joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59908e
Capabilities:
Encode data using xor

Disassembly:
jge 0x5990d5
fld xword [ecx - 0x51]
pushal
adc esp, edx
cmp ebx, dword [eax + 0x2e]
sub ebx, ecx
push ebp
cdq
lodsd eax, dword [esi]
mov ebp, 0x6d3e0aae
mov dword [esi - 0x52], ecx
into
cmp ecx, dword [edi + 0x238eaefe]
xor ah, cl
sbb edx, dword [edx + 0x17]
mov byte [edx + 0x174d6b71], 0x38
retf 0x2609
invalid
jnp 0x5990d9
jge 0x599055
cmpsd dword [esi], dword es:[edi]
pushal
mov edi, 0xd3f640dd
dec ecx
adc al, byte [ecx + 0x39]
dec eax
invalid
in eax, 0xcb
sbb al, byte [edx - 0x40]
test dl, 0x7b
mov al, byte [0xc87498f0]
rol ecx, cl
ficom word [esi + ebx]
std
dec edx
mov byte [esi], ch
push ds
retf
arpl word [esi], ax
int1
inc ebx
pop esi
in al, dx
test byte [ebx - 0x6a], 0x19
jle 0x599070
jg 0x59912e
in al, 0xed
insd dword es:[edi], dx
in al, dx
lahf
pop edi
jo 0x5990aa
shl byte [edx], 0xf2
sub eax, 0x17411bcf
pop ebx
std
mov ebp, dword [edi + 0x1f]
pop ebp
jo 0x5990d9
dec ecx
and eax, dword [edi + 0x45]
btr dword [ebx], edx
jne 0x5990e5
lea esi, [ebx + 0x6d504bbd]
mov ebp, 0x43508b24
test dword [0xcf5810aa], eax
add dword [esi - 0x41], esi
int 0x78
pop ebx
out dx, al
iretd
ret
and eax, 0x197a2bae
inc esp
je 0x5991b2
mov byte [esi - 0x80], dl
sbb eax, 0x3c7df86e
pop ds
das
test al, 0x3a
clc
or byte [edx - 0x3e75204], dl
hlt
jl 0x599128
xchg esp, eax
xor al, 0xb6
clc
lea eax, [ebx + 0x1e0f571a]
and bh, byte [eax]
mov edx, 0x591f7682
loope 0x599193
adc edx, 0xffffffe9
outsd dx, dword [esi]
invalid
mov dword [0x54649a4b], eax
push ebx
inc esp
outsd dx, dword [esi]
das
sar dword [ebx - 0x17d5a3b1], cl
or byte [ebx + 0x79], 0xbd
insb byte es:[edi], dx
xor al, 0x61
xchg ebp, eax
mov dl, 0xc2
salc
mov bh, 0xc6
js 0x599206
pop ebp
mov bl, 4
mov esp, 0xe5d71c50
sbb byte [ebp - 0x3a5f8e76], ch
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
wait
fsubr dword [esi]
mov esp, 0xbc8ba334
xor eax, 0x94dfcddd
and ecx, dword [esi - 0x22]
mov ebp, 0x610d2f2a
add eax, 0x9f4c346f
test eax, 0xde438ce6
jae 0x599192
mov ebp, esp
in al, dx
sbb ah, byte [ebx + 0x12]
adc byte [ebp + 0x1d3b00d], ah
push ecx
aam 0x13
mov ch, 0x98
rol byte [esi + 0x5a93562b], 0xec
adc ecx, dword [ecx + edi + 0x33]
cmp dh, bl
inc esi
xlatb
xlatb
mov esp, 0xd428f44b
xor bl, byte [esi - 0x4383a7a0]
outsb dx, byte [esi]
add ebx, edi
sub dword [edi - 0xf], edi
outsd dx, dword [esi]
xchg esp, eax
push cs
cmp dword [edx + 0x28769a58], esi
sti
ljmp 0xae15
Function at 0x5cfe30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edx, 0
mov dword [ebp - 0x28], 0x90cccc00
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov ecx, dword [eax + edi + 0x78]
mov dword [ebp - 0x18], ecx
mov edx, dword [eax + edi + 0x7c]
mov dword [ebp - 0x14], edx
test al, 0xa8
sbb ah, 0x93
push ebx
rcl ebx, 3
or ebx, 0xa8cc5bac
bswap ebx
cmp ebx, 0xffb9bdcc
or ebx, 0xe23c932a
neg ecx
mov edx, 0xebb9a8cc
cmp edx, ebx
shrd ebx, ecx, 1
sbb ecx, dword [ebp - 4]
xor ecx, 0x2a11ebb9
bswap ecx
cmp sp, cx
btc eax, esi
pop eax
mov ebx, dword [ebp - 0x10]
lea esi, [esi + 2]
add ebx, dword [ebp - 0x14]
shl ebx, cl
test ebx, 0xa8cc5bac
setne al
cmp edx, 0xe23c932a
btc dx, 0x3c
sbb ebx, 0xa8cc5bac
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + edi + 0x1c]
add eax, edi
mov dword [ebp - 0x20], eax
test al, 0xa8
sbb ah, 0x93
push ebx
rcl ebx, 3
or ebx, 0xa8cc5bac
bswap ebx
cmp ebx, 0xffb9bdcc
or ebx, 0xe23c932a
neg ecx
mov edx, 0xebb9a8cc
cmp edx, ebx
shrd ebx, ecx, 1
sbb ecx, dword [ebp - 4]
xor ecx, 0x2a11ebb9
bswap ecx
cmp sp, cx
btc eax, esi
pop eax
mov ebx, dword [ebp - 0x10]
lea esi, [esi + 2]
add ebx, dword [ebp - 0x14]
shl ebx, cl
test ebx, 0xa8cc5bac
setne al
cmp edx, 0xe23c932a
btc dx, 0x3c
sbb ebx, 0xa8cc5bac
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + edi + 0x24]
add eax, edi
mov dword [ebp - 0x1c], eax
test al, 0xa8
sbb ah, 0x93
push ebx
rcl ebx, 3
or ebx, 0xa8cc5bac
bswap ebx
cmp ebx, 0xffb9bdcc
or ebx, 0xe23c932a
neg ecx
mov edx, 0xebb9a8cc
cmp edx, ebx
shrd ebx, ecx, 1
sbb ecx, dword [ebp - 4]
xor ecx, 0x2a11ebb9
bswap ecx
cmp sp, cx
btc eax, esi
pop eax
mov ebx, dword [ebp - 0x10]
lea esi, [esi + 2]
add ebx, dword [ebp - 0x14]
shl ebx, cl
test ebx, 0xa8cc5bac
setne al
cmp edx, 0xe23c932a
btc dx, 0x3c
sbb ebx, 0xa8cc5bac
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + edi + 0x20]
add eax, edi
mov dword [ebp - 0xc], eax
test al, 0xa8
sbb ah, 0x93
push ebx
rcl ebx, 3
or ebx, 0xa8cc5bac
bswap ebx
cmp ebx, 0xffb9bdcc
or ebx, 0xe23c932a
neg ecx
mov edx, 0xebb9a8cc
cmp edx, ebx
shrd ebx, ecx, 1
sbb ecx, dword [ebp - 4]
xor ecx, 0x2a11ebb9
bswap ecx
cmp sp, cx
btc eax, esi
pop eax
mov ebx, dword [ebp - 0x10]
lea esi, [esi + 2]
add ebx, dword [ebp - 0x14]
shl ebx, cl
test ebx, 0xa8cc5bac
setne al
cmp edx, 0xe23c932a
btc dx, 0x3c
sbb ebx, 0xa8cc5bac
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], 0
mov ecx, dword [eax + edi + 0x14]
lea eax, [eax + edi + 0x14]
test ecx, ecx
mov dword [ebp - 0x14], eax
jbe 0x5d032f
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
jmp 0x5d001d
Function at 0x61494e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a770
push 0x6147a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x461d298], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x461d294], ecx
shl ecx, 8
add ecx, edx
mov dword [0x461d290], ecx
shr eax, 0x10
mov dword [0x461d28c], eax
xor esi, esi
push esi
call fcn.006158f9
pop ecx
test eax, eax
jne 0x61493c
push 0x1c
call fcn.006149eb
pop ecx
mov dword [ebp - 4], esi
call fcn.006155d9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x461d7d4], eax
add al, 0xe8
push ebx
or eax, dword [eax]
add byte [ebx + 0x461d264], ah
call fcn.0061525a
call fcn.006151a1
call fcn.00614ec3
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00615149
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x614989
movzx eax, word [ebp - 0x2c]
jmp 0x61498c
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00614ef0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.00614fc5
pop ecx
pop ecx
ret
Function at 0x407522
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x403650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x407540
push eax
call dword [fcn.00403020]
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx eax, word [ebx + 0x14]
push dword [ebx + 0x88]
lea eax, [eax + ebx + 0x18]
push ebx
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], eax
call fcn.00404aa7
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
je 0x407604
movzx eax, word [ebx + 6]
and dword [ebp - 0x14], 0
test eax, eax
push esi
push edi
jle 0x4075af
mov edi, dword [ebp - 0x10]
push 2
pop ecx
lea esi, [ebp - 0xc]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x4075af
add dword [ebp - 0x10], 0x28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x407594
cmp dword [ebp - 0x14], eax
je 0x407602
mov eax, dword [ebp - 0x10]
mov edx, dword [ebx + 0x34]
add edx, dword [eax + 0xc]
push 4
pop ecx
mov edi, 0x404f88
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x407602
push 4
pop ecx
mov edi, 0x404f88
lea esi, [edx + 0x140]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x407602
cmp dword [edx + 0x124], eax
je 0x4075f0
push 0x407324
jmp 0x4075f5
push 0x40750a
push ebx
push dword [ebp - 0x18]
push edx
call fcn.004070fb
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004085aa
leave
ret

Function at 0x418c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
test esi, esi
je 0x418c7f
mov eax, dword [esi + 0x3c]
push ebx
push edi
mov edi, dword [eax + esi + 0x78]
add edi, esi
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x418c78
mov edi, edi
mov ecx, dword [edi + 0x20]
lea edx, [ecx + ebx*4]
mov eax, dword [edx + esi]
mov ecx, dword [esp + 0x18]
add eax, esi
push ecx
push eax
call dword [0x1000707c]
test eax, eax
jne 0x418c70
mov edx, dword [edi + 0x24]
lea eax, [edx + ebx*2]
movzx ecx, word [eax + esi]
mov edx, dword [edi + 0x1c]
lea eax, [edx + ecx*4]
mov ebp, dword [eax + esi]
add ebp, esi
add ebx, 1
cmp ebx, dword [edi + 0x18]
jb 0x418c40
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
ret
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x419e60
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, dword [edi + 0x3c]
add esi, edi
lea eax, [esi + 0x50]
push 0x40
mov dword [esp + 0x20], eax
mov eax, dword [eax]
push 0x1000
push eax
push 0
mov dword [esp + 0x20], esi
call dword [0x10007020]
mov ebp, dword [esi + 0x54]
mov ebx, eax
mov eax, dword [0x100b8010]
test eax, eax
jne 0x419eb7
push 0x100070f8
push 0x100070ec
call dword [0x1000708c]
push eax
call dword [0x100070a4]
mov dword [0x100b8010], eax
push ebp
push edi
push ebx
call eax
movzx ecx, word [esi + 0x14]
mov ebp, dword [esp + 0x1c]
add esp, 0xc
cmp word [ebp + 6], 0
lea esi, [esi + ecx + 0x18]
mov dword [esp + 0x18], 0
jbe 0x419f80
add esi, 0x10
mov edi, dword [esi - 4]
mov eax, dword [0x100b8014]
mov edx, dword [esi]
mov ebp, dword [esi - 8]
add edi, ebx
test eax, eax
mov dword [esp + 0x14], edx
jne 0x419f14
push 0x10007110
push 0x10007100
call dword [0x1000708c]
push eax
call dword [0x100070a4]
mov dword [0x100b8014], eax
push ebp
push edi
call eax
mov eax, dword [esp + 0x14]
cmp ebp, eax
mov dword [esp + 0x14], ebp
jl 0x419f28
mov dword [esp + 0x14], eax
mov ebp, dword [esi + 4]
mov eax, dword [0x100b8010]
add ebp, dword [esp + 0x24]
test eax, eax
jne 0x419f54
push 0x100070f8
push 0x100070ec
call dword [0x1000708c]
push eax
call dword [0x100070a4]
mov dword [0x100b8010], eax
mov ecx, dword [esp + 0x14]
push ecx
push ebp
push edi
call eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
movzx ecx, word [edx + 6]
add eax, 1
add esp, 0xc
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x419ee1
mov ebp, edx
mov eax, dword [ebp + 0xa4]
mov edi, dword [ebp + 0xa0]
mov esi, ebx
sub esi, dword [ebp + 0x34]
add edi, ebx
test eax, eax
mov dword [esp + 0x18], eax
mov edx, edi
jle 0x419fdc
lea ecx, [ecx]
mov eax, dword [edx + 4]
sub eax, 8
shr eax, 1
test eax, eax
lea ecx, [edx + 8]
jle 0x419fd2
mov dword [esp + 0x24], eax
movzx eax, word [ecx]
test eax, 0xf000
je 0x419fc8
and eax, 0xfff
add eax, dword [edx]
add eax, ebx
add dword [eax], esi
add ecx, 2
sub dword [esp + 0x24], 1
jne 0x419fb3
mov edx, ecx
sub ecx, edi
cmp ecx, dword [esp + 0x18]
jl 0x419fa0
mov edi, dword [ebp + 0x80]
mov eax, dword [edi + ebx + 0xc]
add edi, ebx
test eax, eax
je 0x41a041
lea esp, [esp]
add eax, ebx
push eax
call dword [0x10007050]
cmp dword [edi + 4], 0
mov ebp, eax
jne 0x41a006
mov esi, dword [edi + 0x10]
jmp 0x41a008
mov esi, dword [edi]
add esi, ebx
cmp dword [esi], 0
je 0x41a033
nop
mov eax, dword [esi]
test eax, eax
jns 0x41a01d
and eax, 0xffff
jmp 0x41a021
lea eax, [eax + ebx + 2]
push eax
push ebp
call dword [0x100070a4]
mov dword [esi], eax
add esi, 4
cmp dword [esi], 0
jne 0x41a010
mov eax, dword [edi + 0x20]
add edi, 0x14
test eax, eax
jne 0x419ff0
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
push eax
push ebx
call dword [0x10007094]
push eax
call dword [0x10007098]
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x41a072
lea esi, [eax + ebx]
test esi, esi
je 0x41a072
push 0
push 1
push ebx
call esi
push 0
push 2
push ebx
call esi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x41d160
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 1
push 0x10007e80
push 0x10007e90
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100b8224], eax
push 0x10007ea4
push 0x10007eb4
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100b8220], eax
push 0x10007ec8
push 0x10007edc
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100b821c], eax
push 0x10007ef0
push 0x10007efc
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100b8218], eax
push 0x10007f10
push 0x10007f20
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100b8258], eax
push 0x10007f3c
push 0x10007f4c
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100b8254], eax
push 0
call dword [0x1000709c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x6b
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0
jmp 0x41d281
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x20], edx
jge 0x41d2e6
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x28
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
push 8
lea ecx, [ebp - 0x2c]
push ecx
call dword [0x100b8224]
push 8
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [0x100b8220]
push 8
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [0x100b821c]
cmp eax, 8
jne 0x41d2e4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call fcn.0041c1c0
mov dword [ebp - 8], eax
jmp 0x41d2e6
jmp 0x41d278
mov esp, ebp
pop ebp
ret
Function at 0x438ea0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x10089f84
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.0043e8a0
mov dword [esi], eax
mov ecx, 0x20
mov dword [esi + 4], ebx
add esp, 8
mov byte [eax], bl
mov eax, 1
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xac], ecx
push 0x10087813
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0x10000
mov dword [esp + 0x24], 0x10089ef4
mov dword [esp + 0x28], 0x20000
mov dword [esp + 0x2c], 0x10089ee4
mov dword [esp + 0x30], 0x100000
mov dword [esp + 0x34], 0x10089ed8
mov dword [esp + 0x38], 0x40000
mov dword [esp + 0x3c], 0x10089ecc
mov dword [esp + 0x40], 0x80000
mov dword [esp + 0x44], 0x10089ec0
mov dword [esp + 0x48], 0x80000000
mov dword [esp + 0x4c], 0x10089eb0
mov dword [esp + 0x50], 0x40000000
mov dword [esp + 0x54], 0x10089ea0
mov dword [esp + 0x58], 0x20000000
mov dword [esp + 0x5c], 0x10089e90
mov dword [esp + 0x60], 0x10000000
mov dword [esp + 0x64], 0x10089e84
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x10089e74
mov dword [esp + 0x70], 0x80
mov dword [esp + 0x74], 0x10089e5c
mov dword [esp + 0x78], 8
mov dword [esp + 0x7c], 0x10089e4c
mov dword [esp + 0x80], 2
mov dword [esp + 0x84], 0x10089e3c
mov dword [esp + 0x88], 0x100
mov dword [esp + 0x8c], 0x10089e24
mov dword [esp + 0x90], 0x10
mov dword [esp + 0x94], 0x10089e14
mov dword [esp + 0x98], 4
mov dword [esp + 0x9c], 0x10089e00
mov dword [esp + 0xa4], 0x10089df0
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], 0x10089ddc
mov dword [esp + 0xb4], 0x10089dcc
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00424750
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.00424750
cmp ebp, ebx
je 0x43905f
push ebp
call fcn.0043e950
add esp, 4
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test dword [esp + 0x120], eax
je 0x439094
not eax
and dword [esp + 0x120], eax
cmp dword [edi + 8], ebx
je 0x439088
push 0x10089dc8
mov ecx, esi
call fcn.00424510
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.00424510
add ebp, 1
cmp ebp, 0x13
jb 0x439061
cmp dword [edi + 8], ebx
jne 0x4390e3
push 0x10089dc0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00424750
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.00424750
cmp ebp, ebx
je 0x43911f
push ebp
call fcn.0043e950
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
mov eax, dword [esp + 0x120]
cmp eax, ebx
je 0x43911f
push eax
lea ecx, [esp + 0x20]
push 0x10089db8
push ecx
call dword [0x1008725c]
add esp, 0xc
cmp dword [edi + 8], ebx
je 0x439113
push 0x10089dc8
mov ecx, esi
call fcn.00424510
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00424510
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
Function at 0x439670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x17c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x10089f84
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.0043e8a0
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
push 0x10087813
lea ecx, [esp + 0x14]
mov byte [eax], bl
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x1008a16c
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], 0x1008a154
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], 0x1008a140
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], 0x1008a128
mov dword [esp + 0x40], 0x800
mov dword [esp + 0x44], 0x1008a114
mov dword [esp + 0x48], 8
mov dword [esp + 0x4c], 0x1008a0f4
mov dword [esp + 0x50], 0x10
mov dword [esp + 0x54], 0x1008a0d8
mov dword [esp + 0x58], 0x20
mov dword [esp + 0x5c], 0x1008a0b8
mov dword [esp + 0x60], 0x80
mov dword [esp + 0x64], 0x1008a09c
mov dword [esp + 0x68], 0x100
mov dword [esp + 0x6c], 0x1008a080
mov dword [esp + 0x70], 0x200
mov dword [esp + 0x74], 0x1008a068
mov dword [esp + 0x78], 0x1000
mov dword [esp + 0x7c], 0x1008a050
mov dword [esp + 0x80], 0x2000
mov dword [esp + 0x84], 0x1008a038
mov dword [esp + 0x88], 0x4000
mov dword [esp + 0x8c], 0x1008a01c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00424750
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.00424750
cmp ebp, ebx
je 0x4397c7
push ebp
call fcn.0043e950
add esp, 4
mov ebx, dword [esp + 0x190]
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test ebx, eax
je 0x4397fa
not eax
and ebx, eax
cmp dword [edi + 8], 0
je 0x4397ee
push 0x10089dc8
mov ecx, esi
call fcn.00424510
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.00424510
add ebp, 1
cmp ebp, 0xe
jb 0x4397d0
xor ebp, ebp
cmp dword [edi + 8], ebp
jne 0x43984b
push 0x10089dc0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.00424750
mov ebx, dword [esp + 0x10]
push ebx
mov ecx, esi
call fcn.00424750
cmp ebx, ebp
je 0x439886
push ebx
call fcn.0043e950
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4
cmp ebx, ebp
je 0x439886
push ebx
lea ecx, [esp + 0x90]
push 0x10089db8
push ecx
call dword [0x1008725c]
add esp, 0xc
cmp dword [edi + 8], ebp
je 0x439877
push 0x10089dc8
mov ecx, esi
call fcn.00424510
lea edx, [esp + 0x8c]
push edx
mov ecx, esi
call fcn.00424510
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4
Function at 0x446d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
cmp ebx, ebp
push esi
push edi
mov dword [esp + 0x10], ebp
je 0x446dbe
mov eax, dword [ebx + 0x3c]
mov esi, dword [eax + ebx + 0x78]
add eax, ebx
add esi, ebx
cmp dword [esi + 0x18], ebp
mov dword [esp + 0x18], eax
jbe 0x446dbe
jmp 0x446d50
mov eax, dword [esi + 0x20]
mov edi, dword [esp + 0x1c]
lea ecx, [eax + ebp*4]
mov eax, dword [ecx + ebx]
add eax, ebx
test eax, 0xffff0000
je 0x446d7f
test edi, 0xffff0000
je 0x446d7f
push edi
push eax
call dword [0x100871b4]
neg eax
sbb eax, eax
add eax, 1
jmp 0x446d88
xor edx, edx
cmp eax, edi
sete dl
mov eax, edx
test eax, eax
je 0x446db6
mov eax, dword [esi + 0x24]
lea ecx, [eax + ebp*2]
movzx edx, word [ecx + ebx]
mov eax, dword [esi + 0x1c]
lea ecx, [eax + edx*4]
mov edi, dword [ecx + ebx]
add edi, ebx
cmp edi, esi
jb 0x446db2
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x7c]
add eax, esi
cmp edi, eax
jbe 0x446dc8
mov dword [esp + 0x10], edi
add ebp, 1
cmp ebp, dword [esi + 0x18]
jb 0x446d50
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor ecx, ecx
cmp byte [edi], cl
mov eax, edi
je 0x446ddb
add eax, 1
add ecx, 1
cmp byte [eax], 0
jne 0x446dd0
lea ebx, [ecx + 1]
xor esi, esi
test ebx, ebx
jbe 0x446def
push ebx
call fcn.0043e800
add esp, 4
mov esi, eax
push ebx
push edi
push esi
call fcn.0043e780
mov al, byte [esi]
add esp, 0xc
test al, al
mov edi, esi
je 0x446e10
cmp al, 0x2e
je 0x446e21
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x446e02
push esi
call fcn.0043e950
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
call dword [0x100870d8]
add edi, 1
push edi
push eax
call fcn.00446d20
push esi
mov edi, eax
call fcn.0043e950
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x466770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov dx, word [eax]
shr dx, 1
push esi
movzx esi, dx
xor ecx, ecx
test si, si
push edi
mov word [esp + 8], 0x5c
mov word [esp + 0xa], 0x2f
mov word [esp + 0xc], 0x3a
mov word [esp + 0xe], 0x2a
mov word [esp + 0x10], 0x3f
mov word [esp + 0x12], 0x22
mov word [esp + 0x14], 0x3c
mov word [esp + 0x16], 0x3e
mov word [esp + 0x18], 0x7c
jbe 0x4667f7
mov edi, dword [eax + 4]
jmp 0x4667d0
movzx edx, cx
movzx edx, word [edi + edx*2]
xor eax, eax
lea esp, [esp]
cmp dx, word [esp + eax*2 + 8]
je 0x466802
add eax, 1
cmp eax, 9
jb 0x4667e0
add ecx, 1
cmp cx, si
jb 0x4667d0
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x4013b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4013c9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401406
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401402
nop word [eax + eax]
cmp esi, edx
jae 0x401406
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4013f0
cmp esi, edx
jb 0x40140d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret