joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e270
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1003e0c4
cmp word [eax + 8], 0
jbe 0x1003e0c4
mov byte [ecx], 0x5d
inc dword [eax + 4]
dec word [eax + 8]
ret
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
movzx eax, byte [edi + 6]
mov ecx, dword [eax*4 + 0x100964f8]
mov al, byte [ecx]
inc ecx
test al, al
je 0x1003e2ae
lea esp, [esp]
mov edx, dword [esi + 4]
test edx, edx
je 0x1003e2a3
cmp word [esi + 8], 0
jbe 0x1003e2a3
mov byte [edx], al
inc dword [esi + 4]
dec word [esi + 8]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003e290
movzx eax, byte [edi + 6]
cmp eax, 0x12
ja case.0x1003e2c2.3
movzx ecx, byte [eax + 0x1003e444]
jmp dword [ecx*4 + 0x1003e418]
mov edx, dword [edi + 8]
jmp 0x1003e3f0
mov eax, dword [edi + 0xc]
push eax
jmp 0x1003e3f1
mov eax, dword [edi + 0x18]
xor ecx, ecx
mov cx, word [edi + 0x14]
push ecx
call fcn.1003e210
add esp, 4
pop edi
pop esi
ret
movzx edx, word [edi + 0xa]
mov eax, dword [esi]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx]
test edx, edx
je case.0x1003e2c2.3
mov eax, dword [esi + 4]
test eax, eax
je 0x1003e316
cmp word [esi + 8], 0
jbe 0x1003e316
mov byte [eax], 0x28
inc dword [esi + 4]
dec word [esi + 8]
mov eax, esi
call fcn.1003e170
mov eax, dword [esi + 4]
test eax, eax
je 0x1003e335
cmp word [esi + 8], 0
jbe 0x1003e335
mov byte [eax], 0x2c
inc dword [esi + 4]
dec word [esi + 8]
mov cx, word [edi + 0xc]
mov dx, word [edi + 0xa]
mov eax, esi
call fcn.1003e1a0
mov eax, dword [esi + 4]
test eax, eax
je 0x1003e40e
cmp word [esi + 8], 0
jbe 0x1003e40e
mov byte [eax], 0x29
mov eax, dword [esi + 4]
inc eax
dec word [esi + 8]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov edx, dword [edi + 0xc]
push edx
push esi
call fcn.1003e270
mov eax, esi
call fcn.1003e090
mov eax, dword [edi + 0x10]
push eax
push esi
call fcn.1003e270
add esp, 0x10
pop edi
mov eax, esi
pop esi
jmp 0x1003e0b0
mov ecx, dword [edi + 0xc]
push ecx
push esi
call fcn.1003e270
add esp, 8
pop edi
mov eax, esi
pop esi
jmp 0x1003e0b0
mov edx, dword [edi + 0x14]
push edx
push esi
call fcn.1003e270
add esp, 8
pop edi
mov eax, esi
pop esi
jmp 0x1003e0b0
xor eax, eax
mov ax, word [edi + 8]
push eax
mov eax, dword [edi + 0x10]
call fcn.1003e210
add esp, 4
pop edi
pop esi
ret
mov ecx, dword [edi + 0x10]
push ecx
push esi
call fcn.1003e270
add esp, 8
pop edi
mov eax, esi
pop esi
jmp 0x1003e0b0
mov edx, dword [edi + 0x10]
push edx
push esi
call fcn.1003e270
mov eax, dword [esi + 4]
add esp, 8
test eax, eax
je 0x1003e40e
cmp word [esi + 8], 0
jbe 0x1003e40e
mov byte [eax], 0x5d
inc dword [esi + 4]
dec word [esi + 8]
pop edi
pop esi
ret
Function at 0x1003f9d0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1003fb08
movzx ecx, byte [esi + 6]
push ebx
push ebp
push edi
xor eax, eax
xor ebx, ebx
xor ebp, ebp
xor edi, edi
cmp ecx, 0x12
ja case.0x1003f9fc.1
movzx ecx, byte [ecx + 0x1003fb38]
jmp dword [ecx*4 + 0x1003fb0c]
mov ebx, dword [esi + 0xc]
mov ebp, dword [esi + 0x10]
mov edi, 0x1c
jmp 0x1003fae2
mov edx, dword [esi + 0x34]
push edx
call fcn.10045620
mov eax, dword [esi + 0x28]
push eax
call fcn.10045620
mov eax, dword [esi + 0x2c]
mov edi, 0x38
