joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70d48b9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cx, word [ebp + 0x14]
or word [eax + 0x84], 0xffff
push ebx
push esi
push edi
mov word [eax + 0x32], cx
mov cx, word [ebp + 0x10]
xor edx, edx
mov word [eax + 0x20], cx
push 9
pop ecx
mov ebx, 0x70d48c84
mov esi, ebx
lea edi, [eax + 0x44]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [ebp + 0x14]
mov esi, dword [ebp + 0xc]
imul ecx, ecx, 0x38
mov byte [eax], 0x47
mov byte [eax + 1], 0x44
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x1c], 3
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x6c], edx
mov dword [eax + 0x70], edx
mov dword [eax + 0x68], edx
mov word [eax + 0x22], 0x7fff
mov word [eax + 0x24], 0x7fff
mov word [eax + 0x26], 0x8000
mov word [eax + 0x28], 0x8000
mov word [eax + 0x86], dx
mov dword [eax + 0x88], edx
mov word [eax + 0x2a], dx
mov word [eax + 0x2e], dx
mov dword [eax + 0x34], 2
mov dword [eax + 0x38], edx
mov word [eax + 0x3c], dx
mov word [eax + 0x3e], dx
mov word [eax + 0x40], dx
mov word [eax + 0x42], dx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov dword [eax + 0x80], edx
mov esi, dword [esi + 8]
add ecx, esi
push 9
mov dword [eax + 0x8c], ecx
mov word [ecx + 0x28], dx
pop ecx
mov esi, ebx
lea edi, [eax + 0x90]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [eax + 0xb4], 1
pop ebx
pop ebp
ret 0x10
Function at 0x70da5397
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
mov eax, dword [ebp + 8]
je 0x70da53c9
push esi
mov esi, dword [ebp + 0x10]
xor edx, edx
mov dl, byte [eax]
shr esi, 8
xor edx, dword [ebp + 0x10]
and edx, 0xff
mov edx, dword [edx*4 + 0x70da53d0]
xor edx, esi
inc eax
dec ecx
mov dword [ebp + 0x10], edx
jne 0x70da53a5
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x70db02b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
push 9
pop edx
mov dword [ebp + 8], ecx
lea ecx, [eax + 2]
mov ax, word [ebp + 8]
xor ax, word [ecx]
inc ecx
inc ecx
dec edx
jne 0x70db02d0
pop ebp
ret 4

Function at 0x70db6324
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
push esi
push edi
lea eax, [ebp - 8]
push eax
xor esi, esi
cmp dword [0x70e6d5a8], esi
mov edi, ecx
push 1
mov dword [ebp - 0x14], edi
push esi
je 0x70db6358
push dword [0x70e6cadc]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x70db6369
push dword [0x70e6dd98]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x70db64c7
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x70db63a1
mov eax, dword [edi + 4]
shl eax, 3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], esi
push esi
push 0x70db64d0
mov ecx, edi
call fcn.70db6214
cmp dword [ebp - 0x10], esi
jbe 0x70db6497
push ebx
mov ebx, 0x104
mov edi, 0x103
cmp dword [ebp - 0xc], edi
je 0x70db6493
cmp dword [0x70e6d5a8], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0x208
je 0x70db640c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x70db6433
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x70db6493
cmp eax, esi
jne 0x70db6484
cmp dword [0x70e6d5a8], esi
jne 0x70db6474
xor eax, eax
push ebx
mov ecx, 0x82
lea edi, [ebp - 0x334]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x334]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x12c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push esi
lea eax, [ebp - 0x334]
push eax
call fcn.70db6214
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jb 0x70db63bd
mov edi, dword [ebp - 0x14]
pop ebx
cmp dword [edi], esi
je 0x70db64be
cmp dword [ebp + 8], esi
je 0x70db64b7
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 8]
call fcn.70d36ec3
mov ecx, dword [edi + 0xc]
push eax
call fcn.70da66a6
mov dword [edi + 0x14], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 4
Function at 0x70db6b9e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
push ebx
push edi
push 8
mov ebx, ecx
call fcn.70d4fb28
xor edi, edi
cmp eax, edi
mov dword [ebx + 4], eax
je 0x70db6d5d
mov dword [eax], edi
mov eax, dword [ebx + 4]
push esi
mov dword [eax + 4], edi
xor esi, esi
mov al, 0x45
mov byte [ebp + esi - 0x120], al
mov al, byte [esi + 0x70db6d69]
inc esi
test al, al
jne 0x70db6bcc
call dword [sym.imp.KERNEL32.dll_GetACP]
test eax, eax
jbe 0x70db6c0a
xor edx, edx
push 0xa
pop ecx
div ecx
add dl, 0x30
mov byte [ebp + edi - 0x10], dl
inc edi
cmp edi, 5
jl 0x70db6be4
jmp 0x70db6c0a
mov al, byte [ebp + edi - 0x10]
mov byte [ebp + esi - 0x120], al
inc esi
dec edi
jns 0x70db6bfe
and byte [ebp + esi - 0x120], 0
lea ecx, [ebp - 4]
push ecx
xor eax, eax
push 9
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x120]
push eax
push 0x80000001
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x70db6d4d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x120]
push eax
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 8]
mov esi, 0x104
push dword [ebp - 4]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x70db6d40
push esi
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.70da6951
test eax, eax
je 0x70db6c45
push esi
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.70da6951
test eax, eax
je 0x70db6c45
cmp dword [ebp - 0x14], edi
je 0x70db6ce7
push 0x70d8abc0
lea eax, [ebp - 0x42c]
push eax
call fcn.70d37230
test eax, eax
jne 0x70db6ce7
lea eax, [ebp - 0x634]
push eax
mov ecx, ebx
mov dword [ebp - 0x14], edi
call fcn.70db67a2
cmp eax, edi
je 0x70db6d40
mov ecx, dword [ebx + 4]
mov dword [ecx], eax
jmp 0x70db6d40
mov eax, dword [0x70e6dd00]
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x42c]
push eax
call fcn.70d36f56
mov edi, eax
test edi, edi
je 0x70db6d40
lea eax, [ebp - 0x634]
push eax
mov ecx, ebx
call fcn.70db67a2
mov esi, eax
test esi, esi
je 0x70db6d40
push 0xc
call fcn.70d4fb28
test eax, eax
je 0x70db6d40
mov dword [eax], edi
mov dword [eax + 4], esi
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x70db6d37
mov dword [ecx + 4], eax
and dword [eax + 8], edx
jmp 0x70db6d40
mov dword [eax + 8], edx
mov ecx, dword [ebx + 4]
mov dword [ecx + 4], eax
inc dword [ebp - 8]
cmp dword [ebp - 0x10], 0
je 0x70db6c45
cmp dword [ebp - 4], 0
pop esi
je 0x70db6d5d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret
Function at 0x70dc3ca3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [ebp + 0x18]
and al, 2
sub al, 2
neg al
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sbb eax, eax
inc eax
xor ebx, ebx
cmp esi, ebx
mov edi, eax
je 0x70dc3cce
neg eax
sbb eax, eax
and eax, 0x16
add eax, esi
jmp 0x70dc3cd0
xor eax, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.70dc3b1b
cmp eax, ebx
mov dword [ebp + 0x18], eax
je 0x70dc3de3
cmp edi, ebx
je 0x70dc3de3
add dword [ebp + 0x18], 0x16
cmp esi, ebx
je 0x70dc3de3
lea eax, [ebp - 0x6c]
mov byte [esi], 0xd7
mov byte [esi + 1], 0xcd
mov byte [esi + 2], 0xc6
mov byte [esi + 3], 0x9a
push eax
mov byte [esi + 4], bl
mov byte [esi + 5], bl
push 0x6c
push dword [ebp + 8]
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
call sub.GDI32.dll_GetEnhMetaFileHeader
test eax, eax
je 0x70dc3da5
fild dword [ebp - 0x24]
fidiv dword [ebp - 0x1c]
fmul dword [0x70d05134]
fiadd dword [ebp - 0x20]
fidiv dword [ebp - 0x18]
fmul dword [0x70d05134]
fmul dword [0x70d510d4]
fild dword [ebp - 0x54]
fmul st(1)
call fcn.70d59475
fild dword [ebp - 0x50]
mov byte [esi + 6], al
mov byte [esi + 7], ah
fmul st(1)
call fcn.70d59475
fild dword [ebp - 0x4c]
mov byte [esi + 8], al
mov byte [esi + 9], ah
fmul st(1)
call fcn.70d59475
fild dword [ebp - 0x48]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], ah
fmul st(1)
call fcn.70d59475
fmul dword [0x70d046a4]
mov byte [esi + 0xc], al
mov byte [esi + 0xd], ah
call fcn.70d59475
mov byte [esi + 0xe], al
mov byte [esi + 0xf], ah
jmp 0x70dc3dc8
mov byte [esi + 6], bl
mov byte [esi + 7], bl
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], 0xd0
mov byte [esi + 0xb], 7
mov byte [esi + 0xc], 0xd0
mov byte [esi + 0xd], 7
mov byte [esi + 0xe], 0x60
mov byte [esi + 0xf], bl
lea edx, [esi + 0x14]
cmp esi, edx
mov ecx, esi
mov dword [ebp + 8], ebx
mov ax, bx
jae 0x70dc3de0
xor ax, word [ecx]
inc ecx
inc ecx
cmp ecx, edx
jb 0x70dc3dd7
mov word [ecx], ax
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x70dcca20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
lea eax, [ebp - 4]
push eax
push 9
xor edi, edi
push edi
push 0x70dccb78
push 0x80000002
mov dword [0x70e6dd64], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x70dccb67
call fcn.70d3595a
cmp eax, edi
je 0x70dcca61
mov eax, dword [eax + 8]
cmp eax, edi
mov dword [ebp - 0x14], eax
jne 0x70dcca6f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x70dccb67
push ebx
mov dword [ebp - 0xc], edi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x68]
push eax
push edi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 8], 8
push dword [ebp - 4]
mov dword [ebp - 0x10], 0x20
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0x18], eax
jne 0x70dccb50
cmp dword [ebp - 8], 6
mov esi, dword [ebp - 0x1e]
mov word [ebp - 0x1e], di
je 0x70dccad4
cmp dword [ebp - 8], 7
jne 0x70dccb50
cmp word [ebp - 0x1c], 0x30
jb 0x70dccb50
cmp word [ebp - 0x1c], 0x36
ja 0x70dccb50
cmp si, 0x31
jb 0x70dccb50
cmp si, 0x39
ja 0x70dccb50
push 0x70dccb6c
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x70dccb50
cmp dword [ebp - 8], 7
jne 0x70dccb0c
movzx ecx, word [ebp - 0x1c]
movzx eax, si
lea eax, [eax + eax*4]
lea esi, [ecx + eax*2 - 0x211]
jmp 0x70dccb12
movzx esi, si
sub esi, 0x31
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x68]
push eax
call fcn.70d36f56
mov ebx, eax
cmp ebx, edi
je 0x70dccb50
cmp dword [0x70e6dd64], edi
jne 0x70dccb48
push 0x40
call fcn.70d4fb28
mov edi, eax
test edi, edi
mov dword [0x70e6dd64], edi
je 0x70dccb5c
push 0x10
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
xor edi, edi
mov eax, dword [0x70e6dd64]
mov dword [eax + esi*4], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0x18], edi
je 0x70dcca74
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop edi
leave
ret

Function at 0x70dcd571
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x70dcd59c
xor eax, eax
jmp 0x70dcd5c6
push edi
mov edi, dword [ebp + 0x10]
push esi
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x70dcd5bc
cmp edi, dword [ebp + 8]
jne 0x70dcd5bc
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x70dda97c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, dword [0x70e6cbe0]
je 0x70ddaa45
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, 0x70d8d3dc
push ebx
push 0x70d8d3d0
push esi
call edi
test eax, eax
je 0x70ddaa42
mov ebp, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
push esi
call ebp
test eax, eax
je 0x70ddaa42
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x70ddaa42
cmp dword [eax], 0x2e435269
jne 0x70ddaa42
cmp dword [eax + 4], 0
jne 0x70ddaa42
lea ecx, [eax + 0x10]
push ebx
mov dword [0x70e75008], ecx
mov eax, dword [eax + 0xc]
push 0x70ddaa58
push esi
mov dword [0x70e75014], eax
call edi
test eax, eax
je 0x70ddaa42
push eax
push esi
call ebp
test eax, eax
je 0x70ddaa42
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x70ddaa49
cmp dword [eax], 0x2e435269
jne 0x70ddaa49
cmp dword [eax + 4], 1
jne 0x70ddaa49
lea ecx, [eax + 0x10]
mov dword [0x70e7500c], ecx
mov eax, dword [eax + 0xc]
add eax, ecx
mov dword [0x70e75010], eax
mov eax, dword [esp + 0x14]
mov dword [eax], 0x70de46c2
mov dword [eax + 4], 0x70dda927
mov dword [eax + 8], 0x70dda95c
pop edi
pop ebp
pop ebx
pop esi
ret 4
mov dword [0x70e7500c], 0x70e75018
jmp 0x70ddaa42
Function at 0x70de4078
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
movzx esi, byte [eax]
lea ecx, [eax + 1]
movzx eax, byte [ecx]
xor edx, edx
shl esi, 8
push edi
mov edi, dword [0x70e75014]
inc edx
add esi, eax
cmp edi, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
jb 0x70de4224
mov eax, dword [0x70e75008]
push ebx
mov ecx, dword [ebp - 8]
add ecx, edi
shr ecx, 1
movzx edx, byte [eax + ecx*8 - 8]
movzx ebx, byte [eax + ecx*8 - 7]
shl edx, 8
add edx, ebx
cmp edx, esi
jae 0x70de40d2
lea edx, [ecx + 1]
mov dword [ebp - 8], edx
jmp 0x70de40d7
jbe 0x70de40dc
lea edi, [ecx - 1]
cmp edi, dword [ebp - 8]
jae 0x70de40b0
cmp edi, dword [ebp - 8]
jb 0x70de4223
mov ebx, dword [ebp - 0xc]
lea ecx, [eax + ecx*8]
mov esi, dword [ecx - 4]
mov edi, dword [ecx + 4]
add esi, eax
add edi, eax
mov al, byte [ebx]
mov dword [ebp - 8], 0xffff
mov dword [ebp - 0x10], 1
mov byte [ebp - 1], al
jmp 0x70de421b
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jae 0x70de4223
jmp 0x70de4188
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
and al, 0x7f
movzx ax, al
inc ecx
imul eax, ecx
inc dword [ebp - 0x10]
mov dword [ebp - 8], eax
movzx eax, byte [ebp - 1]
inc ebx
cmp dword [eax*4 + 0x70e6eb88], 2
