joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4427d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], ebx
cmp edx, dword [ebx + 0x2c]
jbe 0x44280c
push 0x4daaa0
push 0xecb9
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.0042a1d0
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0043b3c0
add esp, 8
test eax, eax
jne 0x442987
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x14], ecx
movzx edi, byte [esi + 6]
mov dword [esp + 0x1c], edi
cmp ax, word [esi + 0x12]
jae 0x4428cf
nop
mov eax, dword [esi + 0x40]
movzx edi, byte [eax + ecx*2]
movzx eax, byte [eax + ecx*2 + 1]
shl edi, 8
or edi, eax
movzx eax, word [esi + 0x14]
and edi, eax
add edi, dword [esi + 0x38]
cmp byte [esi + 5], 0
jne 0x442897
movzx edx, byte [edi]
mov ecx, ebx
movzx eax, byte [edi + 1]
push dword [ebp + 0xc]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
push 1
call fcn.004427d0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x44297d
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.0043f830
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x44297d
mov ecx, dword [esp + 0x14]
movzx eax, word [esi + 0x12]
inc ecx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
cmp ecx, eax
jl 0x442840
mov edi, dword [esp + 0x1c]
cmp byte [esi + 5], 0
jne 0x442910
mov ecx, dword [esi + 0x38]
push dword [ebp + 0xc]
add ecx, edi
push 1
movzx edx, byte [ecx + 8]
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xb]
shl edx, 8
mov ecx, ebx
or edx, eax
call fcn.004427d0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x44297d
jmp 0x44291d
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44291d
movzx eax, word [esi + 0x12]
add dword [ecx], eax
cmp dword [ebp + 8], 0
je 0x442946
push dword [esi + 0x48]
mov ecx, dword [esi + 0x34]
mov edx, esi
call fcn.0043f490
mov ecx, dword [esi + 0x44]
add esp, 4
mov ebx, eax
call fcn.00435d10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x442961
call fcn.00436140
jmp 0x442966
call fcn.00435f90
mov ebx, eax
test ebx, ebx
jne 0x44297d
mov eax, dword [esi + 0x38]
mov ecx, esi
movzx edx, byte [eax + edi]
or edx, 8
call fcn.0043b2a0
mov ecx, dword [esi + 0x44]
call fcn.00435d10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442dd0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov eax, edx
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
push edi
movlpd qword [esp + 0x18], xmm0
cmp dword [esi + 0x3c], 0
jne 0x442e09
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043e140
test eax, eax
jne 0x442fb6
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jmp 0x442e30
movsx ecx, word [esi + 0x4c]
mov edi, dword [esi + ecx*4 + 0x78]
mov bl, byte [edi + 5]
test bl, bl
jne 0x442e44
cmp byte [edi + 2], bl
jne 0x442e51
movzx eax, word [edi + 0x12]
cdq
add dword [esp + 0x10], eax
adc dword [esp + 0x14], edx
test bl, bl
je 0x442f20
lea esp, [esp]
movzx eax, word [esi + 0x4c]
test ax, ax
je 0x442f9e
cwde
mov ecx, dword [esi + eax*4 + 0x78]
test ecx, ecx
je 0x442ee8
mov ecx, dword [ecx + 0x44]
test byte [ecx + 0x18], 0x40
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0x18], ebx
je 0x442eca
dec dword [ebx + 0x78]
mov eax, dword [ebx + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x18]
mov edi, dword [ebx + 0x3c]
mov dword [ebx + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004adf70
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x28]
add esp, 0x10
jmp 0x442ecf
call fcn.00430740
cmp dword [ebx + 0x78], 0
jne 0x442ee8
mov eax, dword [ebx + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x442ee8
mov ecx, ebx
call fcn.00433110
dec word [esi + 0x4c]
xor eax, eax
mov dx, word [esi + 0x4c]
and byte [esi + 0x48], 0xf9
mov word [esi + 0x2c], ax
movsx eax, dx
mov ecx, dword [esi + eax*4 + 0x78]
mov ax, word [esi + eax*2 + 0x4e]
cmp ax, word [ecx + 0x12]
jae 0x442e60
movsx eax, dx
inc word [esi + eax*2 + 0x4e]
movsx ecx, word [esi + 0x4c]
mov edi, dword [esi + ecx*4 + 0x78]
movzx edx, word [esi + ecx*2 + 0x4e]
movzx eax, word [edi + 0x12]
cmp edx, eax
jne 0x442f50
movzx ecx, byte [edi + 6]
add ecx, dword [edi + 0x38]
movzx edx, byte [ecx + 8]
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xb]
jmp 0x442f83
mov eax, dword [edi + 0x40]
movzx ecx, byte [eax + edx*2]
movzx eax, byte [eax + edx*2 + 1]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x14]
and ecx, eax
add ecx, dword [edi + 0x38]
movzx edx, byte [ecx]
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 3]
shl edx, 8
mov ecx, esi
or edx, eax
call fcn.0043e0a0
test eax, eax
je 0x442e30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 4], eax
mov ecx, esi
call fcn.0043e140
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e7e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x4e4738]
xor eax, ebp
mov dword [ebp - 4], eax
sub esp, 0x18
lea ecx, [ebp - 0x670]
call fcn.0049b960
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004aaf60
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x644], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x66c]
test ecx, ecx
cmove ecx, eax
cmp dword [ebp - 0x618], 0
lea eax, [ebp - 0x670]
mov dword [ebp - 0x66c], ecx
push eax
je 0x49e86c
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x49e872
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov ecx, eax
xor edx, edx
test ecx, ecx
lea eax, [ebp - 0x414]
mov ecx, dword [ebp - 4]
cmove eax, edx
xor ecx, ebp
call fcn.004a83d2
mov esp, ebp
pop ebp
ret
Function at 0x4a55b0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c4c12
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4e4738]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x4db224
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea esi, [edi + 0x10]
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004a6140
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.004a68f0
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x4e9334]
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], 0
sub esp, 8
mov byte [ebp - 4], 3
mov ecx, esi
push dword [ebp + 8]
call fcn.004a6460
test eax, eax
jne 0x4a570a
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x4a5702
or eax, 4
push 0
push eax
call fcn.00407830
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a6690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c3de8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4e4738]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4e4738]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x4a67e4
cmp byte [ebx + 0x45], 0
je 0x4a67e4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4a66f0
xor al, al
jmp 0x4a67e6
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x4a6730
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4a6771
dec eax
je 0x4a6775
sub eax, 2
je 0x4a67cb
xor bl, bl
jmp 0x4a67cd
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x4a67ac
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004a9a4f
add esp, 0x10
cmp esi, eax
jne 0x4a676d
cmp byte [ebx + 0x45], 0
je 0x4a67cb
test esi, esi
jne 0x4a6730
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00420a90
jmp 0x4a6730
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x4a67e0
push dword [esp + 0x18]
call fcn.00427430
add esp, 4
mov al, bl
jmp 0x4a67e6
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a83d2
mov esp, ebp
pop ebp
ret
Function at 0x4bc956
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e4738]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004adb8b
mov dword [ebp - 0x14], eax
cmp dword [0x4e8a70], esi
jne 0x4bca49
push 0x800
push esi
push 0x4cbcb4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4bc9d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4bcb29
push esi
push esi
push 0x4cbcb4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4bcb29
push 0x4cbccc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4bcb29
push eax
call ebx
push 0x4cbcd8
push edi
mov dword [0x4e8a70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4e8a74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4e8a78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4e8a80], eax
test eax, eax
je 0x4bca46
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4e8a7c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4bca6e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4bca61
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4bca83
push 4
pop eax
jmp 0x4bcb2b
cmp dword [ebp - 0x14], esi
je 0x4bca83
push dword [0x4e8a70]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4bca68
mov eax, dword [0x4e8a7c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4bcae1
cmp dword [0x4e8a80], edi
je 0x4bcae1
push eax
call ebx
push dword [0x4e8a80]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4bcae1
test eax, eax
je 0x4bcae1
call ecx
test eax, eax
je 0x4bcad6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4bcad6
test byte [ebp - 8], 1
jne 0x4bcae1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4bcb11
mov eax, dword [0x4e8a74]
cmp eax, edi
je 0x4bcb0e
push eax
call ebx
test eax, eax
je 0x4bcb0e
call eax
mov esi, eax
test esi, esi
je 0x4bcb0e
mov eax, dword [0x4e8a78]
cmp eax, edi
je 0x4bcb0e
push eax
call ebx
test eax, eax
je 0x4bcb0e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4e8a70]
call ebx
test eax, eax
je 0x4bcb29
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4bcb2b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a83d2
mov esp, ebp
pop ebp
ret
Function at 0x402614
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x402ad8
call fcn.004028d8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x402674
cmp eax, 0xffffffff
je 0x402674
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40266d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40266d
cmp edx, 0x10000000
jae 0x40266d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40266a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4026e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40271e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x402716
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x402720
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x402706
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4027f0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402821
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x402821
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x402821
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x183759
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, 0x400
push esi
call fcn.00195455
mov ebx, eax
pop ecx
test ebx, ebx
je 0x1837f7
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push eax
call fcn.001873d0
add esp, 0xc
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.001874fb
pop ecx
pop ecx
test eax, eax
jne 0x1837a1
push ebx
call fcn.00195378
jmp 0x1837f6
push dword [ebp + 0x10]
push ebx
call fcn.00195ee8
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
je 0x1837e0
test esi, esi
je 0x1837e0
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0018749e
add esp, 4
push eax
push 1
lea eax, [ebp - 0x14]
call fcn.001874a9
push eax
call fcn.00196061
push esi
call fcn.0019615a
add esp, 0x14
jmp 0x183799
push ebx
call fcn.00195378
pop ecx
call dword [0x74ab715c]
push eax
push 8
call fcn.00182a97
pop ecx
pop ecx
pop esi
pop ebx
leave
ret

Function at 0x183fa9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea ebx, [edi + 4]
push esi
mov esi, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ebx
cmp ebx, dword [ebp + 0xc]
jbe 0x183fc4
xor eax, eax
jmp 0x183ffc
call fcn.001832ce
mov dword [esi], eax
add esi, 4
xor ecx, ecx
test edi, edi
jbe 0x183ffa
mov eax, dword [ebp + 8]
sub eax, esi
mov dword [ebp + 0xc], eax
mov ebx, dword [ebp - 4]
mov edx, ecx
and edx, 3
mov dl, byte [edx + ebx]
mov ebx, dword [ebp + 0xc]
lea eax, [ecx + esi]
xor dl, byte [ebx + eax]
inc ecx
mov byte [eax], dl
cmp ecx, edi
jb 0x183fdc
mov ebx, dword [ebp - 8]
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x184000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, eax
lea eax, [edi - 4]
mov esi, ecx
cmp eax, dword [ebp + 0xc]
jbe 0x184015
xor eax, eax
jmp 0x184040
mov eax, esi
add esi, 4
sub edi, 4
push 0
pop edx
je 0x18403e
sub esi, dword [ebp + 8]
push ebx
mov ecx, dword [ebp + 8]
mov ebx, edx
and ebx, 3
mov bl, byte [ebx + eax]
add ecx, edx
xor bl, byte [esi + ecx]
inc edx
mov byte [ecx], bl
cmp edx, edi
jb 0x184026
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x184872
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
mov esi, eax
cmp dword [0x74ac7618], edi
jne 0x184894
push 0x80004
call fcn.00195455
pop ecx
mov dword [0x74ac7618], eax
push dword [esi]
call fcn.001a3ee6
mov ecx, dword [0x74ac7618]
mov dword [ecx], eax
mov ebx, dword [esi + 4]
cmp ebx, dword [ebp + 8]
jbe 0x1848d3
mov ebx, dword [ebp + 8]
jmp 0x1848d3
push dword [esi + 8]
mov eax, dword [0x74ac7618]
push ebx
lea eax, [eax + edi + 4]
push 1
push eax
call fcn.0019680c
add esp, 0x10
test eax, eax
je 0x1848d9
add edi, eax
sub ebx, eax
sub dword [esi + 4], eax
test ebx, ebx
ja 0x1848b0
jmp 0x1848dd
and dword [esi + 4], 0
push 8
add edi, 4
push edi
push dword [0x74ac7618]
call fcn.00181ecf
add esp, 0xc
call fcn.001848fb
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x189692
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.00189db2
mov dword [ebp - 8], eax
mov eax, 1
test eax, eax
je 0x1896f0
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x1896e5
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x40
jb 0x1896e5
cmp dword [ebp - 4], 0x400
jae 0x1896e5
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
jne 0x1896e5
jmp 0x1896f0
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
jmp 0x1896a0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1899d2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 6]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x189a59
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
je 0x189a4e
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x28
mov dword [ebp - 0x10], edx
jmp 0x1899f5
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x189e02
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push edi
mov byte [ebp - 0x30], 0x6b
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x6c
mov byte [ebp - 0x2a], 0x33
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x4c
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x62
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x79
mov byte [ebp - 9], 0x45
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x41
mov byte [ebp - 6], 0
mov byte [ebp - 0x50], 0x56
mov byte [ebp - 0x4f], 0x69
mov byte [ebp - 0x4e], 0x72
mov byte [ebp - 0x4d], 0x74
mov byte [ebp - 0x4c], 0x75
mov byte [ebp - 0x4b], 0x61
mov byte [ebp - 0x4a], 0x6c
mov byte [ebp - 0x49], 0x41
mov byte [ebp - 0x48], 0x6c
mov byte [ebp - 0x47], 0x6c
mov byte [ebp - 0x46], 0x6f
mov byte [ebp - 0x45], 0x63
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x40], 0x56
mov byte [ebp - 0x3f], 0x69
mov byte [ebp - 0x3e], 0x72
mov byte [ebp - 0x3d], 0x74
mov byte [ebp - 0x3c], 0x75
mov byte [ebp - 0x3b], 0x61
mov byte [ebp - 0x3a], 0x6c
mov byte [ebp - 0x39], 0x50
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x6f
mov byte [ebp - 0x36], 0x74
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x34], 0x63
mov byte [ebp - 0x33], 0x74
mov byte [ebp - 0x32], 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
call edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
lea edx, [ebp - 0x50]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
call edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
call edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
lea edi, [ebp - 0x30]
xor al, al
mov ecx, 9
rep stosb byte es:[edi], al
lea edi, [ebp - 0x24]
xor al, al
mov ecx, 0xd
rep stosb byte es:[edi], al
lea edi, [ebp - 0x14]
xor al, al
mov ecx, 0xf
rep stosb byte es:[edi], al
lea edi, [ebp - 0x50]
xor al, al
mov ecx, 0xd
rep stosb byte es:[edi], al
lea edi, [ebp - 0x40]
xor al, al
mov ecx, 0xf
rep stosb byte es:[edi], al
pop edi
mov esp, ebp
pop ebp
ret