joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50a0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x28]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp + 0x28], ebx
cmp byte [esi + 0x49], 4
mov eax, dword [esi]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
jne 0x50a10f
mov eax, dword [esi + 0x44]
jmp 0x50a295
push esi
push dword [esi + 0x3c]
push eax
call fcn.00505979
add esp, 0xc
test eax, eax
jne 0x50a295
xor edx, edx
push edi
mov edi, dword [ebp + 0x14]
cmp dword [esi + 0x10], edx
jne 0x50a16c
push edx
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004fd715
add esp, 0x10
test byte [esi + 0x48], 2
je 0x50a16c
xor edx, edx
cmp edi, edx
jl 0x50a16c
jg 0x50a152
cmp dword [ebp + 0x10], edx
jbe 0x50a16c
mov eax, dword [ebp + 0x10]
mov ecx, edi
sub eax, 1
sbb ecx, edx
cmp dword [esi + 0x18], eax
jne 0x50a16c
cmp dword [esi + 0x1c], ecx
jne 0x50a16c
or ebx, 0xffffffff
mov dword [ebp + 0x28], ebx
test ebx, ebx
jne 0x50a192
lea eax, [ebp + 0x28]
push eax
push dword [ebp + 0x24]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.004e9eeb
add esp, 0x18
test eax, eax
jne 0x50a294
mov ebx, dword [ebp + 0x28]
movsx eax, word [esi + 0x4c]
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
mov edi, dword [esi + eax*4 + 0x78]
push dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [eax + 0x50]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push eax
push edi
call fcn.004f0570
mov ecx, eax
add esp, 0x24
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x50a292
movsx ecx, word [esi + 0x4c]
movzx edx, word [esi + ecx*2 + 0x4e]
mov eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x50a29b
push dword [edi + 0x44]
call fcn.0051a7c3
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x50a292
mov eax, dword [edi + 0x40]
mov ebx, dword [ebp - 4]
movzx ecx, byte [eax + ebx*2]
movzx eax, byte [eax + ebx*2 + 1]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x14]
and ecx, eax
add ecx, dword [edi + 0x38]
cmp byte [edi + 5], 0
jne 0x50a223
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov dword [edx], eax
lea eax, [ebp + 0x28]
push eax
push ecx
push edi
call fcn.004eaf3c
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
movzx eax, word [ebp + 0x28]
push eax
push ebx
push edi
call fcn.004eeae7
mov ecx, dword [ebp + 8]
add esp, 0x1c
test ecx, ecx
jne 0x50a292
mov eax, ebx
xor ebx, ebx
lea ecx, [ebp + 8]
push ecx
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push eax
push edi
call fcn.004fd4d0
mov ecx, dword [ebp + 8]
xor eax, eax
add esp, 0x1c
mov word [esi + 0x2c], ax
test ecx, ecx
jne 0x50a292
cmp byte [edi + 1], al
je 0x50a292
and byte [esi + 0x48], 0xfd
push esi
call fcn.004e85b0
pop ecx
mov ecx, eax
movsx eax, word [esi + 0x4c]
mov eax, dword [esi + eax*4 + 0x78]
mov byte [eax + 1], bl
mov byte [esi + 0x49], bl
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jns 0x50a24d
xor ebx, ebx
cmp word [edi + 0x12], bx
jbe 0x50a24f
lea eax, [edx + 1]
mov word [esi + ecx*2 + 0x4e], ax
movzx eax, ax
jmp 0x50a24f
Function at 0x510bf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x510c0d
xor eax, eax
jmp 0x510cf3
push edi
push 0
push 8
push dword [ebp + 8]
call fcn.0050d210
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xc], edi
test edi, edi
je 0x510cf2
test byte [ebp + 0x10], 1
mov eax, dword [esi]
mov dword [edi], eax
jne 0x510c41
xor eax, eax
inc eax
cmp dword [esi], eax
jle 0x510c41
add eax, eax
cmp eax, dword [esi]
jl 0x510c3b
imul eax, eax, 0x18
push ebx
push 0
push eax
push dword [ebp + 8]
call fcn.0050d210
mov ebx, eax
add esp, 0xc
mov dword [edi + 4], ebx
test ebx, ebx
jne 0x510c6e
push edi
push dword [ebp + 8]
call fcn.0050d1c0
pop ecx
pop ecx
xor eax, eax
jmp 0x510cf1
and dword [ebp - 4], 0
cmp dword [esi], 0
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
jle 0x510cef
mov edi, dword [ebp - 8]
lea eax, [ebx + 0x10]
mov dword [ebp + 0xc], eax
sub ebx, edi
push 0
push dword [ebp + 0x10]
push dword [edi]
push dword [ebp + 8]
call fcn.004effb9
mov dword [ebx + edi], eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.0050d41f
mov ecx, dword [ebp + 0xc]
mov dword [ecx - 0xc], eax
push dword [edi + 8]
push dword [ebp + 8]
call fcn.0050d41f
mov ecx, dword [ebp + 0xc]
lea edi, [edi + 0x18]
add esp, 0x20
mov dword [ecx - 8], eax
mov al, byte [edi - 0xc]
and dword [ecx], 0xfffffffe
mov byte [ecx - 4], al
mov eax, dword [edi - 8]
xor eax, dword [ecx]
and eax, 2
xor dword [ecx], eax
mov eax, dword [edi - 4]
mov dword [ecx + 4], eax
add ecx, 0x18
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], eax
cmp eax, dword [esi]
jl 0x510c88
mov edi, dword [ebp - 0xc]
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Create process on windows
Terminate process

Disassembly:
push edi
mov edi, str.http:__mo_mofile.net_jk.htm_search_B3_D8_BD_BA_C6_AE_C0_CE_C7_FC_C0_C7_B1_E2_BB_E7Part2mp3
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x401030
push 1
push eax
push eax
push str.http:__mo_mofile.net_jk.htm_search_B3_D8_BD_BA_C6_AE_C0_CE_C7_FC_C0_C7_B1_E2_BB_E7Part2mp3
push str.OPEN
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
ret 0x10
Function at 0x148728f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x148dd044], 0x8088405
inc edx
mov dword [0x148dd044], edx
mul edx
mov eax, edx
ret

Function at 0x14878720
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x14880444
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x148805d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.1487364c
push 0x148805e4
call fcn.14876a60
mov esi, eax
test esi, esi
je 0x14880486
push 0x148805f0
push esi
call fcn.148769f8
mov edi, eax
test edi, edi
je 0x148805a7
mov dword [ebp - 4], 0x400
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.14873bdc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.14873a6c
push eax
push 0
call edi
test eax, eax
jne 0x148805a7
mov edx, dword [ebp - 4]
dec edx
lea eax, [ebp - 8]
call fcn.14873bdc
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.148736a0
mov eax, dword [ebx]
call fcn.148738a8
cmp eax, 0xf5
jle 0x148805a7
mov edx, dword [ebx]
mov eax, 0x14880610
call fcn.14873b94
test eax, eax
je 0x14880502
mov eax, ebx
mov edx, 0x14880620
call fcn.148736a0
jmp 0x148805a7
mov edx, dword [ebx]
mov eax, 0x14880670
call fcn.14873b94
test eax, eax
je 0x14880523
mov eax, ebx
mov edx, 0x14880684
call fcn.148736a0
jmp 0x148805a7
mov edx, dword [ebx]
mov eax, 0x148806d4
call fcn.14873b94
test eax, eax
je 0x14880541
mov eax, ebx
mov edx, 0x148806e8
call fcn.148736a0
jmp 0x148805a7
mov edx, dword [ebx]
mov eax, 0x14880738
call fcn.14873b94
test eax, eax
je 0x1488055f
mov eax, ebx
mov edx, 0x1488074c
call fcn.148736a0
jmp 0x148805a7
mov edx, dword [ebx]
mov eax, 0x148807e4
call fcn.14873b94
test eax, eax
je 0x1488057d
mov eax, ebx
mov edx, 0x148807f8
call fcn.148736a0
jmp 0x148805a7
mov edx, dword [ebx]
mov eax, 0x14880878
call fcn.14873b94
test eax, eax
je 0x1488059b
mov eax, ebx
mov edx, 0x1488088c
call fcn.148736a0
jmp 0x148805a7
mov eax, ebx
mov edx, 0x14880620
call fcn.148736a0
mov eax, dword [ebx]
call fcn.148738a8
cmp eax, 0xa
jge 0x148805bf
mov eax, ebx
mov edx, 0x14880620
call fcn.148736a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148805dc
lea eax, [ebp - 8]
call fcn.1487364c
ret
Function at 0x14880b28
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x14880b30
push ebx
push esi
xor eax, eax
push ebp
push 0x14880ce3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.148a5778
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x14880c8e
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x14880c8e
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.14873bdc
lea eax, [ebp - 4]
call fcn.14873a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.14876c64
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.148736e4
call fcn.148a656c
cmp eax, 1
jne 0x14880bb8
lea eax, [ebp - 0x14]
call fcn.14880a94
mov eax, dword [ebp - 8]
call fcn.148738a8
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x148dc7b8]
mov ecx, dword [ecx]
lea eax, [ebp - 0x20]
mov edx, 0x14880cf8
call fcn.148738f4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.14878098
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.14873dc8
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, eax
mov eax, 0x14880d04
pop edx
call fcn.148999b4
test eax, eax
jne 0x14880c64
mov eax, dword [ebp - 8]
call fcn.148738a8
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x148dc7b8]
mov ecx, dword [ecx]
lea eax, [ebp - 0x2c]
mov edx, 0x14880cf8
call fcn.148738f4
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.14878098
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.14873dc8
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.1489904c
push 0x7530
push eax
call fcn.14876b38
call fcn.148a656c
cmp eax, 1
jne 0x14880c8e
lea eax, [ebp - 0x30]
call fcn.148809a4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x148dc914]
call fcn.148736a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14880cea
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.14873670
lea eax, [ebp - 0x24]
call fcn.14873c58
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x18]
call fcn.14873c58
lea eax, [ebp - 0x14]
call fcn.1487364c
lea eax, [ebp - 0xc]
call fcn.14873c58
lea eax, [ebp - 8]
mov edx, 2
call fcn.14873670
ret
Function at 0x14881108
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x14881110
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x148812f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.1487364c
lea eax, [ebp - 0x10]
call fcn.148a5778
call fcn.148a69a8
mov ebx, eax
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x1488129f
mov edi, ebx
mov esi, edi
add esi, dword [eax + 0x3c]
cmp dword [esi], 0x4550
jne 0x1488129f
lea eax, [ebp - 0x1c]
call fcn.14880ff4
mov eax, dword [esi + 0x50]
add eax, edi
mov edx, eax
add edx, 4
mov edi, edx
mov ebx, eax
mov edx, dword [ebx]
lea eax, [ebp - 8]
call fcn.14873bdc
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, dword [ebx]
mov edx, edi
call fcn.14876c64
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.148736e4
mov eax, dword [ebp - 0xc]
call fcn.148738a8
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x148dc7b8]
mov ecx, dword [ecx]
lea eax, [ebp - 0x28]
mov edx, 0x14881310
call fcn.148738f4
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.14878098
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.14873dc8
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
call fcn.14873a78
mov ecx, eax
mov eax, 0x1488131c
pop edx
call fcn.148999b4
mov ebx, eax
test ebx, ebx
jne 0x1488124f
mov eax, dword [ebp - 0xc]
call fcn.148738a8
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x148dc7b8]
mov ecx, dword [ecx]
lea eax, [ebp - 0x34]
mov edx, 0x14881310
call fcn.148738f4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.14878098
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.14873dc8
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
call fcn.1489904c
mov ebx, eax
push 0xea60
push ebx
call fcn.14876b38
push 0
push ebx
call fcn.14876b08
lea eax, [ebp - 0x18]
call fcn.14880e28
mov edx, dword [ebp - 0x18]
mov eax, 0x14881340
call fcn.14873b94
dec eax
jne 0x1488129f
mov eax, dword [ebp - 0x18]
call fcn.148738a8
cmp eax, 0x100
jge 0x1488129f
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 0x18]
call fcn.14873ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14881300
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x2c]
call fcn.14873c58
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x20]
call fcn.14873c58
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x10]
call fcn.14873c58
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.14873670
ret
Function at 0x14894e1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x14894f2f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.148a5778
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x14894ef7
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x14894ef7
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.14873bdc
lea eax, [ebp - 4]
call fcn.14873a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.14876c64
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.148736e4
mov eax, dword [ebp - 8]
call fcn.148738a8
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x1c]
mov edx, 0x14894f44
mov eax, 0x14894f50
call fcn.148a66a4
lea eax, [ebp - 0x1c]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.14878098
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.14873dc8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.1489904c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14894f36
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x14]
call fcn.14873c58
lea eax, [ebp - 0xc]
call fcn.14873c58
lea eax, [ebp - 8]
mov edx, 2
call fcn.14873670
ret
Function at 0x148a4b98
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.1487410c
xor eax, eax
push ebp
push 0x148a4c6b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148a4c3e
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0x148a4c3e
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 0x10]
call fcn.14873bdc
lea eax, [ebp - 0x10]
call fcn.14873a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.14876c64
mov eax, dword [ebx]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x10]
call fcn.14873a78
push eax
lea eax, [ebp - 0x14]
call fcn.148a5778
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
pop ecx
call fcn.1489904c
mov ebx, eax
test ebx, ebx
je 0x148a4c45
mov dword [ebp - 0xc], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148a4c72
lea eax, [ebp - 0x14]
call fcn.14873c58
lea eax, [ebp - 0x10]
call fcn.1487364c
lea eax, [ebp - 4]
call fcn.14873c58
ret
Function at 0x148a4c7c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x148a4c84
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.1487410c
xor eax, eax
push ebp
push 0x148a4e6f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148a4e28
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0x148a4e28
mov esi, dword [edx + 0x50]
add esi, ecx
mov ebx, esi
add ebx, 4
mov edx, dword [esi]
lea eax, [ebp - 0x10]
call fcn.14873bdc
lea eax, [ebp - 0x10]
call fcn.14873a78
mov ecx, dword [esi]
mov edx, ebx
call fcn.14876c64
mov ecx, dword [0x148dc7b8]
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
mov edx, 0x148a4e88
call fcn.148738f4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.14878098
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.14873dc8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.14874078
test eax, eax
je 0x148a4dd6
call fcn.14897344
test al, al
je 0x148a4d52
call fcn.148a656c
cmp eax, 1
jne 0x148a4daa
mov eax, dword [esi]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
call fcn.14873a78
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, 0x148a4e90
call fcn.148999b4
mov ebx, eax
test ebx, ebx
jne 0x148a4e28
mov eax, dword [esi]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
call fcn.14873a78
push eax
lea eax, [ebp - 0x20]
call fcn.148a5778
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
pop ecx
call fcn.1489904c
mov ebx, eax
jmp 0x148a4e28
mov eax, dword [esi]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
call fcn.14873a78
push eax
lea eax, [ebp - 0x24]
call fcn.148a5778
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
pop ecx
call fcn.1489904c
mov ebx, eax
jmp 0x148a4e28
mov eax, dword [esi]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
call fcn.14873a78
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, 0x148a4e90
call fcn.148999b4
mov ebx, eax
test ebx, ebx
jne 0x148a4e28
mov eax, dword [esi]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
call fcn.14873a78
push eax
lea eax, [ebp - 0x28]
call fcn.148a5778
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 4]
pop ecx
call fcn.1489904c
mov ebx, eax
test ebx, ebx
je 0x148a4e2f
mov dword [ebp - 0xc], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148a4e76
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.14873c70
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x14]
call fcn.14873c58
lea eax, [ebp - 0x10]
call fcn.1487364c
lea eax, [ebp - 4]
call fcn.14873c58
ret
Function at 0x148a540c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x148a54e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.1487364c
test esi, esi
je 0x148a545e
mov eax, esi
and eax, 0xf
cdq
xor eax, edx
sub eax, edx
mov dl, byte [eax + 0x148dc40c]
lea eax, [ebp - 4]
call fcn.148737f4
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.148738f4
shr esi, 4
test esi, esi
jne 0x148a5433
cmp dword [ebx], 0
jne 0x148a5480
jmp 0x148a5473
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0x148a54fc
call fcn.148738f4
mov eax, dword [ebx]
call fcn.148738a8
cmp edi, eax
jg 0x148a5465
jmp 0x148a54d1
mov eax, dword [ebx]
call fcn.148738a8
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x2d
jne 0x148a54c6
mov eax, dword [ebx]
call fcn.148738a8
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.14873af0
mov edx, ebx
mov ecx, 1
mov eax, 0x148a5508
call fcn.14873b38
jmp 0x148a54c6
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0x148a54fc
call fcn.148738f4
mov eax, dword [ebx]
call fcn.148738a8
cmp edi, eax
jg 0x148a54b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148a54ee
lea eax, [ebp - 4]
call fcn.1487364c
ret
Function at 0x148ab440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x148ab578
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.148a5778
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.14873f00
je 0x148ab543
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148ab543
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x148ab543
mov esi, dword [edx + 0x50]
add esi, ecx
mov ebx, esi
add ebx, 4
mov edx, dword [esi]
lea eax, [ebp - 8]
call fcn.14873bdc
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, dword [esi]
mov edx, ebx
call fcn.14876c64
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.148736e4
mov eax, dword [0x148dc794]
push eax
call fcn.14876918
mov eax, dword [ebp - 0xc]
call fcn.148738a8
push eax
push 0
mov eax, dword [0x148dc8e8]
push eax
push 0
lea ecx, [ebp - 0x1c]
mov edx, 0x148ab590
mov eax, 0x148ab59c
call fcn.148a9880
lea eax, [ebp - 0x1c]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.14878098
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.14873dc8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
call fcn.1489904c
mov eax, dword [0x148dc794]
push eax
call fcn.14876a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148ab57f
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.14873c70
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.14873670
ret
Function at 0x148abd7c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x148abeb4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.148a5778
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.14873f00
je 0x148abe7f
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148abe7f
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x148abe7f
mov esi, dword [edx + 0x50]
add esi, ecx
mov ebx, esi
add ebx, 4
mov edx, dword [esi]
lea eax, [ebp - 8]
call fcn.14873bdc
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, dword [esi]
mov edx, ebx
call fcn.14876c64
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.148736e4
mov eax, dword [0x148dc794]
push eax
call fcn.14876918
mov eax, dword [ebp - 0xc]
call fcn.148738a8
push eax
push 0
mov eax, dword [0x148dc8e8]
push eax
push 0
lea ecx, [ebp - 0x1c]
mov edx, 0x148abecc
mov eax, 0x148abed8
call fcn.148a9880
lea eax, [ebp - 0x1c]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.14878098
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.14873dc8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
call fcn.1489904c
mov eax, dword [0x148dc794]
push eax
call fcn.14876a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148abebb
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.14873c70
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.14873670
ret