joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f7818
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov bx, word [edi + 0x18]
mov esi, dword [edi + 0x10]
mov dword [ebp - 4], eax
movzx eax, bx
mov dword [ebp - 0xc], eax
add eax, esi
xor ecx, ecx
xor eax, esi
test eax, 0xfffff000
push ecx
mov word [ebp - 0x14], 0x38
mov dword [ebp - 0x10], edi
push esi
jne 0x4f7868
call fcn.004f82c1
push dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call fcn.004f8167
movzx eax, ax
jmp 0x4f78df
call fcn.004f82c1
mov ecx, eax
and ecx, 0xfff
mov edi, 0x1000
sub edi, ecx
movzx ecx, di
push ecx
push dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push eax
call fcn.004f8167
movzx eax, ax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
add esi, eax
sub ebx, edi
test bx, bx
jbe 0x4f78d9
xor eax, eax
push eax
push esi
call fcn.004f82c1
cmp bx, 0x1000
mov dword [ebp - 0xc], 0x1000
ja 0x4f78bb
mov dword [ebp - 0xc], ebx
movzx edi, word [ebp - 0xc]
push edi
push dword [ebp - 4]
push eax
call fcn.004f8167
add dword [ebp - 4], edi
movzx eax, ax
add dword [ebp - 8], eax
add esi, edi
sub ebx, dword [ebp - 0xc]
jmp 0x4f789c
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx]
mov edx, eax
sub edx, ecx
neg edx
sbb edx, edx
and edx, 0xc0000001
mov dword [edi + 8], edx
mov dword [edi + 0x1c], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call fcn.004f7eb6
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4f8fdc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
push esi
xor esi, esi
test ecx, ecx
push edi
jbe 0x4f9010
mov edx, dword [eax + 0xc]
cmp dword [ebp + 0x10], edx
jb 0x4f9008
mov edi, dword [eax + 0x10]
add edi, edx
cmp dword [ebp + 0x10], edi
jb 0x4f9012
add eax, 0x28
inc esi
cmp esi, ecx
jb 0x4f8ff6
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4f9612
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
not eax
jbe 0x4f9640
mov edx, dword [ebp + 0xc]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x43a5f8]
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x4f9621
not eax
pop ebp
ret 0xc

Function at 0x50861e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
xor ecx, ecx
mov edx, dword [ebp + 8]
xor eax, dword [edx + ecx*4]
inc ecx
cmp ecx, 0x7f
jb 0x508625
cmp eax, 0xffffffff
jne 0x508639
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x50863e
inc eax
pop ebp
ret 4

Function at 0x5289d2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x43ee84], 0
jne 0x5289e4
pop ebp
jmp fcn.005280da
pop ebp
jmp fcn.00528553
Function at 0x5378b1
Capabilities:
Write file on windows

Disassembly:
mov ebx, dword [0x43ee90]
cli
mov eax, cr0
and eax, 0x7fffffff
mov cr0, eax
jmp 0x5378c5
mov eax, cr4
or eax, 0x6a0
mov cr4, eax
mov eax, dword [0x444d80]
and eax, 0xfffff000
mov cr3, eax
mov ecx, dword [0x4398fc]
rdmsr
or eax, dword [0x439920]
wrmsr
mov eax, cr0
or eax, 0x80050020
mov cr0, eax
jmp 0x5378fa
cmp ebx, 1
jne 0x537900
ret
lgdt [0x474520]
ljmp 0