jmp case.0x1003f9fc.1
mov ecx, dword [esi + 0x28]
push ecx
call fcn.10045620
mov edx, dword [esi + 0x30]
push edx
call fcn.10045620
mov eax, dword [esi + 0x34]
push eax
call fcn.10045620
mov eax, dword [esi + 0x2c]
mov edi, 0x38
jmp case.0x1003f9fc.1
mov ecx, dword [esi + 0x18]
push ecx
call fcn.10045620
mov edx, dword [esi + 0x1c]
push edx
call fcn.10045620
mov eax, dword [esi + 0x20]
push eax
call fcn.10045620
mov ecx, dword [esi + 0x24]
push ecx
call fcn.10045620
mov edx, dword [esi + 0x28]
push edx
call fcn.10045620
mov eax, dword [esi + 0x2c]
push eax
call fcn.10045620
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 8]
mov edi, 0x38
jmp case.0x1003f9fc.1
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
mov edi, 0x14
jmp case.0x1003f9fc.1
mov eax, dword [esi + 0x10]
mov edi, 0x14
jmp case.0x1003f9fc.1
mov ecx, dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
push ecx
call fcn.10045620
mov edx, dword [esi + 0x1c]
push edx
call fcn.10045620
mov edi, 0x20
jmp 0x1003fae2
mov ebx, dword [esi + 0xc]
mov edi, 0x10
jmp case.0x1003f9fc.1
mov ebx, dword [esi + 0x14]
mov edi, 0x24
mov eax, dword [esi + 0x18]
push eax
call fcn.10045620
push ebx
call fcn.1003f9d0
push ebp
call fcn.1003f9d0
test di, di
pop edi
pop ebp
pop ebx
je 0x1003fb08
push esi
call fcn.1005ad00
add esp, 4
pop esi
ret 4

Function at 0x10040110
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
movzx eax, byte [esi + 6]
cmp eax, 0x12
ja case.default.0x10040137
push ebx
mov ebx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
lea esp, [esp]
movzx eax, byte [eax + 0x100401d4]
jmp dword [eax*4 + 0x100401b8]
mov ecx, dword [esi + 0xc]
push ebx
push ecx
push edi
call fcn.10040110
mov esi, dword [esi + 0x10]
add esp, 0xc
jmp 0x10040189
mov edx, dword [esi + 0xc]
push ebx
push edx
push edi
call fcn.10040110
mov esi, dword [esi + 0x10]
add esp, 0xc
jmp 0x10040189
mov eax, dword [esi + 0x28]
call fcn.100400f0
mov esi, dword [esi + 8]
jmp 0x10040189
mov eax, dword [esi + 0x14]
call fcn.100400f0
mov eax, dword [esi + 0x18]
call fcn.100400f0
mov esi, dword [esi + 0x10]
jmp 0x10040189
mov esi, dword [esi + 0xc]
movzx eax, byte [esi + 6]
cmp eax, 0x12
jbe 0x10040130
pop edi
pop ebx
pop esi
ret
mov ecx, dword [edi + 0x30]
movzx eax, word [esi + 4]
add eax, dword [ecx + 0x14]
test bl, bl
push eax
je 0x100401ae
call sym.ulrttpd9.dll__ULTableUseSupplyNulls_4
pop edi
pop ebx
pop esi
ret
call sym.ulrttpd9.dll__ULTableUseSupplyNonNulls_4
pop edi
pop ebx
pop esi
ret
Function at 0x10041220
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov ebx, eax
push ebp
lea eax, [esp + 0x1c]
push eax
call fcn.100410c0
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], esi
test edi, edi
jne 0x1004124e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10041298
mov al, byte [esp + 0x24]
test al, 4
je 0x1004125e
and al, 0xfb
mov byte [esp + 0x24], al
jmp 0x10041298
lea edi, [esp + 0x18]
call fcn.10040dc0
test byte [esp + 0x24], 1
mov edi, dword [esp + 0x1c]
jne 0x10041298
test edi, edi
je 0x10041414
lea ebx, [ebx]
test byte [esp + 0x24], 2
je 0x10041298
lea edi, [esp + 0x18]
call fcn.10040dc0
test eax, eax
mov edi, dword [esp + 0x1c]
jne 0x10041280
test edi, edi
je 0x10041414
movzx eax, byte [edi + 6]
cmp eax, 0x12
ja case.0x100412b0.1
movzx ecx, byte [eax + 0x10041448]
jmp dword [ecx*4 + 0x10041420]
mov eax, dword [edi + 0x18]
push ebp
call fcn.100411f0
add esp, 4
add esi, eax
jmp 0x1004123e
mov eax, dword [edi + 0x14]
push ebp
call fcn.100411f0
push ebp
add esi, eax
mov eax, dword [edi + 0x18]
call fcn.100411f0
add esp, 8
add esi, eax
jmp 0x1004123e
mov edx, dword [edi + 0x10]
push ebx
push edx
push ebp
call fcn.10041150
add esp, 0xc
add esi, eax
jmp 0x1004123e
mov eax, dword [edi + 0x18]
push ebx
push eax
push ebp
call fcn.10041150
add esp, 0xc
add esi, eax
jmp 0x1004123e
mov ecx, dword [edi + 0x18]
push ebx
push ecx
push ebp
call fcn.10041150
add esp, 0xc
add esi, eax
jmp 0x1004123e
mov edx, dword [edi + 0x34]
push ebx
push edx
push ebp
call fcn.10041150
add esp, 0xc
add esi, eax
mov eax, dword [edi + 0x30]
push ebx
push eax
push ebp
call fcn.10041150
mov ecx, dword [edi + 0x34]
push ebx
push ecx
push ebp
add esi, eax
call fcn.10041150
add esp, 0x18
add esi, eax
jmp 0x1004123e
mov esi, dword [edi + 0x28]
test esi, esi
mov dword [esp + 0x14], 0
je 0x10041387
mov edx, dword [esi + 8]
push ebx
push edx
push ebp
call fcn.10041150
mov ecx, dword [esp + 0x20]
mov esi, dword [esi + 0xc]
add esp, 0xc
add ecx, eax
test esi, esi
mov dword [esp + 0x14], ecx
jne 0x10041368
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [edi + 0x24]
add ecx, eax
test esi, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
je 0x100413c3
mov ecx, dword [esi + 8]
push ebx
push ecx
push ebp
call fcn.10041150
mov ecx, dword [esp + 0x20]
mov esi, dword [esi + 0xc]
add esp, 0xc
add ecx, eax
test esi, esi
mov dword [esp + 0x14], ecx
jne 0x100413a4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add eax, edx
mov dword [esp + 0x10], eax
mov esi, dword [edi + 0x14]
test esi, esi
mov dword [esp + 0x14], 0
je 0x100413ff
mov eax, dword [esi + 8]
push ebx
push eax
push ebp
call fcn.10041150
mov ecx, dword [esp + 0x20]
mov esi, dword [esi + 0xc]
add esp, 0xc
add ecx, eax
test esi, esi
mov dword [esp + 0x14], ecx
jne 0x100413e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x10], eax
mov esi, eax
jmp case.0x100412b0.1
pop edi
mov ax, si
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10041359
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov ebx, eax
push ebp
lea eax, [esp + 0x1c]
push eax
call fcn.100410c0
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], esi
test edi, edi
jne 0x1004124e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10041298
mov al, byte [esp + 0x24]
test al, 4
je 0x1004125e
and al, 0xfb
mov byte [esp + 0x24], al
jmp 0x10041298
lea edi, [esp + 0x18]
call fcn.10040dc0
test byte [esp + 0x24], 1
mov edi, dword [esp + 0x1c]
jne 0x10041298
test edi, edi
je 0x10041414
lea ebx, [ebx]
test byte [esp + 0x24], 2
je 0x10041298
lea edi, [esp + 0x18]
call fcn.10040dc0
test eax, eax
mov edi, dword [esp + 0x1c]
jne 0x10041280
test edi, edi
je 0x10041414
movzx eax, byte [edi + 6]
cmp eax, 0x12
ja case.0x100412b0.1
movzx ecx, byte [eax + 0x10041448]
jmp dword [ecx*4 + 0x10041420]
mov eax, dword [edi + 0x18]
push ebp
call fcn.100411f0
add esp, 4
add esi, eax
jmp 0x1004123e
mov eax, dword [edi + 0x14]
push ebp
call fcn.100411f0
push ebp
add esi, eax
mov eax, dword [edi + 0x18]
call fcn.100411f0
add esp, 8
add esi, eax
jmp 0x1004123e
mov edx, dword [edi + 0x10]
push ebx
push edx
push ebp
call fcn.10041150
add esp, 0xc
add esi, eax
jmp 0x1004123e
mov eax, dword [edi + 0x18]
push ebx
push eax
push ebp
call fcn.10041150
add esp, 0xc
add esi, eax
jmp 0x1004123e
mov ecx, dword [edi + 0x18]
push ebx
push ecx
push ebp
call fcn.10041150
add esp, 0xc
add esi, eax
jmp 0x1004123e
mov edx, dword [edi + 0x34]
push ebx
push edx
push ebp
call fcn.10041150
add esp, 0xc
add esi, eax
mov eax, dword [edi + 0x30]
push ebx
push eax
push ebp
call fcn.10041150
mov ecx, dword [edi + 0x34]
push ebx
push ecx
push ebp
add esi, eax
call fcn.10041150
add esp, 0x18
add esi, eax
jmp 0x1004123e
mov esi, dword [edi + 0x28]
test esi, esi
mov dword [esp + 0x14], 0
je 0x10041387
mov edx, dword [esi + 8]
push ebx
push edx
push ebp
call fcn.10041150
mov ecx, dword [esp + 0x20]
mov esi, dword [esi + 0xc]
add esp, 0xc
add ecx, eax
test esi, esi
mov dword [esp + 0x14], ecx
jne 0x10041368
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [edi + 0x24]
add ecx, eax
test esi, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
je 0x100413c3
mov ecx, dword [esi + 8]
push ebx
push ecx
push ebp
call fcn.10041150
mov ecx, dword [esp + 0x20]
mov esi, dword [esi + 0xc]
add esp, 0xc
add ecx, eax
test esi, esi
mov dword [esp + 0x14], ecx
jne 0x100413a4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add eax, edx
mov dword [esp + 0x10], eax
mov esi, dword [edi + 0x14]
test esi, esi
mov dword [esp + 0x14], 0
je 0x100413ff
mov eax, dword [esi + 8]
push ebx
push eax
push ebp
call fcn.10041150
mov ecx, dword [esp + 0x20]
mov esi, dword [esi + 0xc]
add esp, 0xc
add ecx, eax
test esi, esi
mov dword [esp + 0x14], ecx
jne 0x100413e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x10], eax
mov esi, eax
jmp case.0x100412b0.1
pop edi
mov ax, si
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x100448f0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
mov cl, byte [eax]
cmp cl, 0xc
je 0x10044900
cmp cl, 0x15
jne 0x10044905
mov eax, dword [eax + 8]
jmp 0x100448f4
movzx ecx, byte [eax]
add ecx, 0xfffffffe
cmp ecx, 0x13
ja case.0x10044917.3
movzx ecx, byte [ecx + 0x10044944]
jmp dword [ecx*4 + 0x10044938]
test byte [eax + 2], 8
jne case.0x10044917.3
mov dword [esp + 8], eax
jmp fcn.10045ad0
mov dword [esp + 8], eax
jmp fcn.10044870

Function at 0x1004fa30
Capabilities:
Enumerate pe sections

Disassembly:
mov al, byte [0x1009cbe8]
test al, al
jne 0x1004fa6c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
call fcn.100294d0
mov eax, dword [esp + 0x18]
mov ax, word [eax + 6]
mov ecx, dword [esp + 0x10]
movzx edx, ax
mov word [ecx + 0x48], ax
mov eax, dword [0x1009cbf0]
add esp, 0xc
inc edx
mov dword [eax + 0x70], edx
xor al, al
ret 0x14

Function at 0x1004fa80
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [eax]
mov al, byte [0x1009cbe8]
test al, al
jne 0x1004fabf
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call fcn.100294d0
mov ecx, dword [esp + 0x1c]
mov ax, word [ecx + 6]
movzx edx, ax
mov word [esi + 0x48], ax
mov eax, dword [0x1009cbf0]
add esp, 0xc
inc edx
mov dword [eax + 0x70], edx
xor al, al
