joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, ecx
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x43f6f9
lea eax, [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x43f70d
cmp eax, 2
je 0x43f783
jmp 0x43f7b3
push 0xbbf966b4
push dword [0x450640]
call fcn.00444150
add esp, 8
test eax, eax
je 0x43f74e
mov ecx, dword [esi]
test ecx, ecx
je 0x43f77b
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43f757
cmp dword [esp + 4], 0
je 0x43f757
mov dword [esi + 4], 3
jmp 0x43f77b
mov dword [esi + 4], 1
jmp 0x43f7b3
lea eax, [esp + 0x14]
push eax
call fcn.00444990
add esp, 4
test al, al
je 0x43f77b
mov eax, dword [esp + 0x14]
mov ecx, 2
cmp eax, 3
je 0x43f778
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43f7b3
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
push 0x732f71fd
push dword [0x458668]
call fcn.00444150
add esp, 8
push dword [esp]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43f899
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0xdcdddedf
mov dword [esp + 8], 0
xor eax, eax
mov edx, 0x31588af
mov dword [esp + 0xc], edx
movzx edx, byte [esp + eax + 4]
mov esi, dword [esp + 0xc]
and esi, 0x314880d
mov edi, eax
and edi, 2
mov ecx, edx
and ecx, 0x5d
or ecx, 0x90454822
and edx, 0xffffffa2
lea ebx, [edi + esi]
add ebx, 0x28480100
xor ebx, edx
xor ebx, ecx
mov ecx, ebx
xor ecx, 0xb767e2ef
mov esi, ebx
and esi, 0x100090
xor esi, 0xf7aab7f
and esi, ecx
mov edi, esi
and edi, 0xfd
and ecx, 2
or esi, 2
imul esi, ecx
xor ecx, 2
imul ecx, edi
xor ebx, 0x10
add ebx, esi
mov edx, dword [esp + 0xc]
add ebx, ecx
inc bl
mov byte [esp + eax + 4], bl
inc eax
dec edx
cmp eax, 8
jne 0x43f7d0
mov eax, dword [esp + 4]
mov ecx, dword [0x45064c]
test ecx, ecx
je 0x43f899
xor edx, edx
mov esi, dword [0x450650]
cmp dword [esi + edx*8], 0xfd743ac4
je 0x43f870
inc edx
cmp ecx, edx
jne 0x43f860
jmp 0x43f899
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43f899
push dword [esp]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x20]
push 5
push dword [0x450654]
push ecx
call fcn.00441b40
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441a70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44e7a4]

Function at 0x442530
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [esp + 0x4c]
movzx eax, word [eax]
mov dword [esp], eax
mov dword [esp + 4], 0x111ef5e3
mov ecx, 0xb689c6f7
mov edx, 0x6d138dee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x4976390d]
mov esi, edx
and esi, 0x4803098a
mov edi, ecx
xor edi, 0xec47a4c5
mov eax, 0xf6
sub eax, esi
sub eax, edi
add esi, edi
add esi, 0x49763909
mov edi, eax
and edi, 0x85
mov ebp, esi
and ebp, 0x7a
or ebp, edi
xor ebp, 0x7a
and ebp, eax
or esi, ebx
not ebx
or ebx, ebp
and ebx, esi
mov esi, ebx
and esi, 0x24
mov eax, ebx
and eax, 2
mov edi, eax
xor edi, 2
imul edi, esi
or esi, 2
imul esi, eax
xor ebx, 0x26
add ebx, edi
add ebx, esi
inc bl
mov byte [esp + ecx + 0x4976390d], bl
inc ecx
add edx, 2
cmp ecx, 0xb689c6fb
jne 0x442560
xor ecx, ecx
mov eax, dword [esp]
cmp dword [esp + 4], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44ec20]
Function at 0x442c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x442c82
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x442dee
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x442dee
mov dword [esp], 0x14151a1b
mov dword [esp + 4], 0
mov eax, 0x1675bf86
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x1675bf86]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
xor edx, 0x1e
mov edi, ecx
or edi, 0x61
and edi, edx
xor ecx, 0x61
lea ecx, [ecx + edi*2]
inc cl
mov byte [esp + eax - 0x1675bf86], cl
inc eax
cmp eax, 0x1675bf8e
jne 0x442ca0
mov eax, dword [esp]
mov ecx, dword [0x45064c]
test ecx, ecx
je 0x442d2a
xor edx, edx
mov edi, dword [0x450650]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x442d00
inc edx
cmp ecx, edx
jne 0x442cf0
jmp 0x442d2a
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x442d2a
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x450654]
push ecx
call fcn.00441b40
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x442dee
push 0x732f71fd
push dword [0x458668]
call fcn.00444150
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x14151a1b
mov dword [esp + 4], 0
mov edx, 0x1675bf86
nop
movzx esi, byte [esp + edx - 0x1675bf86]
mov edi, edx
and edi, esi
add edi, edi
sub esi, edi
add esi, edx
mov edi, esi
xor edi, 0x1e
mov ebx, esi
or ebx, 0x61
and ebx, edi
xor esi, 0x61
lea ebx, [esi + ebx*2]
inc bl
mov byte [esp + edx - 0x1675bf86], bl
inc edx
cmp edx, 0x1675bf8e
jne 0x442d70
mov edx, dword [0x45064c]
test edx, edx
je 0x442dee
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x450650]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x442dd0
inc edi
cmp edx, edi
jne 0x442dc0
jmp 0x442dee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x442dee
push ecx
push 1
push dword [0x450654]
push edx
mov esi, eax
call fcn.00441b40
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 8], 0x131211c0
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x44
xor cl, byte [esp + eax + 8]
add cl, 0xac
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jne case.default.0x443c77
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x30], 0
sete cl
jmp dword [ecx*4 + 0x44f06c]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [0x44f098]
mov ebx, dword [0x44f0b8]
mov dword [esp], 0
mov eax, dword [0x44f0c4]
mov dword [esp + 0x18], eax
mov edx, dword [edi]
xor eax, eax
cmp edx, edi
setne al
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
jmp dword [eax*4 + 0x44f084]
mov dword [esp + 4], edx
mov edx, dword [edx + 0x30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp esi
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [case.0x443c77.4]
nop
nop
nop
nop
jmp eax
mov eax, dword [esp]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x444070
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x23222170
xor eax, eax
mov edx, 0x2d1e5d47
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov edi, edx
and edi, 0x24144146
mov ebx, eax
and ebx, 1
add ebx, edi
add ebx, 0x10a08008
xor ebx, esi
mov esi, ebx
not esi
xor ebx, 0xf6
add ebx, 0x67
and esi, 1
or ebx, 1
add ebx, esi
mov byte [esp + eax], bl
inc eax
dec edx
cmp eax, 4
jne case.default.0x4440d7
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44f16c]

Function at 0x444150
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x44]
movzx eax, word [eax]
mov dword [esp], 0x33326b65
mov ecx, 0x22a034b4
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x22a034b4]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x7c
mov byte [esp + ecx - 0x22a034b4], dl
inc ecx
cmp ecx, 0x22a034b8
jne 0x444170
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44f18c]
Function at 0x444b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x444bb0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x444bcb
mov eax, 0xffffffff
jmp 0x444bce
add eax, 0xa
push eax
call fcn.0040c8d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x444c11
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x444c00
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xfcfdfafb
xor ecx, ecx
nop
nop
mov esi, ecx
and esi, 2
xor esi, 0x56
mov edx, ecx
and edx, 1
sub edx, esi
xor dl, byte [esp + ecx]
add dl, 0xae
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x444c80
mov esi, dword [esp]
mov ecx, dword [0x45064c]
test ecx, ecx
je 0x444d04
xor edx, edx
mov ebx, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x444cd0
inc edx
cmp ecx, edx
jne 0x444cc0
jmp 0x444d04
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x444d04
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x450654]
push ecx
mov edi, eax
call fcn.00441b40
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c8e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x444d40
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x444d5b
mov eax, 0xffffffff
jmp 0x444d5e