Function at 0x53aa2b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov edx, edi
shr edx, 0xc
cmp edx, 1
mov eax, 0x1000
jb 0x53aa51
lea ecx, [edx + ebx]
cmp ecx, eax
jae 0x53aa51
mov eax, edi
jmp 0x53aa96
mov ecx, dword [0x476fb8]
and dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
push esi
xor esi, esi
test ebx, ebx
jbe 0x53aa75
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
jne 0x53aa75
inc esi
add ecx, 4
cmp esi, ebx
jb 0x53aa68
cmp esi, ebx
je 0x53aa9c
inc dword [ebp + 0x10]
add dword [ebp - 4], 4
mov ecx, 0x400
sub ecx, ebx
cmp dword [ebp + 0x10], ecx
jbe 0x53aa5f
push edi
call fcn.00545b2b
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0xc
test ebx, ebx
mov esi, 0xfff
jbe 0x53aae8
mov ecx, dword [ebp + 0x10]
shl ecx, 2
shl edx, 0xc
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, dword [0x476fb8]
add edx, ecx
mov ebx, dword [edx]
xor ebx, edi
and ebx, esi
xor ebx, edi
mov dword [edx], ebx
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 1
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 2
add edi, eax
add ecx, 4
dec dword [ebp - 4]
jne 0x53aab3
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
or eax, 0xfffffc00
shl eax, 0xc
and edi, esi
or eax, edi
jmp 0x53aa95

Function at 0x53aaf9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [0x476fb8]
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, edi
shr edx, 0xc
and dword [ebp - 4], 0
xor esi, esi
test eax, eax
jbe 0x53ab2a
mov ecx, ebx
cmp dword [ecx], 0
jne 0x53ab2a
inc esi
add ecx, 4
cmp esi, eax
jb 0x53ab1d
cmp esi, eax
je 0x53ab50
inc dword [ebp - 4]
mov ecx, 0x400
sub ecx, eax
add ebx, 4
cmp dword [ebp - 4], ecx
jbe 0x53ab15
push edi
call fcn.00545b2b
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
test eax, eax
mov esi, 0xfff
jbe 0x53abb1
mov ecx, dword [ebp - 4]
shl ecx, 2
shl edx, 0xc
mov edi, edx
mov edx, dword [0x476fb8]
add edx, ecx
mov ebx, dword [edx]
xor ebx, edi
and ebx, esi
xor ebx, edi
mov dword [edx], ebx
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 1
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 2
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 8
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 0x10
add edi, 0x1000
add ecx, 4
dec eax
jne 0x53ab64
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
or eax, 0xfffffc00
shl eax, 0xc
and edi, esi
or eax, edi
jmp 0x53ab49
Function at 0x53cb71
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 0x18]
mov eax, 0xf68
cmp edi, eax
jae 0x53cb8e
mov dword [ebp - 8], edi
jmp 0x53cb93
mov dword [ebp - 8], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x10]
mov edx, dword [esi + 4]
mov dword [ebp + 0xc], edx
xor ecx, ecx
lea edx, [eax + edi]
xor edx, eax
test edx, 0xfffff000
push ecx
mov dword [ebp - 0x10], eax
push eax
jne 0x53cbd7
call fcn.0053d731
test eax, eax
jne 0x53cbc5
and word [esi], 0
jmp 0x53cc54
movzx ecx, di
push ecx
push eax
push dword [ebp + 0xc]
call fcn.0053d5d7
mov word [esi], ax
jmp 0x53cc54
call fcn.0053d731
test eax, eax
je 0x53cbbc
mov ecx, eax
