joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51d8d0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov edx, dword [esp + 8]
cmp word [edx + 2], 1
push esi
push edi
jne 0x51da02
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov esi, 0xffffff
mov dword [esp + 0x10], 0
lea ecx, [edx + 0x20]
mov dword [esp + 0x18], 2
movzx ebx, byte [ecx + 1]
sub ebx, dword [esp + 0x20]
movzx edx, byte [ecx]
movzx edi, byte [ecx + 2]
sub edi, dword [esp + 0x1c]
sub edx, ebp
imul edx, edx
mov eax, ebx
imul eax, ebx
add edx, eax
mov eax, edi
imul eax, edi
add edx, eax
cmp edx, esi
jae 0x51d937
mov eax, dword [esp + 0x18]
add eax, 0xfffffffe
mov dword [esp + 0x10], eax
mov esi, edx
movzx ebx, byte [ecx + 5]
sub ebx, dword [esp + 0x20]
movzx edx, byte [ecx + 4]
movzx edi, byte [ecx + 6]
sub edi, dword [esp + 0x1c]
sub edx, ebp
imul edx, edx
mov eax, ebx
imul eax, ebx
add edx, eax
mov eax, edi
imul eax, edi
add edx, eax
cmp edx, esi
jae 0x51d96f
mov eax, dword [esp + 0x18]
add eax, 0xffffffff
mov dword [esp + 0x10], eax
mov esi, edx
movzx ebx, byte [ecx + 9]
sub ebx, dword [esp + 0x20]
movzx edx, byte [ecx + 8]
movzx edi, byte [ecx + 0xa]
sub edi, dword [esp + 0x1c]
sub edx, ebp
imul edx, edx
mov eax, ebx
imul eax, ebx
add edx, eax
mov eax, edi
imul eax, edi
add edx, eax
cmp edx, esi
jae 0x51d9a4
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov esi, edx
movzx ebx, byte [ecx + 0xd]
sub ebx, dword [esp + 0x20]
movzx edx, byte [ecx + 0xc]
movzx edi, byte [ecx + 0xe]
sub edi, dword [esp + 0x1c]
sub edx, ebp
imul edx, edx
mov eax, ebx
imul eax, ebx
add edx, eax
mov eax, edi
imul eax, edi
add edx, eax
cmp edx, esi
jae 0x51d9dc
mov eax, dword [esp + 0x18]
add eax, 1
mov dword [esp + 0x10], eax
mov esi, edx
mov eax, dword [esp + 0x18]
add eax, 4
mov dword [esp + 0x18], eax
add eax, 0xfffffffe
add ecx, 0x10
cmp eax, 0x100
jl 0x51d900
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
mov al, byte [edx + 7]
test al, al
je 0x51da1e
movzx esi, byte [esp + 0x20]
mov ecx, 8
sub cl, al
shr esi, cl
mov cl, byte [edx + 0xb]
shl esi, cl
jmp 0x51da20
xor esi, esi
movzx eax, byte [esp + 0x1c]
movzx edi, byte [esp + 0x18]
mov ecx, 8
sub cl, byte [edx + 6]
shr eax, cl
movzx ecx, byte [edx + 0xa]
shl eax, cl
mov ecx, 8
sub cl, byte [edx + 5]
shr edi, cl
movzx ecx, byte [edx + 9]
shl edi, cl
mov ecx, 8
sub cl, byte [edx + 4]
add eax, edi
movzx edi, byte [esp + 0x14]
shr edi, cl
movzx ecx, byte [edx + 8]
shl edi, cl
add eax, edi
add eax, dword [edx + 0x1c]
pop edi
add eax, esi
pop esi
pop ecx
ret
Function at 0x51da70
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov dl, byte [esi + 4]
mov bl, 8
cmp dl, bl
push edi
jne 0x51db37
cmp byte [esi + 5], bl
jne 0x51db37
cmp byte [esi + 6], bl
jne 0x51db37
mov eax, dword [esp + 0x18]
test eax, eax
mov edi, dword [esp + 0x14]
je 0x51daae
mov edx, dword [esi + 0xc]
mov cl, byte [esi + 8]
and edx, edi
shr edx, cl
mov dword [eax], edx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x51dac2
mov edx, dword [esi + 0x10]
mov cl, byte [esi + 9]
and edx, edi
shr edx, cl
mov dword [eax], edx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x51dad6
mov edx, dword [esi + 0x14]
mov cl, byte [esi + 0xa]
and edx, edi
shr edx, cl
mov dword [eax], edx
mov dl, byte [esi + 7]
test dl, dl
je 0x51dc10
cmp dl, bl
jne 0x51db03
mov eax, dword [esp + 0x24]
test eax, eax
je 0x51dc10
mov edx, dword [esi + 0x18]
mov cl, byte [esi + 0xb]
and edx, edi
shr edx, cl
pop edi
pop esi
pop ebx
mov dword [eax], edx
xor eax, eax
ret
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x51dc10
mov eax, dword [esi + 0x18]
mov cl, byte [esi + 0xb]
and eax, edi
shr eax, cl
mov cl, dl
mov esi, 1
shl esi, cl
imul eax, eax, 0xff
sub esi, 1
xor edx, edx
div esi
pop edi
pop esi
mov dword [ebx], eax
xor eax, eax
pop ebx
ret
movzx ecx, byte [esi + 5]
mov edi, 1
shl edi, cl
movzx ecx, byte [esi + 6]
mov ebx, 1
shl ebx, cl
movzx ecx, byte [esi + 7]
push ebp
mov ebp, 1
shl ebp, cl
sub edi, 1
sub ebx, 1
sub ebp, 1
cmp dword [esp + 0x1c], 0
je 0x51db9b
mov eax, dword [esi + 0xc]
and eax, dword [esp + 0x18]
mov cl, byte [esi + 8]
shr eax, cl
mov ecx, 1
mov dword [esp + 0x14], ecx
mov cl, dl
mov edx, dword [esp + 0x14]
imul eax, eax, 0xff
shl edx, cl
sub edx, 1
mov ecx, edx
xor edx, edx
div ecx
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
cmp dword [esp + 0x20], 0
je 0x51dbbe
mov eax, dword [esi + 0x10]
and eax, dword [esp + 0x18]
mov cl, byte [esi + 9]
shr eax, cl
xor edx, edx
imul eax, eax, 0xff
div edi
mov edx, dword [esp + 0x20]
mov dword [edx], eax
mov edi, dword [esp + 0x24]
test edi, edi
je 0x51dbde
mov eax, dword [esi + 0x14]
and eax, dword [esp + 0x18]
mov cl, byte [esi + 0xa]
shr eax, cl
xor edx, edx
imul eax, eax, 0xff
div ebx
mov dword [edi], eax
mov edi, dword [esp + 0x28]
test edi, edi
je 0x51dc0f
cmp byte [esi + 7], 0
je 0x51dc0b
mov eax, dword [esi + 0x18]
and eax, dword [esp + 0x18]
mov cl, byte [esi + 0xb]
shr eax, cl
xor edx, edx
imul eax, eax, 0xff
div ebp
pop ebp
mov dword [edi], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor eax, eax
mov dword [edi], eax
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x51dff0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 7]
movzx edx, word [eax]
push esi
movzx esi, byte [eax + 6]
add ecx, esi
movzx esi, byte [eax + 5]
add ecx, esi
movzx esi, byte [eax + 4]
add ecx, esi
cmp ecx, edx
pop esi
je 0x51e053
xor ecx, ecx
cmp edx, ecx
mov dword [eax + 0x1c], ecx
jle 0x51e035
lea esp, [esp]
mov edx, dword [eax + 0x1c]
add edx, edx
or edx, 1
mov dword [eax + 0x1c], edx
movzx edx, word [eax]
add ecx, 1
cmp ecx, edx
jl 0x51e020
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x14]
not edx
not ecx
and ecx, edx
mov edx, dword [eax + 0x10]
not edx
and ecx, edx
mov edx, dword [eax + 0xc]
not edx
and ecx, edx
and dword [eax + 0x1c], ecx
ret
mov dword [eax + 0x1c], 0
ret
Function at 0x52c520
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0x9908b0df
movd mm4, eax
punpckldq mm4, mm4
mov eax, 1
movd mm5, eax
punpckldq mm5, mm5
movq mm6, mm5
psllq mm6, 0x1f
movq mm7, mm6
psubd mm7, mm5
lea esi, [0xa79c68]
add esi, 0x388
mov edi, esi
add edi, 0x634
mov ecx, 0xffffff8f
movq mm0, qword [esi + ecx*8]
pand mm0, mm6
movq mm1, qword [esi + ecx*8 + 4]
movq mm2, qword [edi + ecx*8]
pand mm1, mm7
por mm0, mm1
movq mm3, mm1
psrld mm0, 1
pand mm3, mm5
pxor mm2, mm0
psubd mm3, mm5
movq mm0, qword [esi + ecx*8 + 8]
pandn mm3, mm4
movq mm1, qword [esi + ecx*8 + 0xc]
pxor mm3, mm2
movq mm2, qword [edi + ecx*8 + 8]
pand mm0, mm6
movq qword [esi + ecx*8], mm3
pand mm1, mm7
inc ecx
jne 0x52c575
mov eax, dword [esi]
mov ebx, dword [esi + 4]
and eax, 0x80000000
and ebx, 0x7fffffff
mov edx, dword [edi]
or eax, ebx
shr eax, 1
or ebx, 0xfffffffe
xor eax, edx
add ebx, 1
xor eax, 0x9908b0df
and ebx, 0x9908b0df
xor ebx, eax
mov dword [esi], ebx
lea esi, [0xa79c68]
mov eax, dword [esi]
add esi, 0x9c0
mov dword [esi], eax
mov edi, esi
sub edi, 0x38c
add esi, 4
add edi, 4
mov ecx, 0xffffff39
movq mm0, qword [esi + ecx*8]
pand mm0, mm6
movq mm1, qword [esi + ecx*8 + 4]
movq mm2, qword [edi + ecx*8]
pand mm1, mm7
por mm0, mm1
movq mm3, mm1
psrld mm0, 1
pand mm3, mm5
pxor mm2, mm0
psubd mm3, mm5
movq mm0, qword [esi + ecx*8 + 8]
pandn mm3, mm4
movq mm1, qword [esi + ecx*8 + 0xc]
pxor mm3, mm2
movq mm2, qword [edi + ecx*8 + 8]
pand mm0, mm6
movq qword [esi + ecx*8], mm3
pand mm1, mm7
inc ecx
jne 0x52c60d
push ebp
mov eax, 0x9d2c5680
movd mm6, eax
punpckldq mm6, mm6
mov eax, 0xefc60000
movd mm7, eax
punpckldq mm7, mm7
lea esi, [0xa79c68]
lea edi, [0xa7a630]
add esi, 0x9c0
add edi, 0x9c0
mov ecx, 0xfffffec8
movq mm0, qword [esi + ecx*8]
movq mm1, mm0
psrld mm0, 0xb
pxor mm0, mm1
movq mm2, qword [esi + ecx*8 + 8]
movq mm1, mm0
pslld mm0, 7
movq mm3, mm2
psrld mm2, 0xb
pand mm0, mm6
pxor mm2, mm3
pxor mm0, mm1
movq mm3, mm2
pslld mm2, 7
movq mm1, mm0
pslld mm0, 0xf
pand mm2, mm6
pand mm0, mm7
pxor mm2, mm3
pxor mm0, mm1
movq mm3, mm2
pslld mm2, 0xf
movq mm1, mm0
pand mm2, mm7
psrld mm0, 0x12
pxor mm2, mm3
pxor mm1, mm0
movq mm0, qword [esi + ecx*8 + 0x10]
movq mm3, mm2
movq qword [edi + ecx*8], mm1
psrld mm2, 0x12
movq mm1, mm0
pxor mm3, mm2
movq mm2, qword [esi + ecx*8 + 0x18]
psrld mm0, 0xb
movq qword [edi + ecx*8 + 8], mm3
pxor mm0, mm1
add ecx, 2
jne 0x52c689
pop ebp
emms
pop edi
pop esi
mov dword [0xa7a62c], 0
pop ebx
pop ebp
ret
Function at 0x52c710
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xa7aff4]
push ebx
push esi
push edi
test eax, eax
je 0x52c729
call fcn.0052c520
pop edi
pop esi
pop ebx
pop ebp
ret
lea esi, [0xa79c68]
add esi, 0x38c
mov edi, esi
add edi, 0x634
mov ecx, 0xffffff1d
mov eax, dword [esi + ecx*4]
mov ebx, dword [esi + ecx*4 + 4]
and eax, 0x80000000
and ebx, 0x7fffffff
mov edx, dword [edi + ecx*4]
or eax, ebx
shr eax, 1
or ebx, 0xfffffffe
xor eax, edx
add ebx, 1
xor eax, 0x9908b0df
and ebx, 0x9908b0df
xor ebx, eax
mov eax, dword [esi + ecx*4 + 4]
mov dword [esi + ecx*4], ebx
mov ebx, dword [esi + ecx*4 + 8]
inc ecx
jne 0x52c749
lea esi, [0xa79c68]
mov eax, dword [esi]
add esi, 0x9c0
mov dword [esi], eax
mov edi, esi
sub edi, 0x38c
mov ecx, 0xfffffe73
mov eax, dword [esi + ecx*4]
mov ebx, dword [esi + ecx*4 + 4]
and eax, 0x80000000
and ebx, 0x7fffffff
mov edx, dword [edi + ecx*4]
or eax, ebx
shr eax, 1
or ebx, 0xfffffffe
xor eax, edx
add ebx, 1
xor eax, 0x9908b0df
and ebx, 0x9908b0df
xor ebx, eax
mov eax, dword [esi + ecx*4 + 4]
mov dword [esi + ecx*4], ebx
mov ebx, dword [esi + ecx*4 + 8]
inc ecx
jne 0x52c7a2
push ebp
lea esi, [0xa79c68]
lea edi, [0xa7a630]
add esi, 0x9c0
add edi, 0x9c0
mov ecx, 0xfffffec8
mov eax, dword [esi + ecx*8]
mov edx, dword [esi + ecx*8 + 4]
mov ebx, eax
shr eax, 0xb
mov ebp, edx
shr edx, 0xb
xor eax, ebx
xor edx, ebp
mov ebx, eax
shl eax, 7
mov ebp, edx
shl edx, 7
and eax, 0x9d2c5680
and edx, 0x9d2c5680
xor eax, ebx
xor edx, ebp
mov ebx, eax
shl eax, 0xf
mov ebp, edx
shl edx, 0xf
and eax, 0xefc60000
and edx, 0xefc60000
xor eax, ebx
xor edx, ebp
mov ebx, eax
shr eax, 0x12
mov ebp, edx
shr edx, 0x12
xor eax, ebx
xor edx, ebp
mov dword [edi + ecx*8], eax
mov dword [edi + ecx*8 + 4], edx
mov eax, dword [esi + ecx*8 + 8]
inc ecx
jne 0x52c7f8
pop ebp
pop edi
pop esi
mov dword [0xa7a62c], 0
pop ebx
pop ebp
ret
Function at 0x52d530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x58]
xor ebp, ebp
cmp edi, ebp
mov dword [esp + 0x10], ebp
jne 0x52d58f
push ebp
lea eax, [esp + 0x18]
push 0x10000
push eax
push ebx
call fcn.0052d750
add esp, 0x10
cmp eax, 0xffffff80
jne 0x52d574
cmp edx, 0xffffffff
jne 0x52d574
pop edi
pop esi
pop ebp
mov eax, 0xffffff80
pop ebx
add esp, 0x34
ret
cmp edx, ebp
jg 0x52d58b
jl 0x52d57e
cmp eax, ebp
jae 0x52d58b
pop edi
pop esi
pop ebp
mov eax, 0xffffff7c
pop ebx
add esp, 0x34
ret
lea edi, [esp + 0x14]
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0066c430
mov edx, dword [esp + 0x54]
push edx
call fcn.00679820
add esp, 8
push edi
call fcn.00668db0
add esp, 4
test eax, eax
je 0x52d61f
push edi
lea esi, [ebx + 0x78]
call fcn.00668eb0
push eax
push esi
call fcn.00669860
push edi
push esi
call fcn.006694a0
lea eax, [esp + 0x38]
push eax
push esi
call fcn.00669890
add esp, 0x1c
test eax, eax
jle 0x52d5ed
lea ecx, [esp + 0x24]
push ecx
call fcn.0066c5d0
add esp, 4
test eax, eax
jne 0x52d64c
push ebp
push 0x10000
push edi
push ebx
call fcn.0052d750
add esp, 0x10
cmp eax, 0xffffff80
jne 0x52d60b
cmp edx, 0xffffffff
je 0x52d567
cmp edx, ebp
jl 0x52d57e
jg 0x52d5a6
cmp eax, ebp
jb 0x52d57e
jmp 0x52d5a6
mov esi, 0xffffff7c
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0066c460
mov edx, dword [esp + 0x54]
push edx
call fcn.0066c3a0
add esp, 8
mov eax, esi
mov dword [ebx + 0x58], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov eax, dword [esp + 0x54]
cmp eax, ebp
je 0x52d65c
mov edx, dword [ebx + 0x1c8]
mov dword [eax], edx
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x24]
mov dword [ebx + 0x58], 3
push eax
push ecx
push edx
call fcn.0066c680
mov esi, eax
add esp, 0xc
cmp esi, ebp
jne 0x52d624
cmp ebp, 2
jge 0x52d73d
lea eax, [esp + 0x24]
push eax
lea eax, [ebx + 0x78]
push eax
call fcn.00669890
add esp, 8
test eax, eax
je 0x52d6d0
cmp eax, 0xffffffff
je 0x52d733
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x24]
push ecx
push edx
push eax
call fcn.0066c680
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x52d624
inc ebp
cmp ebp, 2
jge 0x52d73d
jmp 0x52d689
cmp ebp, 2
jge 0x52d73d
push 0
push 0x10000
push edi
push ebx
call fcn.0052d750
add esp, 0x10
test edx, edx
jl 0x52d733
jg 0x52d6f0
test eax, eax
jb 0x52d733
push edi
call fcn.00668eb0
mov ecx, dword [ebx + 0x1c8]
add esp, 4
cmp ecx, eax
push edi
je 0x52d722
call fcn.00668db0
add esp, 4
test eax, eax
je 0x52d6d5
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x52d733
mov dword [esp + 0x10], 1
jmp 0x52d6d5
lea eax, [ebx + 0x78]
push eax
call fcn.006694a0
add esp, 8
jmp 0x52d680
mov esi, 0xffffff7b
jmp 0x52d624
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret
Function at 0x53ae40
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x80]
test eax, eax
jne 0x53ae90
mov eax, dword [esi + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x53aea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x80], eax
jne 0x53ae90
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x53ae90
and eax, 0xffff
pop esi
or eax, 0x80070000
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x5fa110
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0x24]
cmp eax, edi
mov dword [esp + 0x10], eax
jge 0x5fa227
mov ebp, dword [esi + 0x24]
lea ebx, [esi + 0x20]
cmp edi, ebp
jl 0x5fa158
jle 0x5fa13d
push edi
mov ecx, ebx
call fcn.005fb130
cmp ebp, edi
mov ecx, ebp
jge 0x5fa158
mov eax, dword [ebx + 0xc]
lea eax, [eax + ecx*4]
test eax, eax
je 0x5fa153
mov dword [eax], 0
inc ecx
cmp ecx, edi
jl 0x5fa143
mov dword [ebx + 4], edi
mov ebp, dword [esi + 0x38]
lea ebx, [esi + 0x34]
cmp edi, ebp
jl 0x5fa18a
jle 0x5fa16f
push edi
mov ecx, ebx
call fcn.005fb130
cmp ebp, edi
mov ecx, ebp
jge 0x5fa18a
mov edx, dword [ebx + 0xc]
lea eax, [edx + ecx*4]
test eax, eax
je 0x5fa185
mov dword [eax], 0
inc ecx
cmp ecx, edi
jl 0x5fa175
xor eax, eax
mov dword [ebx + 4], edi
test edi, edi
jle 0x5fa1a3
mov ecx, dword [esi + 0x2c]
inc eax
cmp eax, edi
mov dword [ecx + eax*4 - 4], 0xffffffff
jl 0x5fa193
xor eax, eax
test edi, edi
jle 0x5fa1b9
mov edx, dword [esi + 0x40]
inc eax
cmp eax, edi
mov dword [edx + eax*4 - 4], 0xffffffff
jl 0x5fa1a9
mov ebx, dword [esp + 0x10]
xor edx, edx
test ebx, ebx
jle 0x5fa227
xor edi, edi
mov eax, dword [esi + 0x10]
mov ecx, edi
add ecx, eax
add edi, 0x10
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
mov eax, dword [eax + 0xc]
mov ebp, dword [ecx + 0xc]
shl eax, 0x10
or eax, ebp
mov ebp, dword [esi + 0x40]
mov ecx, eax
shl ecx, 0xf
not ecx
add eax, ecx
mov ecx, eax
sar ecx, 0xa
xor ecx, eax
lea eax, [ecx + ecx*8]
mov ecx, eax
sar ecx, 6
xor eax, ecx
mov ecx, eax
shl ecx, 0xb
not ecx
add eax, ecx
mov ecx, eax
sar ecx, 0x10
xor ecx, eax
mov eax, dword [esi + 0xc]
dec eax
and ecx, eax
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + ecx*4]
mov dword [ebp + edx*4], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + ecx*4], edx
inc edx
cmp edx, ebx
jl 0x5fa1c5
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x605160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
push ebx
mov ebx, dword [esp + 0x6c]
cmp dword [ebx + 4], 1
jle 0x6052e2
push ebp
push esi
push edi
or eax, 0xffffffff
xor ebp, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x10], 0x7f7fffff
test eax, eax
jle 0x605245
lea ecx, [ebp + 1]
cmp ecx, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x78], ecx
jge 0x605238
mov eax, dword [ebx + 0xc]
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [eax + edx*4]
mov edx, dword [eax + ebp*4]
push ecx
push edx
call fcn.00606990
mov ecx, 8
lea esi, [esp + 0x5c]
lea edi, [esp + 0x3c]
lea eax, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.0053e680
fld dword [esp + 0x3c]
fmul dword [esp + 0x38]
add esp, 0x18
fadd dword [0x6a7764]
fmul dword [esp + 0x28]
fadd dword [esp + 0x24]
fadd dword [esp + 0x20]
fcom dword [esp + 0x10]
fnstsw ax
test ah, 1
je 0x60521e
mov eax, dword [esp + 0x78]
mov dword [esp + 0x18], ebp
fstp dword [esp + 0x10]
mov dword [esp + 0x1c], eax
jmp 0x605220
fstp st(0)
mov eax, dword [esp + 0x78]
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
mov dword [esp + 0x78], eax
jl 0x6051a8
mov ecx, dword [esp + 0x14]
mov eax, dword [ebx + 4]
mov ebp, ecx
cmp ebp, eax
jl 0x605195
mov eax, dword [ebx + 0xc]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebp, dword [eax + ecx*4]
mov edi, dword [eax + edx*4]
mov eax, dword [esp + 0x74]
mov esi, dword [eax + 4]
test esi, esi
je 0x60526a
mov dword [eax + 4], 0
jmp 0x605287
push 0x10
push 0x2c
call fcn.0062ba20
mov esi, eax
add esp, 8
test esi, esi
je 0x605285
mov ecx, esi
call fcn.00602d90
jmp 0x605287
xor esi, esi
push esi
xor eax, eax
push edi
push ebp
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call fcn.00606990
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], edi
mov dword [ebp + 0x20], esi
mov dword [edi + 0x20], esi
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [eax + ecx*4], esi
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0xc]
mov esi, dword [esp + 0x1c]
dec eax
mov edx, dword [ecx + esi*4]
mov edi, dword [ecx + eax*4]
mov dword [ecx + esi*4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
dec ecx
mov eax, ecx
mov dword [ebx + 4], ecx
cmp eax, 1
jg 0x605175
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x610a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov dword [esp + 4], 0x5d5e0b6b
mov esi, dword [esp + 4]
lea edx, [ecx + 0x124]
mov dword [esp + 8], 0x5d5e0b6b
mov dword [esp + 0xc], 0x5d5e0b6b
mov dword [edx], esi
mov esi, dword [esp + 8]
xor eax, eax
mov byte [ecx + 0x160], 1
mov dword [edx + 4], esi
mov esi, dword [esp + 0xc]
mov byte [ecx + 0x134], al
mov dword [ecx], eax
mov dword [edx + 8], esi
mov esi, eax
mov dword [esp + 0x10], eax
mov dword [edx + 0xc], esi
mov byte [ecx + 0x15c], al
mov dword [ecx + 0x14c], eax
mov dword [ecx + 0x150], eax
mov dword [ecx + 0x154], eax
mov dword [ecx + 0x158], eax
and word [ecx + 0x148], 0xfff0
pop esi
add esp, 0x10
ret
Function at 0x63cc80
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
cmp eax, 3
push ebx
push esi
jne 0x63cce9
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov cx, word [eax + 0x118]
test cx, cx
jne 0x63ccab
test byte [eax + 0x230], 1
jne 0x63ccc8
movzx si, byte [edx]
cmp si, cx
jbe 0x63ccc8
push str.Invalid_background_palette_index
push eax
call fcn.0062e950
add esp, 8
pop esi
pop ebx
add esp, 8
ret
mov cl, byte [edx]
push 1
mov byte [esp + 0xc], cl
lea edx, [esp + 0xc]
push edx
push str.bKGD
push eax
call fcn.0063b9c0
add esp, 0x10
pop esi
pop ebx
add esp, 8
ret
test al, 2
je 0x63cd61
mov esi, dword [esp + 0x18]
xor eax, eax
lea ecx, [esp + 8]
mov ax, word [esi + 2]
push eax
push ecx
call fcn.0063b9a0
xor edx, edx
lea eax, [esp + 0x12]
mov dx, word [esi + 4]
push edx
push eax
call fcn.0063b9a0
xor ecx, ecx
lea edx, [esp + 0x1c]
mov cx, word [esi + 6]
push ecx
push edx
call fcn.0063b9a0
mov eax, dword [esp + 0x2c]
add esp, 0x18
cmp byte [eax + 0x127], 8
jne 0x63cd5a
mov cl, byte [esp + 0xc]
mov bl, byte [esp + 0xa]
mov dl, byte [esp + 8]
or cl, bl
or cl, dl
je 0x63cd5a
push str.Ignoring_attempt_to_write_16_bit_bKGD_chunk_when_bit_depth_is_8
push eax
call fcn.0062e950
add esp, 8
pop esi
pop ebx
add esp, 8
ret
push 6
jmp 0x63ccd0
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
xor eax, eax
mov edx, 1
mov ax, word [ecx + 8]
mov cl, byte [esi + 0x127]
shl edx, cl
cmp eax, edx
jl 0x63cd94
push str.Ignoring_attempt_to_write_bKGD_chunk_out_of_range_for_bit_depth
push esi
call fcn.0062e950
add esp, 8
pop esi
pop ebx
add esp, 8
ret
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0063b9a0
lea ecx, [esp + 0x10]
push 2
push ecx
push str.bKGD
push esi
call fcn.0063b9c0
add esp, 0x18
pop esi
pop ebx
add esp, 8
ret
Function at 0x644980
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x6449b0
push esi
call fcn.006477b0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x6449a9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x644a33
mov eax, dword [esi + 0x1a0]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x644a1f
mov eax, dword [esi + 8]
test eax, eax
je 0x6449d4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1a0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x644a1b
cmp eax, 2
je 0x644a1f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x6449c7
cmp eax, 3
je 0x6449fa
cmp eax, 1
jne 0x6449c7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x6449c7
mov edx, dword [esi + 0x120]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x6449c7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00644a60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x644a53
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00644a60
add esp, 4
pop esi
ret

Function at 0x669000
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x6690a0
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x669052
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x6b1190]
xor eax, edx
inc esi
cmp esi, edi
jl 0x669033
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x66907b
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x6b1190]
xor eax, edx
inc esi
cmp esi, edi
jl 0x66905e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret