joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40319c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x15c]
mov esi, 0x405064
push ebx
sub esp, 0x17c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x11c], 0
mov eax, dword [0x407040]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov eax, 0x10
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x118]
mov eax, ecx
mov ecx, 0x3f
rep stosd dword es:[edi], eax
movzx edx, byte [ebp + eax - 0x15c]
mov byte [ebp + edx - 0x11c], al
inc eax
cmp eax, 0x40
jne 0x4031e2
xor edx, edx
test byte [ebp + 0xc], 3
jne 0x40337a
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
shr edx, 2
cmp byte [ebx + eax - 1], 0x3d
lea edx, [edx + edx*2]
jne 0x403217
dec edx
mov eax, dword [ebp + 0xc]
cmp byte [ebx + eax - 2], 0x3d
jne 0x403222
dec edx
lea eax, [edx + 0xf]
shr eax, 4
shl eax, 4
call fcn.00402bd4
mov ecx, 0
mov dword [ebp - 0x170], 0
sub esp, eax
test edx, edx
cmovns ecx, edx
mov edi, esp
xor eax, eax
mov dword [ebp - 0x174], esp
xor esi, esi
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp + 0xc]
jb 0x403270
mov esi, dword [ebp - 0x174]
mov edi, ebx
mov ecx, edx
rep movsb byte es:[edi], byte [esi]
jmp 0x40337a
mov eax, dword [ebp - 0x170]
xor edi, edi
movzx eax, byte [ebx + eax]
cmp al, 0x3d
je 0x403288
movzx edi, byte [ebp + eax - 0x11c]
mov dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x170]
movzx eax, byte [ebx + eax + 1]
cmp al, 0x3d
je 0x4032af
movzx eax, byte [ebp + eax - 0x11c]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x170]
movzx eax, byte [ebx + eax + 2]
cmp al, 0x3d
je 0x4032d6
movzx eax, byte [ebp + eax - 0x11c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x170]
xor ecx, ecx
add dword [ebp - 0x170], 4
movzx eax, byte [ebx + eax + 3]
cmp al, 0x3d
je 0x4032f8
movzx eax, byte [ebp + eax - 0x11c]
mov ecx, eax
mov dword [ebp - 0x16c], esi
cmp edx, esi
ja 0x40330d
mov esi, dword [ebp - 0x16c]
jmp 0x403254
mov eax, dword [ebp - 0x178]
shl edi, 0x12
inc dword [ebp - 0x16c]
shl eax, 0xc
add eax, edi
mov edi, dword [ebp - 0x17c]
shl edi, 6
add eax, edi
mov edi, dword [ebp - 0x174]
add eax, ecx
mov ecx, eax
shr eax, 0x10
mov byte [edi + esi], al
cmp edx, dword [ebp - 0x16c]
jbe 0x403302
lea eax, [esi + 2]
mov dword [ebp - 0x178], eax
mov eax, edi
mov edi, dword [ebp - 0x16c]
mov byte [eax + edi], ch
lea eax, [esi + 2]
mov dword [ebp - 0x16c], eax
cmp edx, eax
jbe 0x403302
lea eax, [esi + 3]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x174]
mov byte [eax + esi + 2], cl
jmp 0x403302
mov eax, dword [ebp - 0x1c]
sub eax, dword [0x407040]
je 0x40338a
call fcn.004019f0
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x419b00
Capabilities:
Check for software breakpoints

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x44a410
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x118
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x128]
push edi
xor edi, edi
or ebx, 0xffffffff
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
jle 0x44a47d
mov dword [esi + 0x38], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
lea ecx, [esp + 0x14]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
push ecx
mov ebp, eax
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push str.user32.dll
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
js 0x44a426
jle 0x44a51b
mov word [esi + 0x80], di
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0x118], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea edx, [esp + 0x10]
mov ebx, eax
push edx
push ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str.GetGestureInfo
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp ebp, edi
mov dword [esi + 0x11c], eax
je 0x44a55b
mov eax, dword [0x652d44]
push 0x652a78
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CloseGestureInfoHandle
push ebx
call edi
push str.SetGestureConfig
push ebx
mov dword [esi + 0x120], eax
call edi
mov cl, byte [esp + 0x1c]
mov dword [esi + 0x124], eax
mov byte [esi + 0x128], cl
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x5245ab
Capabilities:
Encode data using xor

Disassembly:
int1
xchg ebp, eax
push edx
rcl byte [ebp + ebp*2 + 0x7f1c8eb1]
in al, dx
or eax, 0x1ed163ac
adc al, 0x80
xlatb
ret
int1
xchg edi, eax
or bh, dl
add al, cl
jne 0x52452f
push eax
adc byte [eax], 0x5b
jo 0x524577
cmp byte [ecx - 0x6b], 0x31
inc esp
fidiv word [edx]
inc dh
clc
xor esi, dword [esi - 0x138e466]
and eax, dword [ebx]
lahf
cmc
xor ecx, dword [edi + 0x7c]
push ds
jne 0x524567
invalid
les esi, [ecx - 0x39]
xor byte [edi + 0x5374d39], al
aaa
add eax, 0x3279aa18
lahf
invalid
add esi, ecx
insd dword es:[edi], dx
aaa
add eax, 0x3279aa18
lahf
mov al, byte [0x8d6dce01]
aad 0xb4
cmc
mov byte [eax], cl
pop es
dec ebp
adc dh, byte [edx]
or eax, 0x30467861
jae 0x5245b0
xor bl, byte [edi + 0x6dce01a0]
invalid
pop esp
xchg byte [ebx + edi*2 - 0xb03acd0], bh
sub dword [ecx - 0x60ef04d8], 0xffde8c31
pop edi
mov ss, esi
push ebx
mov esp, 0xfc53307b
hlt
sub byte [ebp + 0x3e], 0x77
das
call 0xe7c38376
jae 0x524666
out 0x73, eax
jl 0x524637
dec esp
and edx, ebx
pop si
mov ah, 0x22
sub eax, 0x6d544225
insd dword es:[edi], dx
inc ebx
stosd dword es:[edi], eax
jae 0x52458f
in al, dx
mov bh, 0x14
mov dh, 0xe3
xchg ebx, eax
jnp 0x5245ca
push edx
jo 0x5245e7
rcl esp, cl
loop 0x524608
shr byte [ebp + 0x66], 0x4f
add edi, dword [edi]
je 0x5245a4
mov ebx, 0x75bc1884
popal
loope 0x5245f7
push ebp
in al, 0x84
add dh, byte [ecx - 0x6d5eb4fd]
jb 0x524657
xchg dl, dl
pop ecx
cwde
mov bl, 0x21
jae 0x524679
jmp 0x1d6edabd
out 0x1a, eax
inc ebp
notrack jmp 0x52462e
xchg byte [ebp - 0xe], ah
jo 0x5245de
sub al, 0x2a
push ss
add cl, byte [ebx - 0x783f70b0]
xor bl, dh
adc byte [ebp - 0x4d08eeeb], bh
inc esi
add ebx, dword [0xb6518270]
jmp 0x5246eb
invalid
cld
rcr esi, 1
test byte [eax + 0x30], bl
lahf
aad 0x70
sub eax, 0x70cd0c1
pop ecx
invalid
Function at 0x56e7ab
Capabilities:
Encode data using xor

Disassembly:
add byte [ecx + 0x5b6b75df], cl
cmp al, 3
cdq
cmp byte [esi + 0x7fd52fec], 0xd0
cmp edi, ebp
mov eax, dword [0xf6375100]
cmp ebp, dword [ebx]
lds eax, [ecx + edx*4 + 0x2d04c5a9]
jne 0x56e7cf
hlt
adc eax, 0xe52142a9
mov edi, 0x76f06c04
inc eax
push ecx
mov eax, 0xdef1c58e
cmp al, byte [edx + 0x54]
int1
fidivr word [edx]
inc edx
push esp
cdq
sbb eax, 0x5351d6e3
salc
push ecx
push ebx
sbb eax, esi
jns 0x56e810
insd dword es:[edi], dx
xchg esi, eax
lock and dword [ebx - 0x4fb30cb7], 0x69
mov dword [0xb04cf349], eax
invalid
add eax, 0xb603ff5d
jg 0x56e762
mov dword [0xb04cf349], eax
imul eax, dword [0xb603ff5d], 0xd3e7aa7f
out 0xd3, eax
jns 0x56e789
sub eax, 0x81b4679a
test al, 0x9f
or ch, ah
sar byte [si + 0x3db3], 1
jb 0x56e7ef
scasd eax, dword es:[edi]
push eax
sahf
mov al, byte [0xafc9b39d]
push ebx
loopne 0x56e7a0
lodsd eax, dword [esi]
xor dword [edx + 0x750603b9], esp
jp 0x56e798
btr esp, esi
test eax, 0x62dec389
mov esi, 0xf7ec31
lodsb al, byte [esi]
cli
cmp eax, 0x433fd458
sub al, 0x15
ret 0x1a1f
mov cl, 0x6e
xchg edi, eax
jae 0x56e88f
jae 0x56e7d5
int3
xor eax, 0x668aa4d
mov ecx, 0x18654793
outsb dx, byte [esi]
aas
push 0x4793b906
sbb byte gs:[esi + 0x3f], ch
das
and ebx, edx
shr bh, 1
or dword [edi + 0x5f], 0x5b5f0425
stc
dec ebx
dec eax
fsubp st(7)
xchg byte [edi + edi*2 + 0x6fcffab9], bh
push ebp
adc ebp, edi
dec ebx
jb 0x56e88c
salc
push 0xaf87c8a4
sub dword [edi], 0xffffffb3
into
push edx
jns 0x56e8b5
mov al, byte [0xaf5d7e56]
add esp, dword [esi + 0x3d40caa6]
push ebx
jp 0x56e908
pop edi
pop ecx
arpl word [ebp - 0x697189a2], bp
xchg edx, eax
mov ch, 0x4b
ficom dword [ecx]
cmpsd dword [esi], dword es:[edi]
lcall 0x9105, 0xcd7f72f0
mov word [ebp + 0x2196cae2], cs
int 0x60
xor eax, 0xf967612d
das
invalid
lea esi, [0xd92d3f40]
insd dword es:[edi], dx
mov eax, dword [ebx - 0x3f6a75bf]
jmp 0x9d7c490

Function at 0x5b817b
Capabilities:
Encode data using xor

Disassembly:
rol bh, cl
arpl word [esp + esi - 0x76fa8b9b], dx
fnstcw word [ebx + 0x4531f3b5]
adc dword [ecx - 0x16], ebx
xor dword [esi], ebx
jne 0x5b81c5
xor al, 0xa1
adc eax, 0x376f4ed6
mov eax, dword [0x6f4ed615]
aaa
sti
inc esi
loop 0x5b8190
adc byte [ecx + 0x7b], dl
inc ecx
mov dword [0xb3ccfad1], eax
repne insd dword es:[edi], dx
and dword [ebp - 0x1f], eax
dec ecx
fadd qword [ebp - 0x65597c37]
inc esp
rol byte [edi + 0x47e86397], cl
aaa
inc edi
ficomp word [ebp + 0x19]
aas
and eax, 0xd86ed56
push esp
xor eax, 0xdd0e6194
pop es
popal
push cs
fld qword [edi]
cwde
test ch, al
mov eax, dword [0x2753508e]
aad 7
mov ch, byte [eax]
clc
aaa
retf
Function at 0x5bbe47
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push edx
push eax
push 0
mov ebx, edx
xor edi, edi
mov ecx, dword [esp + edx*4 + 0x1c]
test ecx, ecx
je 0x5bbe69
cmp dword [eax], ecx
jne 0x5bbe69
mov edi, ecx
mov eax, dword [ecx - 4]
dec edx
jmp 0x5bbe6b
xor eax, eax
mov ecx, dword [esp + edx*4 + 0x1c]
test ecx, ecx
je 0x5bbe83
add eax, dword [ecx - 4]
test eax, 0xc0000000
jne 0x5bbef0
cmp edi, ecx
jne 0x5bbe83
xor edi, edi
dec edx
jne 0x5bbe6b
test edi, edi
je 0x5bbea8
mov edx, eax
mov eax, dword [esp + 4]
mov esi, dword [edi - 4]
call fcn.005bbce7
mov edi, dword [esp + 4]
mov eax, dword [edi]
mov dword [esp], eax
shl esi, 1
add esi, dword [edi]
dec ebx
jmp 0x5bbeb2
call fcn.005bad7b
mov dword [esp], eax
mov esi, eax
mov eax, dword [esp + ebx*4 + 0x1c]
mov edx, esi
test eax, eax
je 0x5bbec8
mov ecx, dword [eax - 4]
shl ecx, 1
add esi, ecx
call fcn.005b817b
dec ebx
jne 0x5bbeb2
mov edx, dword [esp]
mov eax, dword [esp + 4]
test edi, edi
jne 0x5bbee2
test edx, edx
je 0x5bbedd
dec dword [edx - 8]
call fcn.005bb207
add esp, 8
pop edx
pop edi
pop esi
pop ebx
pop eax
pop eax
lea esp, [esp + edx*4]
jmp eax
jmp fcn.005b8f07
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3726674d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3ae07ed0
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10002cef
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
add ebx, esi
push 0x40
lea eax, [ebx + 0x18]
push 0x3000
push dword [eax + 0x38]
mov dword [ebp - 4], ecx
push 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
call dword [0x84605c]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x10002e59
push 0x40
mov edx, esi
mov ecx, edi
call fcn.10003ba0
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.10003ba0
mov eax, dword [ebp - 8]
lea ebx, [esi + 0x18]
movzx ecx, word [eax + 0x14]
movzx esi, word [esi + 0x14]
lea edx, [eax + 0x18]
movzx eax, word [eax + 6]
add ecx, edx
add esi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x10002db7
mov ebx, ecx
sub ebx, esi
mov edi, eax
push 0x28
lea edx, [ebx + esi]
mov ecx, esi
call fcn.10003ba0
add esi, 0x28
dec edi
jne 0x10002d75
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x10002db7
lea esi, [ecx + 0x14]
mov ebx, eax
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call fcn.10003ba0
lea esi, [esi + 0x28]
dec ebx
jne 0x10002d9c
mov ebx, dword [ebp - 0xc]
push ebx
mov edx, edi
mov ecx, edi
call fcn.10004350
push dword [ebp - 0x18]
mov ecx, dword [0x847004]
mov edx, edi
call fcn.10004430
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10002e56
cmp dword [ebx + 0x64], 0
je 0x10002e56
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10002dfe
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100043f0
mov ecx, eax
xor eax, eax
jmp 0x10002e02
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 4]
push 2
mov dword [edx + 4], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10002e2b
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100043f0
mov ecx, eax
xor eax, eax
jmp 0x10002e2d
mov ecx, eax
mov edx, dword [ebp - 4]
push 3
mov dword [edx + 8], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10002e50
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100043f0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10002ea4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
push 0x40
add ebx, esi
push 0x3000
lea eax, [ebx + 0x18]
mov dword [ebp - 0x1c], ecx
push dword [eax + 0x38]
mov dword [ebp - 0x18], eax
push 0
call dword [0x84605c]
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x10002fad
push 0x40
mov edx, esi
mov ecx, edi
call fcn.10003ba0
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.10003ba0
movzx ecx, word [ebx + 0x14]
lea eax, [esi + 0x18]
movzx esi, word [esi + 0x14]
lea edx, [ebx + 0x18]
movzx ebx, word [ebx + 6]
add ecx, edx
add esi, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x10002f5c
mov edi, ecx
sub edi, esi
push 0x28
lea edx, [edi + esi]
mov ecx, esi
call fcn.10003ba0
add esi, 0x28
dec ebx
jne 0x10002f22
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
test ebx, ebx
je 0x10002f5c
lea esi, [ecx + 0x14]
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call fcn.10003ba0
lea esi, [esi + 0x28]
dec ebx
jne 0x10002f44
mov ebx, dword [ebp - 0x14]
push ebx
mov edx, edi
mov ecx, edi
call fcn.10004350
push dword [ebp - 0x18]
mov ecx, dword [0x847004]
mov edx, edi
call fcn.10004430
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10002faa
cmp dword [ebx + 0x64], 0
je 0x10002faa
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10002fa2
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100043f0
jmp 0x10002fa4
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10004250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [0x847000]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [0x84607c]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x10004294
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x10004283
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x100042af
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x100042a4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x100042f1
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x100042d4
test esi, esi
je 0x100042fd
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x100042f5
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x847000]
call dword [0x84607c]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call fcn.10001d1b
push ebx
push 0
push dword [0x847000]
call dword [0x846080]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8