joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe3a6f7
Capabilities:
Encrypt data using aes

Disassembly:
push esp
jmp 0xe3ae16
jmp 0xe3a7a9
lea esp, [esp + 0x24]
cmp eax, 1
jmp 0xe3a71b
push edx
mov dword [esp], ecx
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp + 1]
jmp 0xe3a750
push ebx
mov ebx, ebp
lea ebx, [ebx - 4]
jmp 0xe3a7fc
jle 0xdfd0c2
stc
lea ecx, [eax - 1]
bswap edx
mov edi, ecx
jmp 0xe3a72c
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
lea edx, [ebp - 0x27]
lea edi, [esp + ebx]
neg dh
add edi, ebp
jmp 0xe3a7e1
lea esp, [esp + 2]
jmp 0xe3a778
movzx ebx, byte [esi + 0x11]
sub esp, 2
clc
mov edi, dword [esp]
sete dh
jmp 0xe3a791
push eax
mov eax, esi
mov edx, dword [eax]
pop eax
jmp 0xe3a7c5
sub esp, 6
mov edi, 0x1127558e
lea esp, [esp + 2]
jmp 0xe3a824
add esi, 0x10
cmc
sub esp, 0xe
push edx
lea esp, [esp + 2]
jmp 0xe3a7b9
mov dword [ebx], ecx
pop ebx
pushal
lea esp, [esp + 0x20]
mov ecx, 0xff
jmp 0xdfd139
shr edi, 0x18
call fcn.00e3a856
loopne 0xe3a878
not byte [ecx - 0x62e17aa0]
or eax, 0x6c40a754
jg 0xe3a7b0
mov edi, edx
cli
stc
pushal
mov dword [esp + 0x13], eax
jmp 0xe3a80e
add byte [0xd38b52f9], al
jmp 0xe3a8e1
push word [esp + 7]
lea esp, [esp + 2]
jmp 0xe3a8b9
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0xe3a8cb
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
popfd
loopne 0xe3a863
loopne 0xe3a8c4
movzx ebx, byte [esi + 5]
push esp
jmp 0xe3a8a1
and edx, ecx
call fcn.00e3a924
cmc
je 0xe3a8bf
lea edi, [ecx + ebx*4 - 0x1b]
popal
int1
nop
arpl word [ebx - 0x72659ce0], ax
adc al, 0x95
add byte [eax], al
add byte [eax], al
lea edx, [edx*4]
lea edx, reloc.KERNEL32.dll_CreateFileA
mov ebx, dword [edx]
pop edx
call fcn.00e3a86b
clc
stc
stc
pushal
jmp 0xe3a9c1
bt edi, edx
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
btc edi, edi
bsf di, ax
sub esp, 0x12
jmp 0xe3a97a
mov edx, dword [esi + 4]
push esp
mov dword [esi], edi
clc
jmp 0xe3a957
pop di
pushal
mov al, byte [esp]
mov dword [esp], edx
sub esp, 0x18
jmp 0xe3a98c
lea esp, [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 0x14]
popal
jmp 0xe3aa08
lea esp, [esp + 0x44]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_CreateFileA]
jmp 0xe3a971
and edx, ecx
sub esp, 0x1e
mov byte [esp + 0x14], bh
lea esp, [esp + 2]
jmp 0xe3a9a5
shr edi, 0x18
push esp
call 0xe3a9e7
and edi, ecx
sub esp, 0xc
mov word [esp + 4], sp
mov edi, dword [edi*4 + reloc.KERNEL32.dll_CreateFileA]
call fcn.00e3af55
daa
movsb byte es:[edi], byte [esi]
cmp bl, byte [ebp - 0x54]
inc edx
push ebx
rol dword [ecx + 0x20], 1
sal dword [eax + edx*8], cl
push ebx
retf 0x7488
invalid
invalid
lea esp, [esp + 4]
pop edi
mov bl, 0x46
mov esi, dword [esp]
jmp 0xe3ae42
pop esi
pop ebx
call fcn.00e3aeb4
mov ch, 0x34
stosb byte es:[edi], al
int 0x3c
fldenv [ebp + 0x23d0b121]
ret
Function at 0xe3aa36
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push esp
jmp 0xe3ae16
jmp 0xe3a7a9
lea esp, [esp + 0x24]
cmp eax, 1
jmp 0xe3a71b
push edx
mov dword [esp], ecx
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp + 1]
jmp 0xe3a750
push ebx
mov ebx, ebp
lea ebx, [ebx - 4]
jmp 0xe3a7fc
jle 0xdfd0c2