and ecx, 0xfff
mov ebx, 0x1000
sub ebx, ecx
movzx ecx, bx
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
call fcn.0053d5d7
mov word [esi], ax
mov eax, dword [ebp - 4]
add dword [ebp - 0x10], eax
add dword [ebp + 0xc], eax
sub edi, ebx
jmp 0x53cc49
xor eax, eax
push eax
push dword [ebp - 0x10]
call fcn.0053d731
test eax, eax
je 0x53cc4e
cmp di, 0x1000
mov dword [ebp - 4], 0x1000
ja 0x53cc2f
mov dword [ebp - 4], edi
movzx ebx, word [ebp - 4]
push ebx
push eax
push dword [ebp + 0xc]
call fcn.0053d5d7
add word [esi], ax
add dword [ebp - 0x10], ebx
add dword [ebp + 0xc], ebx
sub edi, dword [ebp - 4]
test di, di
ja 0x53cc0f
mov edi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
movzx eax, word [esi]
sub edi, eax
neg edi
sbb edi, edi
and edi, 0xc0000001
mov dword [ebx + 8], edi
movzx eax, word [esi]
mov dword [ebx + 0x1c], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 2
mov word [ebp - 0x18], 0x38
mov dword [ebp - 0x14], ebx
call fcn.0053d326
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x53cc88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov bx, word [edi + 0x18]
mov esi, dword [edi + 0x10]
mov dword [ebp - 4], eax
movzx eax, bx
mov dword [ebp - 0xc], eax
add eax, esi
xor ecx, ecx
xor eax, esi
test eax, 0xfffff000
push ecx
mov word [ebp - 0x14], 0x38
mov dword [ebp - 0x10], edi
push esi
jne 0x53ccd8
call fcn.0053d731
push dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call fcn.0053d5d7
movzx eax, ax
jmp 0x53cd4f
call fcn.0053d731
mov ecx, eax
and ecx, 0xfff
mov edi, 0x1000
sub edi, ecx
movzx ecx, di
push ecx
push dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push eax
call fcn.0053d5d7
movzx eax, ax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
add esi, eax
sub ebx, edi
test bx, bx
jbe 0x53cd49
xor eax, eax
push eax
push esi
call fcn.0053d731
cmp bx, 0x1000
mov dword [ebp - 0xc], 0x1000
ja 0x53cd2b
mov dword [ebp - 0xc], ebx
movzx edi, word [ebp - 0xc]
push edi
push dword [ebp - 4]
push eax
call fcn.0053d5d7
add dword [ebp - 4], edi
movzx eax, ax
add dword [ebp - 8], eax
add esi, edi
sub ebx, dword [ebp - 0xc]
jmp 0x53cd0c
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx]
mov edx, eax
sub edx, ecx
neg edx
sbb edx, edx
and edx, 0xc0000001
mov dword [edi + 8], edx
mov dword [edi + 0x1c], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call fcn.0053d326
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x53e44c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
push esi
xor esi, esi
test ecx, ecx
push edi
jbe 0x53e480
mov edx, dword [eax + 0xc]
cmp dword [ebp + 0x10], edx
jb 0x53e478
mov edi, dword [eax + 0x10]
add edi, edx
cmp dword [ebp + 0x10], edi
jb 0x53e482
add eax, 0x28
inc esi
cmp esi, ecx
jb 0x53e466
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x53ea82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
not eax
jbe 0x53eab0
mov edx, dword [ebp + 0xc]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x43a5f8]
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x53ea91
not eax
pop ebp
ret 0xc

Function at 0x54da8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
xor ecx, ecx
mov edx, dword [ebp + 8]
xor eax, dword [edx + ecx*4]
inc ecx
cmp ecx, 0x7f
jb 0x54da95
cmp eax, 0xffffffff
jne 0x54daa9
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x54daae
inc eax
pop ebp
ret 4

Function at 0x56de42
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x43ee84], 0
jne 0x56de54
pop ebp
jmp fcn.0056d54a
pop ebp
jmp fcn.0056d9c3
Function at 0x57cd21
Capabilities:
Write file on windows

Disassembly:
mov ebx, dword [0x43ee90]
cli
mov eax, cr0
and eax, 0x7fffffff
mov cr0, eax
jmp 0x57cd35
mov eax, cr4
or eax, 0x6a0
mov cr4, eax
mov eax, dword [0x444d80]
and eax, 0xfffff000
mov cr3, eax
mov ecx, dword [0x4398fc]
rdmsr
or eax, dword [0x439920]
wrmsr
mov eax, cr0
or eax, 0x80050020
mov cr0, eax
jmp 0x57cd6a
cmp ebx, 1
jne 0x57cd70
ret
lgdt [0x474520]
ljmp 0

Function at 0x57fe9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov edx, edi
shr edx, 0xc
cmp edx, 1
mov eax, 0x1000
jb 0x57fec1
lea ecx, [edx + ebx]
cmp ecx, eax
jae 0x57fec1
mov eax, edi
jmp 0x57ff06
mov ecx, dword [0x476fb8]
and dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
push esi
xor esi, esi
test ebx, ebx
jbe 0x57fee5
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
jne 0x57fee5
inc esi
add ecx, 4
cmp esi, ebx
jb 0x57fed8
cmp esi, ebx
je 0x57ff0c
inc dword [ebp + 0x10]
add dword [ebp - 4], 4
mov ecx, 0x400
sub ecx, ebx
cmp dword [ebp + 0x10], ecx
jbe 0x57fecf
push edi
call fcn.0058af9b
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0xc
test ebx, ebx
mov esi, 0xfff
jbe 0x57ff58
mov ecx, dword [ebp + 0x10]
shl ecx, 2
shl edx, 0xc
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, dword [0x476fb8]
add edx, ecx
mov ebx, dword [edx]
xor ebx, edi
and ebx, esi
xor ebx, edi
mov dword [edx], ebx
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 1
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 2
add edi, eax
add ecx, 4
dec dword [ebp - 4]
jne 0x57ff23
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
or eax, 0xfffffc00
shl eax, 0xc
and edi, esi
or eax, edi
jmp 0x57ff05

Function at 0x57ff69
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [0x476fb8]
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, edi
shr edx, 0xc
and dword [ebp - 4], 0
xor esi, esi
test eax, eax
jbe 0x57ff9a
mov ecx, ebx
cmp dword [ecx], 0
jne 0x57ff9a
inc esi
add ecx, 4
cmp esi, eax
jb 0x57ff8d
cmp esi, eax
je 0x57ffc0
inc dword [ebp - 4]
mov ecx, 0x400
sub ecx, eax
add ebx, 4
cmp dword [ebp - 4], ecx
jbe 0x57ff85
push edi
call fcn.0058af9b
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
test eax, eax
mov esi, 0xfff
jbe 0x580021
mov ecx, dword [ebp - 4]
shl ecx, 2
shl edx, 0xc
mov edi, edx
mov edx, dword [0x476fb8]
add edx, ecx
mov ebx, dword [edx]
xor ebx, edi
and ebx, esi
xor ebx, edi
mov dword [edx], ebx
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 1
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 2
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 8
mov edx, dword [0x476fb8]
add edx, ecx
or dword [edx], 0x10
add edi, 0x1000
add ecx, 4
dec eax
jne 0x57ffd4
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
or eax, 0xfffffc00
shl eax, 0xc
and edi, esi
or eax, edi
jmp 0x57ffb9
Function at 0x581fe1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 0x18]
mov eax, 0xf68
cmp edi, eax
jae 0x581ffe
mov dword [ebp - 8], edi
jmp 0x582003
mov dword [ebp - 8], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x10]
mov edx, dword [esi + 4]
mov dword [ebp + 0xc], edx
xor ecx, ecx
lea edx, [eax + edi]
xor edx, eax
test edx, 0xfffff000
push ecx
mov dword [ebp - 0x10], eax
push eax
jne 0x582047
call fcn.00582ba1
test eax, eax
jne 0x582035
and word [esi], 0
jmp 0x5820c4
movzx ecx, di
push ecx
push eax
push dword [ebp + 0xc]
call fcn.00582a47
mov word [esi], ax
jmp 0x5820c4
call fcn.00582ba1
test eax, eax
je 0x58202c
mov ecx, eax
and ecx, 0xfff
mov ebx, 0x1000
sub ebx, ecx
movzx ecx, bx
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
call fcn.00582a47
mov word [esi], ax
mov eax, dword [ebp - 4]
add dword [ebp - 0x10], eax
add dword [ebp + 0xc], eax
sub edi, ebx
jmp 0x5820b9
xor eax, eax
push eax
push dword [ebp - 0x10]
call fcn.00582ba1
test eax, eax
je 0x5820be
cmp di, 0x1000
mov dword [ebp - 4], 0x1000
ja 0x58209f
mov dword [ebp - 4], edi
movzx ebx, word [ebp - 4]
push ebx
push eax
push dword [ebp + 0xc]
call fcn.00582a47
add word [esi], ax
add dword [ebp - 0x10], ebx
add dword [ebp + 0xc], ebx
sub edi, dword [ebp - 4]
test di, di
ja 0x58207f
mov edi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
movzx eax, word [esi]
sub edi, eax
neg edi
sbb edi, edi
and edi, 0xc0000001
mov dword [ebx + 8], edi
movzx eax, word [esi]
mov dword [ebx + 0x1c], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 2
mov word [ebp - 0x18], 0x38
mov dword [ebp - 0x14], ebx
call fcn.00582796
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x5820f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov bx, word [edi + 0x18]
mov esi, dword [edi + 0x10]
mov dword [ebp - 4], eax
movzx eax, bx
mov dword [ebp - 0xc], eax
add eax, esi
xor ecx, ecx
xor eax, esi
test eax, 0xfffff000
push ecx
mov word [ebp - 0x14], 0x38
mov dword [ebp - 0x10], edi
push esi
jne 0x582148
call fcn.00582ba1
push dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call fcn.00582a47
movzx eax, ax
jmp 0x5821bf
call fcn.00582ba1
mov ecx, eax
and ecx, 0xfff
mov edi, 0x1000
sub edi, ecx
movzx ecx, di
push ecx
push dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push eax
call fcn.00582a47
movzx eax, ax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
add esi, eax
sub ebx, edi
test bx, bx
jbe 0x5821b9
xor eax, eax
push eax
push esi
call fcn.00582ba1
cmp bx, 0x1000
mov dword [ebp - 0xc], 0x1000
ja 0x58219b
mov dword [ebp - 0xc], ebx
movzx edi, word [ebp - 0xc]
push edi
push dword [ebp - 4]
push eax
call fcn.00582a47
add dword [ebp - 4], edi
movzx eax, ax
add dword [ebp - 8], eax
add esi, edi
sub ebx, dword [ebp - 0xc]
jmp 0x58217c
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx]
mov edx, eax
sub edx, ecx
neg edx
sbb edx, edx
and edx, 0xc0000001
mov dword [edi + 8], edx
mov dword [edi + 0x1c], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call fcn.00582796
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x5838bc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
push esi
xor esi, esi
test ecx, ecx
push edi
jbe 0x5838f0
mov edx, dword [eax + 0xc]
cmp dword [ebp + 0x10], edx
jb 0x5838e8
mov edi, dword [eax + 0x10]
add edi, edx
cmp dword [ebp + 0x10], edi
jb 0x5838f2
add eax, 0x28
inc esi
cmp esi, ecx
jb 0x5838d6
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x583ef2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
not eax
jbe 0x583f20
mov edx, dword [ebp + 0xc]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x43a5f8]
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x583f01
not eax
pop ebp
ret 0xc