mov al, byte [ebx]
mov byte [ebp - 1], al
jl 0x70de4188
test al, al
je 0x70de418e
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jae 0x70de418e
movzx eax, byte [ebp - 1]
mov eax, dword [eax*4 + 0x70e6eb88]
cdq
push 2
pop ecx
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jne 0x70de4188
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 0xfffffffe
cmp ebx, eax
ja 0x70de418e
cmp byte [ebx + 1], 0xec
je 0x70de4188
cmp ebx, eax
je 0x70de418e
cmp byte [ebx + 2], 0xec
jne 0x70de418e
cmp byte [ebp - 1], 0x7f
ja 0x70de411a
cmp esi, edi
jae 0x70de420e
mov ecx, dword [ebp - 0x10]
push 2
pop edx
mov ax, word [esi]
cmp cx, ax
je 0x70de41bd
jb 0x70de420e
cmp esi, edi
jae 0x70de420e
cmp al, 2
jne 0x70de41ae
add esi, edx
jmp 0x70de41b7
add esi, edx
movzx eax, word [esi]
lea esi, [esi + eax*2 + 2]
cmp esi, edi
jb 0x70de4198
jmp 0x70de420e
add esi, edx
cmp cx, dx
jne 0x70de41cf
push edx
push dword [ebp + 0xc]
call fcn.70de34ba
jmp 0x70de420e
xor eax, eax
mov ax, word [esi]
add esi, edx
test ax, ax
mov dword [ebp - 0xc], eax
jbe 0x70de420e
mov ax, word [esi]
cmp word [ebp - 8], ax
je 0x70de41fb
jbe 0x70de4207
add dword [ebp - 0xc], 0xffff
inc esi
inc esi
cmp word [ebp - 0xc], 0
ja 0x70de41de
jmp 0x70de420e
movzx eax, cx
push eax
push dword [ebp + 0xc]
call fcn.70de34ba
movzx eax, word [ebp - 0xc]
lea esi, [esi + eax*2]
cmp byte [ebp - 1], 0x80
jb 0x70de4223
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
ja 0x70de4223
cmp esi, edi
jb 0x70de410d
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x70de6fcc
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x70de7007
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x70de6fee
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x70de6fff
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x70de7009
inc edi
add eax, 0x28
cmp edi, esi
jb 0x70de6fe4
xor eax, eax
pop edi
pop esi
ret

Function at 0x70de7331
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.70de6f51
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
inc ecx
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid

Function at 0x70de7392
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ecx
call fcn.70de6f9c
push eax
push esi
push dword [ebp + 8]
call fcn.70de6f51
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.70de6f9c
push eax
push esi
push dword [ebp + 8]
call fcn.70de6f51
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.70de6f8c
js 0x70de745c
invalid
invalid
invalid
Function at 0x70de7645
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x70de7663
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x70de7681
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x70de76df
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x70de76c6
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x70de76cf
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x70de76d9
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x70de76bb
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
or al, 0x66
cmp ecx, dword [eax + 6]
jbe fcn.70de7645
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x70de772c
dec eax
je 0x70de7723
sub eax, 3
je 0x70de771a
mov dword [ebp - 4], 0x40
jmp 0x70de7749
mov dword [ebp - 4], 4
jmp 0x70de772f
mov dword [ebp - 4], 0x20
jmp 0x70de772f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x70de777b
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x70de76fb
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.70de6f8c
stc
imul ecx, dword [edi - 0x25], 0xffffffff
jne 0x70de7786
push 1
push esi
call edi
mov eax, esi
jmp 0x70de7787
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x70de78a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
Function at 0x70de8f6e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx - 0x37b43]
inc dword [eax]
je 0x70de8f7d
jmp 0x70de9032
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x70de8fd6
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x70de8fdb
jmp 0x70de892e
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x70de9022
lea eax, [ebp - 0x714]
push eax
call fcn.70de6f9c
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.70de6f51
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x70de902d
jmp 0x70de9032
jmp 0x70de892e