pop esi
ret 0x14

Function at 0x1004fbc0
Capabilities:
Enumerate pe sections

Disassembly:
mov al, byte [0x1009cbe8]
test al, al
jne 0x1004fc04
movzx eax, word [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call fcn.100296b0
mov ecx, dword [esp + 0x1c]
mov ax, word [ecx + 6]
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
movzx edx, ax
mov word [ecx + 0x48], ax
mov eax, dword [0x1009cbf0]
add esp, 0x10
inc edx
mov dword [eax + 0x70], edx
xor al, al
ret 0x18
Function at 0x10054a20
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0x10]
movzx ecx, byte [esi + 6]
add ecx, 0xfffffffe
xor al, al
cmp ecx, 0x10
ja case.default.0x10054a41
movzx ecx, byte [ecx + 0x10054b40]
push ebx
push ebp
push edi
jmp dword [ecx*4 + 0x10054b28]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov edx, dword [esi + 0xc]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edi
push ebx
push edx
push ebp
push eax
call fcn.10054a20
add esp, 0x14
test al, al
je 0x10054a8b
mov ecx, dword [esi + 0x10]
mov edx, dword [esp + 0x14]
push edi
push ebx
push ecx
push ebp
push edx
call fcn.10054a20
add esp, 0x14
test al, al
je 0x10054a8b
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
ret
pop edi
pop ebp
pop ebx
xor al, al
pop esi
ret
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov eax, dword [esi + 0xc]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edi
push ebx
push eax
push ebp
push ecx
call fcn.10054a20
add esp, 0x14
test al, al
je 0x10054a8b
mov edx, dword [esi + 0x10]
mov eax, dword [esp + 0x14]
push edi
push ebx
push edx
push ebp
push eax
jmp 0x10054a78
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
call fcn.10054a20
add esp, 0x14
pop edi
pop ebp
pop ebx
pop esi
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push eax
push ecx
push esi
mov esi, dword [esp + 0x20]
push edx
call fcn.10053f50
add esp, 0x10
pop edi
pop ebp
pop ebx
pop esi
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.10054080
add esp, 8
pop edi
pop ebp
pop ebx
pop esi
ret
int3
Function at 0x10057eb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [edx]
test ebx, ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
je 0x10057fb5
mov esi, ebx
push esi
mov edi, esi
call fcn.10044850
mov esi, eax
cmp byte [esi], 8
jne 0x10057ee4
mov esi, dword [esi + 8]
cmp edi, esi
jne 0x10057ed2
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x18]
mov ebp, dword [ecx + 0x18]
test ebp, ebp
mov dword [esp + 0x10], 0
je 0x10057f9d
mov eax, ebp
push eax
mov edi, eax
call fcn.10044850
cmp byte [eax], 8
jne 0x10057f14
mov eax, dword [eax + 8]
cmp edi, eax
jne 0x10057f04
mov edx, dword [esp + 0x14]
push eax
push esi
push edx
call fcn.10045110
test al, al
jne 0x10057f3a
mov ecx, dword [esp + 0x10]
mov ebp, dword [ebp + 0xc]
inc ecx
test ebp, ebp
mov dword [esp + 0x10], ecx
jne 0x10057f02
jmp 0x10057f9d
mov eax, dword [ebx + 8]
cmp byte [eax], 8
lea esi, [ebx + 8]
jne 0x10057f48
lea esi, [eax + 8]
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
movzx edx, cx
push ecx
mov ecx, dword [eax + edx*4]
mov edx, dword [edi + 4]
push ecx
push edx
call fcn.10052da0
test al, al
je 0x10057fbf
mov eax, dword [edi + 4]
push eax
call fcn.100449b0
mov byte [eax], 0x13
mov byte [eax + 1], 0
mov ecx, dword [esi]
mov dx, word [ecx + 6]
mov cl, byte [eax + 2]
push eax
and cl, 0x7f
push esi
mov word [eax + 6], dx
mov byte [eax + 2], cl
call fcn.10045780
and byte [ebx + 2], 0x7f
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov ebx, dword [eax + 0xc]
add eax, 0xc
test ebx, ebx
mov dword [esp + 0x20], eax
jne 0x10057ed0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret

Function at 0x10058610
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, dword [ebp + 4]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esi]
push edi
call fcn.10044980
test al, al
je 0x100586da
add ebp, 0x14
mov dword [esi], 0
mov esi, dword [ebp]
test esi, esi
mov dword [esp + 0x14], 0
je 0x10058666
push esi
push edi
push ebx
call fcn.10045110
test al, al
jne 0x10058684
mov ecx, dword [esp + 0x14]
lea ebp, [esi + 0xc]
mov esi, dword [ebp]
inc ecx
test esi, esi
mov dword [esp + 0x14], ecx
jne 0x10058647
push 0x29
push ebx
mov dword [ebx + 8], edi
call fcn.10045fa0
test al, al
je 0x100586e1
push ebx
call fcn.100449b0
or byte [eax + 2], 0x80
mov dword [ebp], eax
jmp 0x1005868c
push edi
call fcn.10045620
mov edi, esi
push 0x10
call fcn.1005ad30
add esp, 4
test eax, eax
je 0x100586e1
mov cx, word [esp + 0x14]
mov dword [eax + 8], 0
mov word [eax + 0xc], cx
mov byte [eax], 0x13
mov byte [eax + 1], 0
mov byte [eax + 2], 0
mov dl, byte [edi + 3]
mov byte [eax + 3], dl
mov cx, word [edi + 4]
mov word [eax + 4], cx
mov dx, word [edi + 6]
mov word [eax + 6], dx
push ebx
mov dword [ebx + 8], eax
call fcn.100449b0
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x1005abf0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push 0
lea eax, [esp + 8]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005ac1d
cmp dword [esp + 4], esi
jne 0x1005ac1d
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret

Function at 0x1005ac30
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push 0
lea eax, [esp + 8]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1005ac5d
cmp dword [esp + 4], esi
jne 0x1005ac5d
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret
Function at 0x1006a360
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test byte [esi + 0xe], 1
mov ecx, dword [esi]
je 0x1006a385
mov dl, byte [esi + 0x10]
mov al, byte [ecx]
add dl, 0x3b
xor al, dl
inc ecx
test al, al
jne 0x1006a370
mov byte [esi + 0x10], dl
mov dword [esi], ecx
pop esi
ret 4
mov eax, ecx
push edi
lea edi, [eax + 1]
jmp 0x1006a390
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1006a390
sub eax, edi
lea eax, [ecx + eax + 1]
pop edi
mov dword [esi], eax
pop esi
ret 4

Function at 0x1006a3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
mov cl, byte [edi + 0xe]
mov eax, dword [edi]
test cl, 1
mov cl, byte [eax]
lea esi, [ebp + 2]
je 0x1006a43a
mov dl, byte [edi + 0x10]
add dl, 0x3b
xor cl, dl
inc eax
test cl, cl
je 0x1006a426
mov byte [esi], cl
mov cl, byte [eax]
add dl, 0x3b
inc esi
xor cl, dl
inc eax
test cl, cl
jne 0x1006a417
sub esi, ebp
sub esi, 2
mov byte [edi + 0x10], dl
mov word [ebp], si
mov dword [edi], eax
pop edi
pop esi
pop ebp
ret 8
inc eax
test cl, cl
je 0x1006a44a
nop
mov byte [esi], cl
mov cl, byte [eax]
inc esi
inc eax
test cl, cl
jne 0x1006a440
sub esi, ebp
sub esi, 2
mov word [ebp], si
mov dword [edi], eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x1006e320
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x20
cmp eax, 0x80
je 0x1006e342
cmp eax, 0xc0
je 0x1006e342
cmp eax, 0x100
je 0x1006e342
xor eax, eax
add esp, 0x20
ret
cdq
push ebx
and edx, 0x1f
add eax, edx
push ebp
sar eax, 5
add eax, 6
push esi
push edi
mov edi, dword [esp + 0x34]
lea ecx, [eax - 6]
mov dword [edi], eax
lea eax, [ecx - 1]
test eax, eax
jl 0x1006e37e
mov edx, dword [esp + 0x38]
lea esi, [esp + 0x10]
sub edx, esi
lea esp, [esp]
lea esi, [edx + eax*4]
dec eax
mov esi, dword [esp + esi + 0x10]
mov dword [esp + eax*4 + 0x14], esi
jns 0x1006e370
xor esi, esi
xor edx, edx
xor eax, eax
test ecx, ecx
jle 0x1006e3b5
mov ebx, dword [edi]
inc ebx
cmp esi, ebx
jge 0x1006e3b5
cmp eax, ecx
jge 0x1006e3a9
cmp edx, 4
jge 0x1006e3ac
mov ebp, dword [esp + eax*4 + 0x10]
lea ebx, [edx + esi*4]
inc eax
inc edx
cmp eax, ecx
mov dword [edi + ebx*4 + 4], ebp
jl 0x1006e393
cmp edx, 4
jne 0x1006e3b1
inc esi
xor edx, edx
cmp eax, ecx
jl 0x1006e388
mov eax, dword [edi]
inc eax
cmp esi, eax
jge 0x1006e51d
mov dword [esp + 0x3c], 0x10098558
jmp 0x1006e3d0
movzx ebx, byte [esp + ecx*4 + 0xd]
mov al, byte [esp + 0x10]
xor al, byte [ebx + str.cw]
mov byte [esp + 0x10], al
movzx ebx, byte [esp + ecx*4 + 0xe]
mov bl, byte [ebx + str.cw]
xor byte [esp + 0x11], bl
movzx ebx, byte [esp + ecx*4 + 0xf]
mov bl, byte [ebx + str.cw]
xor byte [esp + 0x12], bl
movzx ebx, byte [esp + ecx*4 + 0xc]
mov bl, byte [ebx + str.cw]
xor byte [esp + 0x13], bl
mov ebx, dword [esp + 0x3c]
xor al, byte [ebx]
inc ebx
cmp ecx, 8
mov byte [esp + 0x10], al
mov dword [esp + 0x3c], ebx
mov eax, 1
je 0x1006e450
cmp ecx, eax
jle 0x1006e4d4
mov ebp, dword [esp + eax*4 + 0x10]
mov ebx, dword [esp + eax*4 + 0xc]
xor ebp, ebx
mov dword [esp + eax*4 + 0x10], ebp
inc eax
cmp eax, ecx
jl 0x1006e431
jmp 0x1006e4d4
mov ebp, dword [esp + eax*4 + 0x10]
mov ebx, dword [esp + eax*4 + 0xc]
xor ebp, ebx
mov dword [esp + eax*4 + 0x10], ebp
inc eax
cmp eax, 4
jl 0x1006e450
movzx eax, byte [esp + 0x1c]
mov al, byte [eax + str.cw]
mov bl, byte [esp + 0x20]
xor bl, al
movzx eax, byte [esp + 0x1d]
mov al, byte [eax + str.cw]
mov byte [esp + 0x20], bl
mov bl, byte [esp + 0x21]
xor bl, al
movzx eax, byte [esp + 0x1e]
mov al, byte [eax + str.cw]
mov byte [esp + 0x21], bl
mov bl, byte [esp + 0x22]
xor bl, al
movzx eax, byte [esp + 0x1f]
mov al, byte [eax + str.cw]
mov byte [esp + 0x22], bl
xor byte [esp + 0x23], al
mov eax, 5
jmp 0x1006e4c0
mov ebp, dword [esp + eax*4 + 0x10]
mov ebx, dword [esp + eax*4 + 0xc]
xor ebp, ebx
mov dword [esp + eax*4 + 0x10], ebp
inc eax
cmp eax, 8
jl 0x1006e4c0
xor eax, eax
test ecx, ecx
jle 0x1006e512
lea ebx, [ebx]
mov ebx, dword [edi]
inc ebx
cmp esi, ebx
jge 0x1006e512
cmp eax, ecx
jge 0x1006e506
jmp 0x1006e4f0
cmp edx, 4
jge 0x1006e509
mov ebp, dword [esp + eax*4 + 0x10]
lea ebx, [edx + esi*4]
inc eax
inc edx
cmp eax, ecx
mov dword [edi + ebx*4 + 4], ebp
jl 0x1006e4f0
cmp edx, 4
jne 0x1006e50e
inc esi
xor edx, edx
cmp eax, ecx
jl 0x1006e4e0
mov eax, dword [edi]
inc eax
cmp esi, eax
jl 0x1006e3d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret