.000838a8
cmp eax, 0xf5
jle 0x935a3
mov edx, dword [ebx]
mov eax, 0x9360c
call fcn.00083b94
test eax, eax
je 0x934fe
mov eax, ebx
mov edx, 0x9361c
call fcn.000836a0
jmp 0x935a3
mov edx, dword [ebx]
mov eax, 0x9366c
call fcn.00083b94
test eax, eax
je 0x9351f
mov eax, ebx
mov edx, 0x93680
call fcn.000836a0
jmp 0x935a3
mov edx, dword [ebx]
mov eax, 0x936d0
call fcn.00083b94
test eax, eax
je 0x9353d
mov eax, ebx
mov edx, 0x936e4
call fcn.000836a0
jmp 0x935a3
mov edx, dword [ebx]
mov eax, 0x93734
call fcn.00083b94
test eax, eax
je 0x9355b
mov eax, ebx
mov edx, 0x93748
call fcn.000836a0
jmp 0x935a3
mov edx, dword [ebx]
mov eax, 0x937e0
call fcn.00083b94
test eax, eax
je 0x93579
mov eax, ebx
mov edx, 0x937f4
call fcn.000836a0
jmp 0x935a3
mov edx, dword [ebx]
mov eax, 0x93874
call fcn.00083b94
test eax, eax
je 0x93597
mov eax, ebx
mov edx, 0x93888
call fcn.000836a0
jmp 0x935a3
mov eax, ebx
mov edx, 0x9361c
call fcn.000836a0
mov eax, dword [ebx]
call fcn.000838a8
cmp eax, 0xa
jge 0x935bb
mov eax, ebx
mov edx, 0x9361c
call fcn.000836a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x935d8
lea eax, [ebp - 8]
call fcn.0008364c
ret
Function at 0x93b24
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x93b2c
push ebx
push esi
xor eax, eax
push ebp
push 0x93d31
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.000c07d0
call fcn.000c1670
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x93ccc
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x93ccc
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.00083bdc
lea eax, [ebp - 4]
call fcn.00083a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.00086ccc
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.000836e4
call fcn.000c1234
cmp eax, 1
jne 0x93bb4
lea eax, [ebp - 0x14]
call fcn.00093a90
mov eax, dword [ebp - 8]
call fcn.000838a8
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 1
lea ecx, [ebp - 0x20]
mov edx, 0x93d48
mov eax, 0x93d54
call fcn.000c136c
lea eax, [ebp - 0x20]
mov edx, dword [0xd2340]
mov edx, dword [edx]
call fcn.000838b0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000880e0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00083dd8
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x28]
mov edx, 0x93d64
mov eax, 0x93d70
call fcn.000c136c
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00083dd8
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 8]
call fcn.00083a78
mov ecx, eax
pop eax
pop edx
call fcn.000b3b0c
test eax, eax
jne 0x93ca2
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.000836e4
mov eax, dword [ebp - 8]
call fcn.000838a8
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
lea ecx, [ebp - 0x34]
mov edx, 0x93d48
mov eax, 0x93d54
call fcn.000c136c
lea eax, [ebp - 0x34]
mov edx, dword [0xd2340]
mov edx, dword [edx]
call fcn.000838b0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.000880e0
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.00083dd8
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 8]
call fcn.00083a78
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.000b3b0c
push 0x7530
push eax
call fcn.00086ba8
call fcn.000c1234
cmp eax, 1
jne 0x93ccc
lea eax, [ebp - 0x38]
call fcn.000939a0
mov edx, dword [ebp - 0x38]
mov eax, dword [0xd24c8]
call fcn.000836a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x93d38
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00083670
lea eax, [ebp - 0x2c]
call fcn.00083c58
lea eax, [ebp - 0x28]
call fcn.0008364c
lea eax, [ebp - 0x24]
call fcn.00083c58
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00083670
lea eax, [ebp - 0x18]
call fcn.00083c58
lea eax, [ebp - 0x14]
call fcn.0008364c
lea eax, [ebp - 0xc]
call fcn.00083c58
lea eax, [ebp - 8]
mov edx, 2
call fcn.00083670
ret
Function at 0x941a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x941ac
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x943e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0008364c
lea eax, [ebp - 0x10]
call fcn.000c07d0
call fcn.000c1670
mov ebx, eax
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x9437d
mov edi, ebx
mov esi, edi
add esi, dword [eax + 0x3c]
cmp dword [esi], 0x4550
jne 0x9437d
lea eax, [ebp - 0x1c]
call fcn.00094090
mov eax, dword [esi + 0x50]
add eax, edi
mov edx, eax
add edx, 4
mov edi, edx
mov ebx, eax
mov edx, dword [ebx]
lea eax, [ebp - 8]
call fcn.00083bdc
lea eax, [ebp - 8]
call fcn.00083a78
mov ecx, dword [ebx]
mov edx, edi
call fcn.00086ccc
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.000836e4
mov eax, dword [ebp - 0xc]
call fcn.000838a8
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push 1
lea ecx, [ebp - 0x28]
mov edx, 0x94400
mov eax, 0x9440c
call fcn.000c136c
lea eax, [ebp - 0x28]
mov edx, dword [0xd2340]
mov edx, dword [edx]
call fcn.000838b0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.000880e0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00083dd8
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x30]
mov edx, 0x9441c
mov eax, 0x94428
call fcn.000c136c
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.00083dd8
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
call fcn.00083a78
mov ecx, eax
pop eax
pop edx
call fcn.000b3b0c
mov ebx, eax
test ebx, ebx
jne 0x9432d
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.000836e4
mov eax, dword [ebp - 0xc]
call fcn.000838a8
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push 0
lea ecx, [ebp - 0x3c]
mov edx, 0x94400
mov eax, 0x9440c
call fcn.000c136c
lea eax, [ebp - 0x3c]
mov edx, dword [0xd2340]
mov edx, dword [edx]
call fcn.000838b0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.000880e0
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.00083dd8
mov eax, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0xc]
call fcn.00083a78
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
call fcn.000b3b0c
mov ebx, eax
push 0xea60
push ebx
call fcn.00086ba8
push 0
push ebx
call fcn.00086b78
lea eax, [ebp - 0x18]
call fcn.00093ec4
mov edx, dword [ebp - 0x18]
mov eax, 0x94440
call fcn.00083b94
dec eax
jne 0x9437d
mov eax, dword [ebp - 0x18]
call fcn.000838a8
cmp eax, 0x100
jge 0x9437d
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 0x18]
call fcn.00083ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x943ee
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00083670
lea eax, [ebp - 0x34]
call fcn.00083c58
lea eax, [ebp - 0x30]
call fcn.0008364c
lea eax, [ebp - 0x2c]
call fcn.00083c58
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00083670
lea eax, [ebp - 0x20]
call fcn.00083c58
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00083670
lea eax, [ebp - 0x10]
call fcn.00083c58
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00083670
ret
Function at 0xa82ac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0xa82b4
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0xa8444
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 3
call fcn.000a820c
call fcn.000c1670
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xa83ec
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0xa83ec
mov edi, dword [edx + 0x50]
add edi, ecx
add edi, 4
mov esi, dword [edx + 0x50]
add esi, eax
mov edx, dword [esi]
lea eax, [ebp - 4]
call fcn.00083bdc
lea eax, [ebp - 4]
call fcn.00083a78
mov ecx, dword [esi]
mov edx, edi
call fcn.00086ccc
lea ecx, [ebp - 0x1c]
mov edx, 0xa845c
mov eax, 0xa8468
call fcn.000c136c
lea eax, [ebp - 0x1c]
mov edx, dword [0xd2340]
mov edx, dword [edx]
call fcn.000838b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.000880e0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00083dd8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.000c02a8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00083894
mov eax, dword [esi]
push eax
mov eax, dword [0xd2498]
push eax
push 0
push 0
lea eax, [ebp - 4]
call fcn.00083a78
push eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.00083dd8
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
call fcn.000c07d0
mov eax, dword [ebp - 0x24]
pop edx
pop ecx
call fcn.000b3b0c
mov esi, eax
test esi, esi
je 0xa83e3
push 0x6ddd00
push esi
call fcn.00086ba8
mov eax, dword [0xd2498]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.000869f8
neg eax
sbb eax, eax
neg eax
cmp al, 1
jne 0xa83e3
cmp dword [ebp - 0xc], 0xa
je 0xa83fd
cmp dword [ebp - 0xc], 0x14
mov eax, dword [0xd2498]
xor edx, edx
mov dword [eax], edx
push 0x493e0
call fcn.00086b70
dec ebx
jne 0xa82d2
call fcn.000a74b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa844b
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00083c70
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00083670
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00083c70
lea eax, [ebp - 8]
mov edx, 2
call fcn.00083670
ret
Function at 0xa9a20
Capabilities:
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0xa9a29
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00083a5c
mov eax, dword [ebp - 8]
call fcn.00083a5c
mov eax, dword [ebp - 0xc]
call fcn.00083a5c
xor eax, eax
push ebp
push 0xa9b81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0008364c
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.000a929c
lea eax, [ebp - 0x24]
call fcn.000a93a4
push dword [ebp - 0x24]
push 0xa9b98
push dword [ebp - 0x14]
push 0xa9bc8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00083968
mov eax, 5
call fcn.000828f4
add eax, 4
lea edx, [ebp - 0x20]
call fcn.000bf68c
push dword [ebp - 0x10]
push 0xa9bf8
push dword [ebp - 0x14]
push 0xa9c04
push dword [ebp - 0x20]
push 0xa9c28
push dword [ebp - 4]
push 0xa9c38
lea eax, [ebp - 0x10]
mov edx, 8
call fcn.00083968
lea edx, [ebp - 0x1c]
mov eax, 4
call fcn.000a929c
lea eax, [ebp - 0x28]
call fcn.000a7a1c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.000a9464
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0xa9c44
push dword [ebp - 0x14]
push 0xa9c50
push dword [ebp - 0x18]
push 0xa9c60
push dword [ebp - 0x20]
push 0xa9c74
lea eax, [ebp - 0x10]
mov edx, 9
call fcn.00083968
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.000a994c
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000001
call fcn.000b7b48
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.000b7b48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa9b88
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00083670
ret
Function at 0xaf5a8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0xaf6bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.000c07d0
call fcn.000c1670
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xaf683
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0xaf683
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.00083bdc
lea eax, [ebp - 4]
call fcn.00083a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.00086ccc
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.000836e4
mov eax, dword [ebp - 8]
call fcn.000838a8
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
lea ecx, [ebp - 0x1c]
mov edx, 0xaf6d0
mov eax, 0xaf6dc
call fcn.000c136c
lea eax, [ebp - 0x1c]
mov edx, dword [0xd2340]
mov edx, dword [edx]
call fcn.000838b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.000880e0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00083dd8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 8]
call fcn.00083a78
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.000b3b0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xaf6c2
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00083670
lea eax, [ebp - 0x14]
call fcn.00083c58
lea eax, [ebp - 0xc]
call fcn.00083c58
lea eax, [ebp - 8]
mov edx, 2
call fcn.00083670
ret