add eax, 0xa
push eax
call fcn.0040c8d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x444da1
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x444d90
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp], dx
add ecx, edi
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xfcfdfafb
xor ecx, ecx
nop
nop
nop
nop
mov esi, ecx
and esi, 2
xor esi, 0x56
mov edx, ecx
and edx, 1
sub edx, esi
xor dl, byte [esp + ecx + 0x20]
add dl, 0xae
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 4
jne 0x444e10
mov esi, dword [esp + 0x20]
mov ecx, dword [0x45064c]
test ecx, ecx
je 0x444e89
xor edx, edx
mov edi, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x444e60
inc edx
cmp ecx, edx
jne 0x444e50
jmp 0x444e89
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x444e89
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push dword [0x450654]
push ecx
mov edi, eax
call fcn.00441b40
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.0040c8e0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x444e9f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x444eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xfcfdfafb
xor eax, eax
nop
nop
nop
nop
nop
mov edx, eax
and edx, 2
xor edx, 0x56
mov ecx, eax
and ecx, 1
sub ecx, edx
xor cl, byte [esp + eax]
add cl, 0xae
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x444ed0
mov eax, dword [esp]
mov edx, dword [0x45064c]
test edx, edx
je 0x444f48
xor ebx, ebx
mov ecx, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x444f20
inc ebx
cmp edx, ebx
jne 0x444f10
jmp 0x444f48
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x444f48
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push dword [0x450654]
push edx
call fcn.00441b40
add esp, 0x20
test edi, edi
je 0x444f52
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x444f5e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xfcfdfafb
xor eax, eax
nop
nop
nop
mov edi, eax
and edi, 2
xor edi, 0x56
mov ebx, eax
and ebx, 1
sub ebx, edi
xor bl, byte [esp + eax + 4]
add bl, 0xae
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 4
jne 0x444f90
mov eax, dword [esp + 4]
mov ebx, dword [0x45064c]
test ebx, ebx
je 0x44500e
xor ebp, ebp
mov edi, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x444fe0
inc ebp
cmp ebx, ebp
jne 0x444fd0
jmp 0x44500e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x44500e
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 9
push dword [0x450654]
push ebx
call fcn.00441b40
add esp, 0x30
cmp eax, 0x103
jne 0x4450a9
mov dword [esp], 0xfcfdfafb
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 2
xor edx, 0x56
mov ecx, eax
and ecx, 1
sub ecx, edx
xor cl, byte [esp + eax]
add cl, 0xae
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x445030
mov eax, dword [esp]
mov ecx, dword [0x45064c]
test ecx, ecx
je 0x4450a1
xor edx, edx
mov edi, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x445080
inc edx
cmp ecx, edx
jne 0x445070
jmp 0x4450a1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x4450a1
push 0
push 0
push dword [esp + 0x28]
push 3
push dword [0x450654]
push ecx
call fcn.00441b40
add esp, 0x18
test eax, eax
js 0x4450a9
mov eax, dword [esp + 4]
test esi, esi
je 0x4450bc
xor ecx, ecx
cmp eax, 0xc0000011
je 0x4450ba
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445220
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x445240
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 4], bx
add ebx, 2
mov word [esp + 6], bx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xfcfdfafb
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 2
xor edi, 0x56
mov ebx, eax
and ebx, 1
sub ebx, edi
xor bl, byte [esp + eax]
add bl, 0xae
mov byte [esp + eax], bl
inc eax
cmp eax, 4
jne 0x4452a0
mov eax, dword [esp]
mov edi, dword [0x45064c]
test edi, edi
je 0x445312
xor ebx, ebx
mov ebp, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x4452f1
inc ebx
cmp edi, ebx
jne 0x4452e0
jmp 0x445312
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x445312
lea eax, [esp + 0xc]
push esi
push eax
push edx
push ecx
push 4
push dword [0x450654]
push edi
call fcn.00441b40
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100013d0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, ecx
nop
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x100042dc
call esi
push 0x100042e8
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
nop
push 0x100042f0
call esi
push 0x100042f8
mov dword [edi + 8], eax
call esi
mov dword [edi + 0xc], eax
nop
push 0x10004300
call esi
mov dword [edi + 0x10], eax
xor eax, eax
cmp dword [edi + eax*4], 0
je 0x10001539
inc eax
cmp eax, 5
jl 0x10001410
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 0x10004308
push dword [edi + 4]
call esi
mov dword [edi + 0x14], eax
nop
push 0x10004318
push dword [edi + 4]
lea ebx, [edi + 0x18]
call esi
push 0x1000432c
push dword [edi + 4]
mov dword [ebx], eax
call esi
push 0x10004340
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call esi
mov dword [edi + 0x20], eax
nop
push 0x10004354
push dword [edi + 0xc]
call esi
mov dword [edi + 0x24], eax
nop
push 0x10004364
push dword [edi + 0x10]
call esi
push 0x1000437c
push dword [edi]
mov dword [edi + 0x28], eax
call esi
push 0x1000438c
push dword [edi]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
nop
push 0x1000439c
push dword [edi]
call esi
push 0x100043ac
push dword [edi]
mov dword [edi + 0x34], eax
call esi
mov dword [edi + 0x38], eax
nop
push 0x100043bc
push dword [edi + 0x10]
call esi
mov dword [edi + 0x3c], eax
nop
push 0x100043d0
push dword [edi + 8]
call esi
mov dword [edi + 0x40], eax
lea edx, [edi + 0x49]
mov esi, 2
nop
mov ecx, dword [ebx - 4]
lea ebx, [ebx + 0x18]
lea edx, [edx + 0x1e]
mov eax, dword [ecx]
mov dword [edx - 0x23], eax
movzx eax, byte [ecx + 4]
mov byte [edx - 0x1f], al
mov ecx, dword [ebx - 0x18]
mov eax, dword [ecx]
mov dword [edx - 0x1e], eax
movzx eax, byte [ecx + 4]
mov byte [edx - 0x1a], al
mov ecx, dword [ebx - 0x14]
mov eax, dword [ecx]
mov dword [edx - 0x19], eax
movzx eax, byte [ecx + 4]
mov byte [edx - 0x15], al
mov ecx, dword [ebx - 0x10]
mov eax, dword [ecx]
mov dword [edx - 0x14], eax
movzx eax, byte [ecx + 4]
mov byte [edx - 0x10], al
mov ecx, dword [ebx - 0xc]
mov eax, dword [ecx]
mov dword [edx - 0xf], eax
movzx eax, byte [ecx + 4]
mov byte [edx - 0xb], al
mov ecx, dword [ebx - 8]
mov eax, dword [ecx]
mov dword [edx - 0xa], eax
movzx eax, byte [ecx + 4]
mov byte [edx - 6], al
dec esi
jne 0x100014d0
pop ebx
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x10001540
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
push esi
push edi
movzx esi, bl
mov edi, ecx
lea eax, [edi + esi*4]
cmp byte [esi + eax + 0x44], 0xe9
jne 0x100015c5
nop
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push dword [edi + esi*4 + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
cmp bl, 5
je 0x1000158c
cmp bl, 0xa
je 0x1000158c
mov ecx, dword [edi + esi*4 + 0x14]
mov eax, dword [0x10005024]
mov dword [ecx], eax
mov al, byte [0x10005028]
mov byte [ecx + 4], al
nop
jmp 0x100015a8
push dword [edi + esi*4 + 0x14]
mov ecx, edi
call fcn.10001640
movzx ecx, byte [edi + esi*4 + 0x14]
mov byte [ecx], 0xe9
nop
movzx ecx, byte [edi + esi*4 + 0x14]
mov dword [ecx + 1], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push dword [edi + esi*4 + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x100015d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
mov dword [ebp - 4], ecx
lea eax, [ecx + edi*4]
cmp byte [edi + eax + 0x44], 0xe9
lea ebx, [edi + eax]
jne 0x10001630
nop
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push dword [ecx + edi*4 + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x44]
mov ecx, dword [edx + edi*4 + 0x14]
mov dword [ecx], eax
mov al, byte [ebx + 0x48]
mov byte [ecx + 4], al
nop
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push dword [edx + edi*4 + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4