joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007b343
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008f330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10073a84
mov dword [ebp - 0x14], eax
cmp dword [0x1067c334], esi
jne 0x1007b436
push 0x800
push esi
push 0x10006944
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007b3c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007b516
push esi
push esi
push 0x10006944
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007b516
push 0x1000695c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007b516
push eax
call ebx
push 0x10006968
push edi
mov dword [0x1067c334], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006978
push edi
mov dword [0x1067c338], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000698c
push edi
mov dword [0x1067c33c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067c344], eax
test eax, eax
je 0x1007b433
push 0x100069a8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067c340], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007b45b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007b44e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007b470
push 4
pop eax
jmp 0x1007b518
cmp dword [ebp - 0x14], esi
je 0x1007b470
push dword [0x1067c334]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007b455
mov eax, dword [0x1067c340]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007b4ce
cmp dword [0x1067c344], edi
je 0x1007b4ce
push eax
call ebx
push dword [0x1067c344]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007b4ce
test eax, eax
je 0x1007b4ce
call ecx
test eax, eax
je 0x1007b4c3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007b4c3
test byte [ebp - 8], 1
jne 0x1007b4ce
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007b4fe
mov eax, dword [0x1067c338]
cmp eax, edi
je 0x1007b4fb
push eax
call ebx
test eax, eax
je 0x1007b4fb
call eax
mov esi, eax
test esi, esi
je 0x1007b4fb
mov eax, dword [0x1067c33c]
cmp eax, edi
je 0x1007b4fb
push eax
call ebx
test eax, eax
je 0x1007b4fb
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067c334]
call ebx
test eax, eax
je 0x1007b516
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007b518
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0xa2a120
Capabilities:
Encode data using xor

Disassembly:
imul ebx, ebp
mov esi, edx
lea edi, [0xf4e872cf]
mov bh, 0xe
inc edx
sbb edi, esi
mov ebp, 0x3e85397e
movsx ebp, ah
or ch, bl
add edx, 0xca449a79
lea ebx, [0xde874d89]
push edx
or dl, 0x3c
pop eax
mov edi, 0x81935902
test ecx, 0x68ee5d64
sub dl, bh
test bl, dh
xchg ecx, ebx
test edi, edx
je 0xa2a09e
sub edi, eax
xor eax, 0x62b8905d
xor eax, 0x62b8905d
test bl, 0xec
lea esi, [0xfb8f8820]
call 0xa2a120
mov eax, 0x1a5c5334
inc edi
movsx esi, ch
cmp ebx, eax
imul eax, eax
mov edx, 0x637
mov al, 0x93
imul esi, edi, 0x115bfb5c
imul esi, edi, 0xc864b841
add edx, 0x41c
inc ebx
add eax, ebp
sbb eax, 0xb732bdbd
mov ah, dh
sub edx, 0xfffffe2b
mov ecx, edi
mov ah, bl
sub edx, 0x1d6
cmp eax, 0xe24c
jno 0xa2a10c
mov eax, 0x8452ac72
cmp edi, 0xa85d910
mov eax, 0x5c3954db
xchg edi, edi
cmp ecx, eax
and ah, ah
sbb esi, ecx
cmp edx, 0x136
ja 0xa2a0da
pop ecx
mov bl, 0x3d
sbb al, 0x93
xchg eax, esi
mov dh, bh
add ecx, 0x2604c2
mov dl, 0x71
mov edx, ecx
dec eax
add ecx, 0xaf2
mov al, 0xc7
imul ebp, edx, 0x48334dbb
test ebx, 0x8ed9041a
adc ebx, 0xeca6c0e2
dec ebp
test edx, ebx
movzx ebp, cx
jb 0xa2a15e
sub eax, 0x9e159446
movzx edx, dl
adc edx, 0xa9000ce9
xchg esi, edi
mov bh, 0x60
mov ebp, 0
add eax, esi
xor ebp, 0xfff085fb
dec edx
inc esi
add ebp, 0xf8308
dec edi
dec edi
lea esi, [0x26b5a26d]
test dl, dl
add eax, ebx
mov edx, 0x7203
xchg bh, al
xor edx, 0x73c5
mov bh, 0xc3
imul edx, edx, 4
imul edi, ecx, 0xa16f831
mov esi, 0xc665a2bb
sub ebp, edx
lea eax, [0x9b79443e]
test dl, 0x5b
add ebp, 0x717
imul edx, esi
or bh, ch
mov ebx, ebx
lea edx, [0x426d9fde]
movsx esi, dx
xchg dl, ah
lea edx, [0xc618818d]
imul edi, ebp
cmp ebp, 0x412
jne 0xa2a181
mov dl, 0xf7
xchg eax, esi
lea edx, [0xf626d4ac]
lea esi, [0x8c0e64c2]
jmp ecx
Function at 0x401390
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xc
mov eax, dword [0x40d028]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push edi
mov edi, ecx
xor ecx, ecx
lea eax, [esi + 0x16]
jmp 0x4013b0
movzx edx, byte [eax - 2]
mov byte [esp + ecx + 8], dl
movzx edx, byte [eax - 1]
mov byte [esp + ecx + 9], dl
movzx edx, byte [eax]
mov byte [esp + ecx + 0xa], dl
movzx edx, byte [eax + 1]
mov byte [esp + ecx + 0xb], dl
add ecx, 4
add eax, 4
cmp ecx, 8
jb 0x4013b0
mov ecx, dword [esi + 0x14]
shr ecx, 3
and ecx, 0x3f
mov eax, 0x38
cmp ecx, 0x38
jb 0x4013f2
mov eax, 0x78
lea ebp, [esi + 0x5c]
push ebp
sub eax, ecx
push esi
call fcn.004012c0
lea eax, [esp + 8]
push eax
push esi
mov eax, 8
call fcn.004012c0
lea ecx, [edi + 1]
lea eax, [esi + 6]
mov edi, 4
lea esp, [esp]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x401420
push 0x9c
push edi
push esi
call sub.MSVCR90.dll_memset
push 0x40
push edi
push ebp
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x28]
add esp, 0x18
pop edi
mov byte [ebp], 0x80
pop ebp
xor ecx, esp
call fcn.00404120
add esp, 0xc
ret

Function at 0x401fd0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x438
mov eax, dword [0x40d028]
xor eax, esp
mov dword [esp + 0x434], eax
push esi
push edi
push 0x228
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x208
lea ecx, [esp + 0x238]
push 0
push ecx
mov edi, eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4020bc
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x402061
cmp dword [esp + 0x10], edi
je 0x402061
lea ebx, [ebx]
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp dword [esp + 0x10], edi
jne 0x402050
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4020bc
push 0x104
lea edx, [esp + 0x238]
push edx
push 0
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [esp + 0x234]
push eax
lea ecx, [ebx + 0x80]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_1]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.00404120
add esp, 0x438
ret
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00404120
add esp, 0x438
ret
Function at 0x404120
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d028]
jne 0x40412a
repz ret
jmp fcn.0040463e
Function at 0x422937
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419b87
and dword [ebp - 4], 0
cmp dword [0x42ffe0], 0
mov ebx, eax
jne 0x4229e8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x422a99
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x422a99
push eax
call fcn.00419b15
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42ffe0], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42ffe4], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42ffe8], eax
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42fff0], eax
test eax, eax
je 0x4229e8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42ffec], eax
mov eax, dword [0x42ffec]
cmp eax, ebx
je 0x422a40
cmp dword [0x42fff0], ebx
je 0x422a40
push eax
call fcn.00419b90
push dword [0x42fff0]
mov esi, eax
call fcn.00419b90
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422a40
test edi, edi
je 0x422a40
call esi
test eax, eax
je 0x422a37
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x422a37
test byte [ebp - 0xc], 1
jne 0x422a40
or dword [ebp + 0x10], 0x200000
jmp 0x422a79
mov eax, dword [0x42ffe4]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x422a79
mov eax, dword [0x42ffe8]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42ffe0]
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a99
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x422a9b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x78225746
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x47dd38ba
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x949f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0949f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x949f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x949f06a
add dl, dl
jne 0x949f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x949f0dc
xor eax, eax
add dl, dl
jne 0x949f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x949f17d
add dl, dl
jne 0x949f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x949f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x949f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x949f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x949f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x949f075
mov eax, 1
add dl, dl
jne 0x949f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x949f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x949f0e1
sub eax, ebx
mov ebx, 1
jne 0x949f128
mov ecx, 1
add dl, dl
jne 0x949f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x949f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x949f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x949f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x949f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x949f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x949f136
cmp eax, 0x7d00
jae 0x949f16d
cmp eax, 0x500
jb 0x949f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x949f075
cmp eax, 0x7f
ja 0x949f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x949f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x949f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x949f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403d2a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405790
push 0x403f74
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
nop
nop
nop
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0x407df0], 0xffffffff
or dword [0x407df4], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x407dd4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x407dd0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x407dec], eax
call fcn.00403f73
cmp dword [0x407ce0], ebx
jne 0x403dad
push 0x403f70
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00403f5e
push 0x407018
push 0x407014
call sub.MSVCRT.dll__initterm
mov eax, dword [0x407dcc]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x407dc8]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
nop
adc eax, sym.imp.MSVCRT.dll___getmainargs
push 0x407010
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x403e40
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x403e14
cmp al, 0x22
jne 0x403e06
cmp byte [esi], 0x22
jne 0x403e1d
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x403e27
cmp al, 0x20
jbe 0x403e19
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x403e4b
movzx eax, word [ebp - 0x2c]
jmp 0x403e4e
cmp byte [esi], 0x20
jbe 0x403e1d
inc esi
mov dword [ebp - 0x74], esi
jmp 0x403e40
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
nop
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call fcn.00403f52
pop ecx
pop ecx
ret
Function at 0x208d2f1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x2085410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
test eax, eax
jne 0x208d314
push ebx
call dword [0x209e01c]
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [ebp - 0xc], 0x646f632e
mov dword [ebp - 8], 0x65
movzx edi, word [esi + 0x14]
push dword [esi + 0x88]
add edi, 0x18
push esi
add edi, esi
call fcn.02086824
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x208d3bd
movzx edx, word [esi + 6]
xor ecx, ecx
test edx, edx
jle 0x208d36a
lea eax, [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0x208d362
lea eax, [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, dword [edi + 4]
je 0x208d36a
add edi, 0x28
inc ecx
cmp ecx, edx
jl 0x208d34e
cmp ecx, edx
je 0x208d3bd
mov ecx, dword [esi + 0x34]
add ecx, dword [edi + 0xc]
mov edi, 0x2086e30
xor edx, edx
mov eax, dword [ecx + edx*4]
cmp eax, dword [edi + edx*4]
jne 0x208d3bd
inc edx
cmp edx, 4
jne 0x208d37b
xor edx, edx
mov eax, dword [ecx + edx*4 + 0x140]
cmp eax, dword [edi + edx*4]
jne 0x208d3bd
inc edx
cmp edx, 4
jne 0x208d38b
cmp dword [ecx + 0x124], 0
je 0x208d3ad
push 0x208d67c
jmp 0x208d3b2
push 0x208d661
push esi
push ebx
push ecx
call fcn.0208d3ce
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0208ed46
mov esp, ebp
pop ebp
ret
Function at 0x21696e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
xor ebp, ebp
push edi
test ebx, ebx
je 0x2169746
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov dword [esp + 0x14], eax
mov edi, dword [eax + 0x78]
add edi, ebx
cmp dword [edi + 0x18], esi
jbe 0x2169746
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x20]
lea eax, [eax + esi*4]
mov ecx, dword [eax + ebx]
add ecx, ebx
test ecx, 0xffff0000
je 0x2169735
test edx, 0xffff0000
je 0x2169735
push edx
push ecx
call dword [0x100d310c]
mov edx, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
jmp 0x216973c
xor eax, eax
cmp ecx, edx
sete al
test eax, eax
jne 0x216974d
inc esi
cmp esi, dword [edi + 0x18]
jb 0x2169707
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov ebp, dword [eax + ebx]
add ebp, ebx
cmp ebp, edi
jb 0x2169746
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x7c]
add eax, edi
cmp ebp, eax
ja 0x2169746
xor ecx, ecx
mov eax, ebp
cmp byte [ebp], cl
je 0x2169789
lea esp, [esp]
lea eax, [eax + 1]
inc ecx
cmp byte [eax], 0
jne 0x2169780
lea esi, [ecx + 1]
xor edi, edi
test esi, esi
je 0x216979d
push esi
call fcn.021637c0
add esp, 4
mov edi, eax
push esi
push ebp
push edi
call fcn.020db930
add esp, 0xc
mov esi, edi
cmp byte [edi], 0
je 0x21697bb
nop
cmp byte [esi], 0x2e
je 0x21697cd
inc esi
cmp byte [esi], 0
jne 0x21697b0
push edi
xor esi, esi
call fcn.021637b0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov byte [esi], 0
call dword [0x100d31d0]
mov ecx, eax
lea eax, [esi + 1]
push eax
push ecx
call fcn.021696e0
add esp, 8
mov esi, eax
push edi
call fcn.021637b0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x616e00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x501015
lea edi, [esi - 0x100015]
push edi
or ebp, 0xffffffff
jmp 0x616e22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x616e29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x616e18
mov eax, 1
add ebx, ebx
jne 0x616e3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x616e4c
jne 0x616e6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x616e6b
dec eax
add ebx, ebx
jne 0x616e58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x616e30
add ebx, ebx
jne 0x616e67
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x616ebd
xor ecx, ecx
sub eax, 3
jb 0x616e83
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x616ef2
sar eax, 1
mov ebp, eax
jmp 0x616e8e
add ebx, ebx
jne 0x616e8e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x616e5c
inc ecx
add ebx, ebx
jne 0x616e9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x616e5c
add ebx, ebx
jne 0x616ea9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x616e9e
jne 0x616eba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x616e9e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x616edc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x616ece
jmp 0x616e1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x616edc
add edi, ecx
jmp 0x616e1e
pop esi
mov edi, esi
mov ecx, 0x3d1b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x616efa
cmp byte [edi], 0x15
jne 0x616efa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x616eff
lea edi, [esi + 0x211000]
mov eax, dword [edi]
or eax, eax
je 0x616f6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x216000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x216028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x616f2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x216030]
or eax, eax
je 0x616f68
mov dword [ebx], eax
add ebx, 4
jmp 0x616f49
call dword [esi + 0x21602c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x616f9f
cmp al, 0xef
ja 0x616f92
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x616f74
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x616f81
mov ebp, dword [esi + 0x216034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x616fd3
sub esp, 0xffffff80
jmp 0x4629e0