Function at 0x592efe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
xor ecx, ecx
mov edx, dword [ebp + 8]
xor eax, dword [edx + ecx*4]
inc ecx
cmp ecx, 0x7f
jb 0x592f05
cmp eax, 0xffffffff
jne 0x592f19
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x592f1e
inc eax
pop ebp
ret 4
Function at 0x62d787
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [0x48581004]
push 0x48581658
lea eax, [ebp - 0x1c]
push eax
call esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
xor ebx, ebx
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], 0x40
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [0x48581038]
cmp eax, ebx
jl 0x62d8f5
push edi
push 0x48581650
lea eax, [ebp - 0x1c]
push eax
call esi
mov edi, dword [0x48581034]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call edi
cmp eax, 0xc0000034
mov dword [ebp - 0xc], eax
je 0x62d80a
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jl 0x62d858
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov esi, dword [0x4858102c]
add ecx, 0x10
push ecx
push ebx
push dword [eax + 0x18]
call esi
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x62d839
mov dword [ebp - 0xc], 0xc0000017
cmp dword [ebp - 0xc], ebx
jl 0x62d858
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 8]
push eax
push 2
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call edi
cmp eax, ebx
mov dword [ebp - 0xc], eax
jge 0x62d860
mov eax, dword [ebp - 0xc]
jmp 0x62d8f4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x18
push ebx
push dword [eax + 0x18]
call esi
cmp eax, ebx
mov dword [0x485870a0], eax
jne 0x62d881
mov eax, 0xc0000017
jmp 0x62d8f4
mov esi, dword [ebp - 0x14]
push 6
pop ecx
mov edi, eax
add esi, 0xc
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 4]
call dword [0x48581028]
push 1
push dword [0x485870a0]
lea eax, [ebp - 0x24]
push eax
call dword [0x48581040]
cmp eax, ebx
jl 0x62d8f4
mov edx, 0x48586860
xor eax, eax
mov edi, edx
mov ecx, 0x208
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x20]
push 0x40f
add eax, 0x12
push eax
push edx
call fcn.0062f88a
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [0x48581008]
mov eax, dword fs:[0x18]
push dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [0x48581030]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x62ea20
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push 0
push 0xb
push dword [eax + 8]
call dword [0x485810b4]
test eax, eax
jl 0x62ea71
mov eax, dword [ebp - 4]
test byte [eax + 2], 1
jne 0x62ea75
add eax, 4
push eax
lea eax, [ebp - 0xc]
push eax
call dword [0x485810b0]
push 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [0x485810ac]
test eax, eax
jge 0x62ea82
xor eax, eax
jmp 0x62ea85
add eax, 4
push eax
push dword [ebp + 8]
call dword [0x485810a8]
xor eax, eax
inc eax
leave
ret 8
Function at 0x62ea89
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [0x48581004]
xor ebx, ebx
cmp eax, ebx
push edi
jne 0x62eaee
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [0x48581038]
mov edi, eax
cmp edi, ebx
jge 0x62eaf1
push edi
push dword [ebp + 8]
push 0x4858247c
jmp 0x62eb86
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
call esi
mov edi, dword [0x48581034]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call edi
mov esi, 0xc0000034
cmp eax, esi
jne 0x62eb32
push esi
push dword [ebp + 0x10]
push 0x48582430
call fcn.0062d203
add esp, 0xc
mov eax, esi
jmp 0x62ec3c
add dword [ebp - 8], 0x10
mov eax, dword fs:[0x18]
push dword [ebp - 8]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [0x4858102c]
mov esi, eax
cmp esi, ebx
jne 0x62eb64
push 0x485823f8
call fcn.0062d203
pop ecx
xor eax, eax
jmp 0x62ec3c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push esi
push 2
push eax
push dword [ebp - 4]
call edi
mov edi, eax
cmp edi, ebx
jge 0x62eb95
push edi
push dword [ebp + 0x10]
push 0x485823b8
call fcn.0062d203
add esp, 0xc
mov eax, edi
jmp 0x62ec3c
cmp dword [ebp + 0x20], 1
lea edi, [esi + 0xc]
jne 0x62ebc7
push dword [ebp + 0x18]
mov eax, dword [ebp - 8]
push dword [ebp + 0x14]
shr eax, 1
push eax
push edi
call fcn.0062e779
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x62ec17
push edi
call fcn.0062f884
lea eax, [eax + eax + 2]
pop ecx
mov dword [esi + 8], eax
jmp 0x62ebdc
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [esi + 8]
push edi
call fcn.0062e6ff
mov dword [ebp + 8], eax
cmp dword [ebp + 8], ebx
jl 0x62ec17
push dword [esi + 8]
lea eax, [ebp - 0x14]
push edi
push dword [ebp + 0x20]
push ebx
push eax
push dword [ebp - 4]
call dword [0x48581078]
cmp eax, ebx
mov dword [ebp + 8], eax
jge 0x62ec0e
push eax
push dword [ebp + 0x10]
push 0x4858237c
call fcn.0062d203
add esp, 0xc
push dword [ebp - 4]
call dword [0x48581074]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [0x48581030]
cmp dword [ebp + 0xc], ebx
jne 0x62ec39
push dword [ebp - 4]
call dword [0x48581028]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x1c