stc
lea ecx, [eax - 1]
bswap edx
mov edi, ecx
jmp 0xe3a72c
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
lea edx, [ebp - 0x27]
lea edi, [esp + ebx]
neg dh
add edi, ebp
jmp 0xe3a7e1
lea esp, [esp + 2]
jmp 0xe3a778
movzx ebx, byte [esi + 0x11]
sub esp, 2
clc
mov edi, dword [esp]
sete dh
jmp 0xe3a791
push eax
mov eax, esi
mov edx, dword [eax]
pop eax
jmp 0xe3a7c5
sub esp, 6
mov edi, 0x1127558e
lea esp, [esp + 2]
jmp 0xe3a824
add esi, 0x10
cmc
sub esp, 0xe
push edx
lea esp, [esp + 2]
jmp 0xe3a7b9
mov dword [ebx], ecx
pop ebx
pushal
lea esp, [esp + 0x20]
mov ecx, 0xff
jmp 0xdfd139
shr edi, 0x18
call fcn.00e3a856
loopne 0xe3a878
not byte [ecx - 0x62e17aa0]
or eax, 0x6c40a754
jg 0xe3a7b0
mov edi, edx
cli
stc
pushal
mov dword [esp + 0x13], eax
jmp 0xe3a80e
add byte [0xd38b52f9], al
jmp 0xe3a8e1
push word [esp + 7]
lea esp, [esp + 2]
jmp 0xe3a8b9
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0xe3a8cb
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
popfd
loopne 0xe3a863
loopne 0xe3a8c4
movzx ebx, byte [esi + 5]
push esp
jmp 0xe3a8a1
and edx, ecx
call fcn.00e3a924
cmc
je 0xe3a8bf
lea edi, [ecx + ebx*4 - 0x1b]
popal
int1
nop
arpl word [ebx - 0x72659ce0], ax
adc al, 0x95
add byte [eax], al
add byte [eax], al
lea edx, [edx*4]
lea edx, reloc.KERNEL32.dll_CreateFileA
mov ebx, dword [edx]
pop edx
call fcn.00e3a86b
clc
stc
stc
pushal
jmp 0xe3a9c1
bt edi, edx
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
btc edi, edi
bsf di, ax
sub esp, 0x12
jmp 0xe3a97a
mov edx, dword [esi + 4]
push esp
mov dword [esi], edi
clc
jmp 0xe3a957
pop di
pushal
mov al, byte [esp]
mov dword [esp], edx
sub esp, 0x18
jmp 0xe3a98c
lea esp, [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 0x14]
popal
jmp 0xe3aa08
lea esp, [esp + 0x44]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_CreateFileA]
jmp 0xe3a971
and edx, ecx
sub esp, 0x1e
mov byte [esp + 0x14], bh
lea esp, [esp + 2]
jmp 0xe3a9a5
shr edi, 0x18
push esp
call 0xe3a9e7
and edi, ecx
sub esp, 0xc
mov word [esp + 4], sp
mov edi, dword [edi*4 + reloc.KERNEL32.dll_CreateFileA]
call fcn.00e3af55
daa
movsb byte es:[edi], byte [esi]
cmp bl, byte [ebp - 0x54]
inc edx
push ebx
rol dword [ecx + 0x20], 1
sal dword [eax + edx*8], cl
push ebx
retf 0x7488
invalid
invalid
lea esp, [esp + 4]
pop edi
mov bl, 0x46
mov esi, dword [esp]
jmp 0xe3ae42
pop esi
pop ebx
call fcn.00e3aeb4
mov ch, 0x34
stosb byte es:[edi], al
int 0x3c
fldenv [ebp + 0x23d0b121]
ret

Function at 0xe3aa82
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
pushal
and ebx, ecx
clc
call fcn.00e3aa3f
xlatb
push eax
invalid
add esp, 3
lea esp, [esp + 1]
jmp 0xe3aa62
Function at 0xe3ab7e
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xe3ac13
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
movzx ebx, byte [esi + 0xd]
sub esp, 6
push word [esp + 1]
jmp 0xe3abf6
pushal
lea esp, [esp + 0xf]
lea esp, [esp + 1]
jmp 0xe3abd4
lea esp, [esp + 1]
add esp, 1
lea esp, [esp + 2]
and ebx, ecx
jmp 0xe3ab83

Function at 0xe3abdd
Capabilities:
Encrypt data using aes

Disassembly:
bsf di, ax
jmp 0xe3ab4b
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
mov edi, edx
shr edi, 0x18
jmp 0xe3ae5e
movzx ebx, byte [esi + 0xa]
call fcn.00e3aba5
and edx, ecx
clc
call 0xe3abdd
xchg ecx, eax
add esp, 1
clc
lea esp, [esp + 3]
jmp 0xe3ac25
mov edx, dword [edx*4 + reloc.KERNEL32.dll_CreateFileA]
sub esp, 0x10
push esp
jmp 0xe3ad3d
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
jmp 0xe3abcb
and edx, ecx
sub esp, 0x1a
call fcn.00e3acfc
lea esp, [esp + 3]
push edx
mov byte [esp + 3], ch
lea esp, [esp + 1]
jmp 0xe3ad8d
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
cmc
stc
call fcn.00e3ad73
inc ecx
rcl byte [esi + 0x31], 0xc0
and eax, 0x215fccfd
retf 0x6052
mov edi, dword [edi*4 + reloc.KERNEL32.dll_CreateFileA]
and edi, ecx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_CreateFileA]
jmp 0xe3ac3d

Function at 0xe3acfc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
clc
push edx
lea esp, [esp + 1]
add esp, 1
lea esp, [esp + 2]
jmp 0xe3ac7d
mov ebx, esi
lea ebx, [ebx + 0xc]
mov edx, dword [ebx]
pop ebx
jmp 0xe3ac4f
mov dword [esi + 8], edi
lea edi, [edx + edi]
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
sub esp, 4
jmp 0xe3accb
lea esp, [esp + 0x4c]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_CreateFileA]
lea edx, reloc.KERNEL32.dll_CreateFileA
cmc
push ebx
jmp 0xe3ac73
push dword [esp + 0x1a]
mov edi, dword [edi*4 + reloc.KERNEL32.dll_CreateFileA]
jmp 0xe3acd7
mov edi, edx
shr edi, 0x18
pushal
push dword [esp + 2]
jmp 0xe3acaf
and edi, ecx
sub esp, 0xe
sub esp, 0x18
lea esp, [esp + 2]
jmp 0xe3ad1c
and bx, 0x8eea
sub bl, dh
inc bx
lea ebx, [eax - 0xf9]
jmp 0xe3ad06
push dword [esp + 0xe]
lea esp, [esp + 2]
jmp 0xe3ac9a
movzx ebx, byte [esi + 0xe]
stc
stc
stc
jmp 0xe3ae30
mov edi, dword [edi*4 + reloc.KERNEL32.dll_CreateFileA]
and ebx, ecx
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
jmp 0xe3ace5
push edx
add esp, 3
lea esp, [esp + 1]
and ebx, ecx
sub esp, 4
jmp 0xe3ad47
and edx, ecx
push edx
pushal
push dword [esp + 4]
mov edx, dword [edx*4 + reloc.KERNEL32.dll_CreateFileA]
jmp 0xe3ad64
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CreateFileA]
push esp
mov word [esp], bx
push esp
jmp 0xe3ada8

Function at 0xe3adc2
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esi + 0xc], edi
call 0xe3adc2
cmpsb byte [esi], byte es:[edi]
push dword [esp + 2]
pushal
jmp 0xe3ae06
lea esp, [esp + 2]
jmp 0xe3adb9
lea esp, [esp + 0x34]
jne 0xdfd139
je 0xdfd0c2
Function at 0xf7a92d
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0xf77018
movzx ebx, word [eax + 0x3c]
jmp 0xf7a8ec
sub eax, 0x10000
jmp 0xf7a931
add ebx, eax
cmp word [ebx], 0x4550
je 0xf76da7
push dword [ebp - 0x2c]
jne 0xf7a8cf
enter 0xffffffffffffdd4d, 0xffffffffffffffa4
push edi
mov al, byte [0x2b4cde5a]
out 0x18, al
test al, 0x33
mov dword [reloc.KERNEL32.dll_CreateFileA], eax
pop edx
fimul word [ebx + ebp - 0x1a]
sbb byte [eax + 0x35c6a333], ch
mov ah, 0xbe
xor al, 0xaa
int 0x3c
mov ebx, 0xd0b121a1
and eax, eax
loope 0xf7a97d
invalid
lea esp, [esp + 4]
cmp word [eax], 0x5a4d
je 0xf7807c
jne 0xf7a8cf
rcr dword [ebx - 0x35], cl
scasb al, byte es:[edi]
pop ebp
mov ecx, 0x3552bc3b
les esi, [ecx]
jns 0x78832169
scasd eax, dword es:[edi]
sub bh, byte [eax - 0x3c52d521]
dec edi
fistp qword [edx - 0x1f9d2fb7]
jbe 0xf7a971
loopne 0xf7a963
pushfd
sbb eax, 0xcb27d48d
out dx, al
outsb dx, byte [esi]
cld
wait
jbe 0xf7a901
cld
adc dword [ebx], 0x76
test dword [esi - 0x3e], esp
inc esp
fidivr dword [ebp - 0xe8b51b4]
popal
jbe 0xf7a8f8
ret 0xda44
add bl, dh
add al, 0x76
pushal
pop es
or al, 0x74
mul dword [edi + 2]
int1
js 0xf7a9ef
call 0x70dfc310
test dword [reloc.KERNEL32.dll_CreateFileA], eax
xor eax, 0xbe4324b6
push eax
and eax, 0xad5e3bab
dec esi
dec ebp
int3
cmp al, al
inc esi
aam 0xb3
dec esi
mov bl, 0x4e
lodsb al, byte [esi]
jb 0xf7a9f3
imul ecx, dword [esi], reloc.KERNEL32.dll_CreateFileA
push cs
pop eax
fdiv qword [edx + 0x15]
in al, 0x1a
scasb al, byte es:[edi]
sub dword [ecx - reloc.KERNEL32.dll_CreateFileA], edi
dec edx
fdivr dword [edi - 0x109432b6]
jg 0xf7aa2c
jmp 0x96f82d2d
jecxz 0xf7aa92
cli
popfd
insb byte es:[edi], dx
cdq
pop ss
xchg ecx, eax
add dword [eax - 0x6d], esp
outsd dx, dword [esi]
xchg edi, eax
adc al, byte [eax + 0x1b9512e7]
xchg edi, eax
pop es
bound edx, qword [ecx - 0x61f775e8]
stc
or cl, ch
and eax, 0x796ec754
jmp 0x64889be5
sbb byte [esi - 0x902e717], cl
jne 0xf7aa7f
invalid
Function at 0x4022d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c1c9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x47c028]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::_Lockit::constructor_int_]
mov dword [esp + 0x28], 0
mov eax, dword [0x47d340]
mov ecx, dword [sym.imp.MSVCP80.dll_class_std::locale::id_std::ctype_wchar_t_::id]
mov dword [esp + 0xc], eax
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::locale::id::operator_unsigned_int_void_]
mov ecx, dword [esp + 0x30]
push eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::locale::facet_const____thiscall_std::locale::_Getfacet_unsigned_int_const]
mov esi, eax
test esi, esi
jne 0x402384
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x402384
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCP80.dll_public:_static_unsigned_int___cdecl_std::ctype_wchar_t_::_Getcat_class_std::locale::facet_const___]
add esp, 4
cmp eax, 0xffffffff
jne 0x402368
push str.bad_cast
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCR80.dll_public:_void___thiscall_std::bad_cast::constructor_char_const__]
push 0x478604
lea edx, [esp + 0x18]
push edx
call sub.MSVCR80.dll__CxxThrowException
mov ecx, dword [esp + 0xc]
mov esi, ecx
mov dword [0x47d340], ecx
mov edi, ecx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::locale::facet::_Incref_void_]
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::locale::facet::_Register_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x409ea0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x409ed1
push esi
push edi
jmp 0x409eb0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x46e7f8]
lea edi, [eax*8]
xor esi, edi
sub ecx, 1
xor eax, esi
add edx, 1
test ecx, ecx
jg 0x409eb0
pop edi
pop esi
ret

Function at 0x409f40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x409f5d
mov esi, 0x80
cmp esi, dword [edi]
jne 0x409f6a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x47d66c]
test eax, eax
je 0x409f75
call eax
lea ecx, [esi*8]
push ecx
call fcn.00406980
mov ebp, eax
mov eax, dword [0x47d670]
add esp, 4
test eax, eax
mov dword [esp + 0x10], ebp
je 0x409f96
call eax
test ebp, ebp
je 0x409f61
mov edx, dword [edi + 0xc]
push edx
call fcn.00406c60
add esp, 4
push ebp
mov dword [edi + 0xc], ebp
call dword [0x47c140]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call sub.MSVCR80.dll_memset
mov ecx, dword [edi + 8]
add esp, 0xc
test ecx, ecx
mov dword [edi + 8], 0
je 0x40a085
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x40a017
nop
movzx ebx, byte [esi]
movzx ebx, byte [ebx + 0x46e7f8]
lea ebp, [eax*8]
xor ebx, ebp
sub edx, 1
xor eax, ebx
add esi, 1
test edx, edx
jg 0x409ff0
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
xor edx, edx
div ebx
lea eax, [ebp + edx*8]
test eax, eax
je 0x40a060
mov esi, dword [eax]
test esi, esi
je 0x40a034
mov edx, dword [eax + 4]
jmp 0x40a036
xor edx, edx
add esi, 1
test edx, edx
mov dword [eax], esi
mov dword [eax + 4], ecx
je 0x40a060
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x40a058
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x40a079
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x40a079
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x40a06f
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x409fe3
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x411130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [edi + 0x3c]
sub esp, 0xc
push ebx
push ebp
xor ebp, ebp
cmp dword [edx], ebp
push esi
mov esi, dword [esp + 0x1c]
jne 0x411167
mov eax, dword [edi + 0x78]
mov ecx, dword [edi]
or eax, 0x1e
push ebp
and eax, 0x87f7f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebp
push ecx
call eax
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x411252
mov ecx, dword [edi + 0x18]
cmp ecx, dword [edi + 0x24]
jbe 0x4111a3
mov eax, dword [edi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.0046ba40
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 5
push eax
mov eax, dword [ecx + 0x28]
call eax
mov ecx, dword [edi + 0x18]
add esp, 0xc
mov dword [edi + 0x24], ecx
test esi, esi
je 0x411250
mov ebx, dword [esi + 0x14]
cmp ebx, dword [edi + 0x18]
ja 0x411241
test byte [esi + 0x18], 0x20
jne 0x411241
mov eax, dword [edi + 0x80]
cdq
push edx
push eax
lea ecx, [ebx - 1]
push 0
push ecx
call fcn.0046ba40
cmp ebx, 1
mov dword [esp + 0x10], eax
mov ebp, edx
jne 0x4111e5
call fcn.004103d0
mov ecx, dword [edi + 0x80]
mov eax, dword [edi + 0x3c]
mov esi, dword [esi + 4]
mov edx, dword [eax]
push ebp
mov ebp, dword [esp + 0x14]
push ebp
push ecx
push esi
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
cmp ebx, 1
mov ebp, eax
jne 0x411226
mov ecx, dword [esi + 0x18]
lea eax, [esi + 0x18]
mov dword [edi + 0x64], ecx
mov edx, dword [eax + 4]
mov dword [edi + 0x68], edx
mov ecx, dword [eax + 8]
mov dword [edi + 0x6c], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0x70], edx
cmp ebx, dword [edi + 0x20]
jbe 0x41122e
mov dword [edi + 0x20], ebx
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 4]
push eax
mov eax, dword [edi + 0x58]
call fcn.00420530
add esp, 4
test ebp, ebp
mov esi, dword [esi + 0xc]
mov dword [esp + 0x1c], esi
je 0x4111a3
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x416de0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
cmp byte [esi], 0
push ebx
push ebp
push edi
jne 0x416fa4
mov al, byte [esi + 5]
mov ebp, dword [esi + 0x38]
mov ebx, dword [esi + 0x34]
mov byte [esp + 0xf], al
movzx eax, al
movzx ecx, byte [eax + ebp]
lea edi, [eax + ebp]
mov eax, esi
call fcn.00416d50
test eax, eax
je 0x416e36
push 0x4775ec
push 0xc64f
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.00408500
add esp, 0x10
mov eax, 0xb
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
mov cx, word [ebx + 0x20]
movzx edx, byte [esi + 3]
mov ax, 3
sub ax, dx
movzx edx, byte [esp + 0xf]
add ax, ax
add ax, ax
add ax, dx
sub cx, 1
mov word [esi + 0x12], cx
movzx eax, ax
mov byte [esi + 1], 0
mov ecx, dword [ebx + 0x24]
mov word [esi + 0xc], ax
mov dword [esp + 0x10], ecx
add ecx, ebp
mov dword [esi + 0x3c], ecx
movzx ecx, ax
xor edx, edx
lea eax, [ecx + ebp]
mov dword [esi + 0x40], eax
mov dh, byte [edi + 5]
xor eax, eax
mov ah, byte [edi + 3]
mov dl, byte [edi + 6]
sub edx, 1
and edx, 0xffff
add edx, 1
mov dword [esp + 0x18], edx
movzx edx, byte [edi + 4]
or ax, dx
mov word [esi + 0x10], ax
mov edx, dword [ebx + 0x20]
movzx eax, ax
mov dword [esp + 0x14], eax
sub edx, 8
mov eax, 0xaaaaaaab
mul edx
mov eax, dword [esp + 0x14]
shr edx, 2
cmp eax, edx
jbe 0x416ee7
push 0x4775ec
push 0xc65b
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.00408500
add esp, 0x10
mov eax, 0xb
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
lea ecx, [ecx + eax*2]
xor eax, eax
mov ah, byte [edi + 1]
mov dword [esp + 0x14], ecx
mov al, byte [edi + 2]
movzx edi, byte [edi + 7]
add edi, dword [esp + 0x18]
movzx eax, ax
test ax, ax
jbe 0x416f65
movzx eax, ax
cmp eax, ecx
jl 0x416f8b
mov edx, dword [esp + 0x10]
add edx, 0xfffffffc
cmp eax, edx
jg 0x416f8b
movzx dx, byte [eax + ebp + 1]
mov dh, byte [eax + ebp]
xor ebx, ebx
mov bh, byte [eax + ebp + 2]
movzx edx, dx
test dx, dx
mov bl, byte [eax + ebp + 3]
movzx ebx, bx
mov dword [esp + 0x18], ebx
jbe 0x416f50
movzx ecx, bx
movzx ebx, dx
lea ecx, [ecx + eax + 3]
cmp ebx, ecx
jle 0x416f7b
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
movzx ebx, bx
add eax, ebx
cmp eax, dword [esp + 0x10]
jg 0x416f7b
add edi, ebx
test dx, dx
movzx eax, dx
ja 0x416f06
cmp edi, dword [esp + 0x10]
jle 0x416f9b
mov eax, 0xc69b
pop edi
pop ebp
pop ebx
add esp, 0x10
jmp fcn.00463d40
mov eax, 0xc68d
pop edi
pop ebp
pop ebx
add esp, 0x10
jmp fcn.00463d40
mov eax, 0xc686
pop edi
pop ebp
pop ebx
add esp, 0x10
jmp fcn.00463d40
sub edi, ecx
mov word [esi + 0xe], di
mov byte [esi], 1
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x42d180
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
test ecx, ecx
push esi
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0x48]
mov esi, dword [eax + 0x34]
je 0x42d1a0
push esi
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edi
call fcn.00424630
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x42d1d7
movzx ecx, word [edi + 6]
xor eax, eax
test cx, cx
mov word [esi + 4], cx
jbe 0x42d1d3
mov ecx, dword [esi + 0x10]
add ecx, 0x1c
lea esp, [esp]
test byte [ecx], 1
jne 0x42d1f0
movzx edx, word [esi + 4]
add eax, 1
add ecx, 0x28
cmp eax, edx
jl 0x42d1c0
or byte [esi + 6], 2
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push esi
push eax
push ecx
call fcn.00424720
add esp, 0xc
mov dword [ebx], eax
pop edi
pop esi
pop ecx
ret
pop edi
mov dword [ebx], 0xffffffff
pop esi
pop ecx
ret
Function at 0x4375e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
test ebp, ebp
mov eax, ebp
jne 0x4375f7
xor ebx, ebx
jmp 0x437611
cmp byte [ebp], 0
je 0x437608
lea ecx, [ecx]
add eax, 1
cmp byte [eax], 0
jne 0x437600
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x14]
xor esi, esi
test eax, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jle 0x4376d4
jmp 0x437634
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x43763c
xor esi, 1
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x43765c
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov edx, esi
shl edx, 4
mov edx, dword [edx + eax]
call fcn.00408f60
test eax, eax
jne 0x4376bf
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x10]
shl esi, 4
mov ecx, dword [esi + edx + 0xc]
add ecx, 8
cmp dword [ecx + 0xc], 0
je 0x4376a9
xor eax, eax
test ebx, ebx
mov edi, ebx
mov edx, ebp
jle 0x4376a3
lea ecx, [ecx]
movzx esi, byte [edx]
movzx esi, byte [esi + 0x46e7f8]
lea ebp, [eax*8]
xor esi, ebp
sub edi, 1
xor eax, esi
add edx, 1
test edi, edi
jg 0x437680
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x4376ab
xor edx, edx
push ebp
call fcn.0040a0a0
add esp, 4
test eax, eax
je 0x4376de
mov edi, dword [eax + 8]
test edi, edi
jne 0x4376d4
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x437630
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x4376bf

Function at 0x437780
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
test edi, edi
mov eax, edi
jne 0x437796
xor ebx, ebx
jmp 0x4377b1
cmp byte [edi], 0
je 0x4377a8
jmp 0x4377a0
add eax, 1
cmp byte [eax], 0
jne 0x4377a0
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 0x14]
xor eax, eax
test edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
jle 0x437872
mov ecx, dword [ecx + 0x10]
push esi
mov dword [esp + 0x14], ecx
jmp 0x4377d4
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x4377dc
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x4377fc
mov edx, dword [eax]
call fcn.00408f60
test eax, eax
jne 0x43784f
cmp dword [esi + 0x24], 0
lea ecx, [esi + 0x18]
je 0x437839
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x437833
nop
movzx edi, byte [edx]
movzx edi, byte [edi + 0x46e7f8]
lea ebp, [eax*8]
xor edi, ebp
sub esi, 1
xor eax, edi
add edx, 1
test esi, esi
jg 0x437810
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x43783b
xor edx, edx
push edi
call fcn.0040a0a0
add esp, 4
test eax, eax
je 0x43786e
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x437864
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x4377d0
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x43784f
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret