joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40691b
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40983c
mov ebx, 0x426a58
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [esp + 0x18]
test esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov edi, 0x400
je 0x406969
push 1
push 0
push esi
call fcn.00405f3c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x406a88
cmp eax, edi
jg 0x406a88
push edi
mov esi, 0x4280a8
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x406a88
cmp eax, edi
jg 0x406a88
push esi
push ebx
push str._ls_ls_r_n
push 0x4274a8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42bd2c]
push dword [eax + 0x128]
push esi
call fcn.0040669a
push 4
push 0xc0000000
push esi
call fcn.00405f3c
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x406a88
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406a81
push edi
push esi
push ebp
call fcn.00405fbf
test eax, eax
je 0x406a81
push str._Rename__r_n
push esi
call fcn.00405e9c
test eax, eax
jne 0x406a1f
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406a54
push 0x409820
add eax, 0xa
push eax
call fcn.00405e9c
mov ebp, eax
test ebp, ebp
je 0x406a50
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406a41
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406a3b
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x406a56
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
push 0x4274a8
add eax, esi
push eax
call fcn.00405ef2
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00405fee
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x406a8d
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406ab0
push dword [esp + 8]
push dword [esp + 8]
call fcn.0040691b
pop ecx
pop ecx
inc dword [0x42bdf0]
ret 8
Function at 0x406ab9
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push esi
mov dword [ebp - 4], eax
call fcn.00406612
test bl, 8
mov dword [ebp - 8], eax
je 0x406af7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x42bde8], eax
jmp 0x406cd1
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
push edi
je 0x406b12
test eax, eax
je 0x406c51
test bl, 2
je 0x406c51
push esi
mov edi, 0x4278a8
push edi
call fcn.004061c9
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406b34
push str..
push edi
call ebx
jmp 0x406b3a
push esi
call fcn.004065e6
cmp word [esi], 0
jne 0x406b4a
cmp word [0x4278a8], 0x5c
jne 0x406b52
push 0x4087a4
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [esi + eax*2]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x406c46
cmp word [ebp - 0x22c], 0x2e
jne 0x406ba5
cmp word [ebp - 0x22a], 0
je 0x406c29
cmp word [ebp - 0x22a], 0x2e
jne 0x406ba5
cmp word [ebp - 0x228], 0
je 0x406c29
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.004061c9
test byte [ebp - 0x258], 0x10
je 0x406bd0
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x406c29
push dword [ebp + 0xc]
push esi
call fcn.00406ab9
jmp 0x406c29
push esi
push str.Delete:_DeleteFile___s__
call fcn.0040637d
pop ecx
pop ecx
push dword [ebp - 4]
push esi
call fcn.0040656f
test eax, eax
push esi
jne 0x406c22
cmp dword [ebp - 4], eax
je 0x406c0e
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.0040637d
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00404fe0
push 0
push esi
call fcn.00406a8d
jmp 0x406c29
push str.Delete:_DeleteFile_failed___s__
call fcn.0040637d
inc dword [0x42bde8]
pop ecx
pop ecx
jmp 0x406c29
push 0xfffffffffffffff2
call fcn.00404fe0
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406b75
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406c51
and word [ebx - 2], 0
xor edi, edi
cmp dword [ebp + 8], edi
je 0x406cd0
cmp dword [ebp - 8], edi
push esi
jne 0x406c65
push str.RMDir:_RemoveDirectory_invalid_input___s__
jmp 0x406cba
call fcn.00406411
test eax, eax
je 0x406cd0
push esi
call fcn.004065b7
push esi
push str.RMDir:_RemoveDirectory___s__
call fcn.0040637d
mov eax, dword [ebp - 4]
pop ecx
pop ecx
or eax, 1
push eax
push esi
call fcn.0040656f
test eax, eax
push esi
jne 0x406cc9
cmp dword [ebp - 4], edi
je 0x406cb5
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.0040637d
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00404fe0
push edi
push esi
call fcn.00406a8d
jmp 0x406cd0
push str.RMDir:_RemoveDirectory_failed___s__
call fcn.0040637d
inc dword [0x42bde8]
pop ecx
pop ecx
jmp 0x406cd0
push 0xffffffffffffffe5
call fcn.00404fe0
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x406cd7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4288ac], 0
jne 0x406d12
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406ceb
mov dword [ecx*4 + 0x4288a8], eax
inc ecx
cmp ecx, 0x100
jl 0x406ce6
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406d3f
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4288a8]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406d20
not eax
pop ebp
ret 0xc
Function at 0x49b7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x49b805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x49b878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x49b83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x49b86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x49b86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x49b831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x49b7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100076ef
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
lea eax, [esi + 0x20]
mov ecx, 0x10
mov dword [esi + 0x1c], eax
mov eax, ecx
call fcn.100075b0
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, dword [esi + 0x1c]
mov dword [0x102b250c], 0x37a
sub esp, 4
mov dword [esp], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ecx
call fcn.10008928
add esp, 4
lea ecx, [0x10007827]
mov edx, dword [0x102b250c]
mov edi, dword [esi + 0x18]
mov ebx, dword [edi]
mov dword [esi + 0x30], ebx
add edx, 0xffffdcc0
mov dword [0x102b250c], edx
mov dword [esi + 0x38], 0x12f400
mov edx, dword [0x102b24f8]
mov dword [esi + 0x48], edx
mov edx, dword [0x102b24fc]
mov dword [esi + 0x58], edx
mov edx, dword [0x102b2500]
mov dword [esi + 0x64], edx
mov edx, dword [0x102b2504]
mov dword [esi + 0x50], edx
mov edx, dword [0x102b2508]
mov dword [esi + 0x4c], edx
mov dword [0x102b2510], 0x1a2
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], ecx
jmp 0x100077b4
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esi + 4], ecx
je 0x100077d7
jmp 0x100077c1
mov eax, dword [esi + 0xc]
cmp word [eax], 0x5a4d
mov dword [esi + 8], eax
je 0x100077a0
mov eax, dword [esi + 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esi], eax
mov eax, dword [esi]
mov dword [esi + 0xc], eax
jmp 0x100077b4
lea eax, [esi + 0x20]
mov ecx, dword [esi + 8]
mov dword [esi + 0x5c], ecx
mov dword [0x102b250c], 0xd16
mov edx, dword [esi + 4]
mov edi, dword [ecx + edx + 0x50]
mov dword [esi + 0x24], edi
mov edi, dword [esi + 0x18]
mov ebx, dword [edi + 8]
push ebx
push eax
call fcn.100087c2
add esp, 8
sub esp, 4
mov ecx, esp
lea edx, [esi + 0x20]
mov dword [ecx], edx
call eax
mov eax, 2
mov dword [0x102b250c], 0x4fd
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007e95
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, dword [0x102b2510]
add edi, 0x1064
mov dword [0x102b250c], edi
mov dword [0x102b2518], 0
mov byte [0x102b251c], 0
mov dword [0x102b2510], 0x1215
mov dword [0x102b2514], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10007f00
mov dword [0x102b2510], 0x2133
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x102b2514]
add eax, 1
mov dword [0x102b2514], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10007f00
mov dword [0x102b250c], 0x1408
xor eax, eax
mov dword [0x102b2514], 0
mov ecx, dword [0x102b2510]
add ecx, 0xffffd9c5
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0xffffdcb5
mov esi, 0x100
mov edi, dword [0x102b2518]
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 0x2c], edx
mov edx, ebx
mov ebx, dword [ebp - 0x10]
div ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebx + ecx]
add ecx, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ecx, edx
mov eax, ecx
cdq
idiv esi
mov dword [0x102b2518], edx
mov ecx, dword [ebp - 0x28]
mov cl, byte [ebx + ecx]
mov byte [0x102b251c], cl
mov esi, dword [ebp - 0x30]
mov dword [0x102b2510], esi
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x28]
mov byte [ebx + edx], cl
mov esi, dword [0x102b250c]
add esi, 0x2328
mov dword [0x102b250c], esi
mov cl, byte [0x102b251c]
mov esi, dword [0x102b2518]
mov byte [ebx + esi], cl
mov dword [0x102b2510], 0x2f0
mov esi, dword [0x102b2514]
add esi, 1
mov dword [0x102b2514], esi
cmp esi, 0x100
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], esi
jl 0x10007f4e
jmp 0x10007eee
Function at 0x10008018
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x2c87
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, 0x1d5a
mov dword [0x102b2514], 0
mov dword [0x102b2518], 0
mov dword [0x102b2520], 0
mov dword [0x102b250c], 0x1d5a
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
jne 0x100080a0
mov eax, dword [ebp - 0x30]
mov dword [0x102b250c], eax
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edi, 0x100
mov ebx, edx
add ebx, 1
add ecx, 0xfffff6df
add eax, 1
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x102b2514], edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ecx + edx]
add ecx, esi
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x102b2518], edx
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x40]
mov cl, byte [ecx + esi]
mov byte [0x102b251c], cl
mov edi, dword [ebp - 0x3c]
mov dword [0x102b250c], edi
mov edi, dword [ebp - 0x2c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x102b2510], 0x63b
mov cl, byte [0x102b251c]
mov edx, dword [0x102b2518]
mov byte [edi + edx], cl
mov dword [0x102b250c], 0xbac
mov edx, dword [0x102b2514]
movzx edx, byte [edi + edx]
mov ecx, dword [0x102b2518]
movzx ecx, byte [edi + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x102b2520], ecx
mov dword [0x102b250c], 0x1236
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x38]
mov dl, byte [edx + esi]
xor dl, byte [edi + ecx]
mov ecx, dword [ebp - 0x28]
mov byte [ecx + esi], dl
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x44], ebx
je 0x100081a0
mov eax, dword [0x102b2514]
mov dword [ebp - 0x48], eax
mov eax, dword [0x102b2518]
mov ecx, dword [0x102b250c]
mov edx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], esi
jmp 0x100080a0
mov eax, dword [0x102b250c]
add eax, 0xf2d
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
jmp 0x10008090
Function at 0x100082fd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.100081b8
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10008339
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x102b250c], 0xfffff751
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x102b2510], 0xffffe77b
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x10008391
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jmp 0x100083c7
mov eax, dword [ebp - 0x34]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
je 0x1000840b
jmp 0x100083e3
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edx
jmp 0x1000839c
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x1000839c
mov al, byte [ebp - 0x4a]
test al, 1
jne 0x1000843d
jmp 0x10008414
xor eax, eax
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov edx, dword [ebp - 0x54]
add edx, 2
mov esi, dword [ebp - 0x30]
cmp ecx, esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], ecx
jb 0x100083c7
jmp 0x10008391
mov eax, dword [ebp - 0x54]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x34], edi
jmp 0x10008391
Function at 0x100087c2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x102b2510]
add edx, 0xfffff0b4
mov dword [0x102b2510], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [0x102b250c], 0x13ed
mov dword [ebp - 0x30], eax
jmp 0x10008828
lea eax, [ebp - 0x24]
mov dword [0x102b2510], 0x18e3
mov dword [ebp - 0x34], eax
call fcn.10008577
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10008661
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x10008850
jmp 0x10008858
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x1027783e]
mov dl, byte [eax + 0x1027780f]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
je 0x100087f8
jmp 0x10008828
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [0x102b250c]
mov ecx, dword [ebp - 0x38]
add eax, 0xffffe855
mov dword [0x102b250c], eax
mov eax, esp
mov dword [eax + 0xc], 0x40
mov dword [eax + 8], 0x1000
mov dword [eax + 4], 0x6000
mov dword [eax], 0
call ecx
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.10007bbf
xor eax, eax
mov dword [0x102b2510], 0x26a5
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x20], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 8], ecx
mov esi, dword [0x102b2510]
add esi, 0x236
mov dword [0x102b250c], esi
add ecx, 0x189d
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x10008904
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x10008928
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x102b2510], 0x715
mov dword [0x102b250c], 0x266c
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x10008994
mov eax, dword [ebp - 0x13c]
mov cl, byte [eax + 0x1027783e]
mov dl, byte [eax + 0x1027780f]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x13c], eax
je 0x10008a04
jmp 0x10008963
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0x118
mov edi, edx
add edi, esi
add edi, 0xc0
mov esi, dword [edi]
imul edi, eax, 0x118
add edx, edi
add edx, 0x9c
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x355
mov ecx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x10008994
mov dword [0x102b250c], 0x13ed
xor eax, eax
mov dword [ebp - 0x13c], eax
jmp 0x10008963
lea eax, [ebp - 0x12c]
mov dword [0x102b2510], 0x18e3
mov dword [ebp - 0x144], eax
call fcn.10008577
mov dword [esp], eax
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], eax
call fcn.10008661
mov ecx, eax
mov dword [0x102b2524], eax
mov eax, esp
mov edx, dword [ebp - 0x140]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0x118
mov edi, edx
add edi, esi
add edi, 0xc0
mov esi, dword [edi]
imul edi, eax, 0x118
mov ebx, edx
add ebx, edi
add ebx, 0x88
mov edi, dword [ebx]
imul ebx, eax, 0x118
add edx, ebx
add edx, 0x9c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x148]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.10007dfc
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x355
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
jne 0x10008a72
lea eax, [0x1027781d]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov esi, dword [0x102b250c]
add esi, 0xfffffd55
mov dword [0x102b250c], esi
mov dword [0x102b2510], 0x100b
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.10007e95
mov dword [0x102b250c], 0x21fb
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x140]
mov dword [esp + 0xc], edx
call fcn.10008018
xor eax, eax
mov ecx, dword [ebp - 0x148]
add ecx, 0x127d97
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x12f400
mov ecx, dword [ebp - 0x148]
add ecx, 0x73187
mov dword [edx + 8], ecx
mov dword [0x102b2510], 0x149a
mov dword [edx + 0xc], 0x2010
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret