joyce8/EMBER2024-capa huggingface dataset:
Function at 0x31b35d4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x31b3708
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.031e5c80
call fcn.031e6b20
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x31b36cd
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x31b36cd
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.031a3acc
lea eax, [ebp - 4]
call fcn.031a3968
mov ecx, dword [ebx]
mov edx, esi
call fcn.031a6a00
lea eax, [ebp - 0x10]
call fcn.031b3540
mov eax, dword [ebp - 4]
call fcn.031a3798
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 1
lea ecx, [ebp - 0x1c]
mov edx, 0x31b3720
mov eax, 0x31b372c
call fcn.031e681c
lea eax, [ebp - 0x1c]
mov edx, dword [0x31fbbc8]
mov edx, dword [edx]
call fcn.031a37a0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.031a7e34
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.031a3cc8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.031a3968
mov ecx, eax
mov eax, dword [ebp - 8]
pop edx
call fcn.031dc518
push 0x7530
push eax
call fcn.031a6894
lea eax, [ebp - 0x20]
call fcn.031b3450
mov edx, dword [ebp - 0x20]
mov eax, dword [0x31fbce0]
call fcn.031a35cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31b370f
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.031a359c
lea eax, [ebp - 0x14]
call fcn.031a3b48
lea eax, [ebp - 0x10]
call fcn.031a3578
lea eax, [ebp - 8]
call fcn.031a3b48
lea eax, [ebp - 4]
call fcn.031a3578
ret
Function at 0x31b3b4c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x31b3b54
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x31b3cca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.031a3578
lea eax, [ebp - 0xc]
call fcn.031e5c80
call fcn.031e6b20
mov ebx, eax
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x31b3c8a
mov edi, ebx
mov esi, edi
add esi, dword [eax + 0x3c]
cmp dword [esi], 0x4550
jne 0x31b3c8a
lea eax, [ebp - 0x18]
call fcn.031b3a38
mov eax, dword [esi + 0x50]
add eax, edi
mov edx, eax
add edx, 4
mov edi, edx
mov ebx, eax
mov edx, dword [ebx]
lea eax, [ebp - 8]
call fcn.031a3acc
lea eax, [ebp - 8]
call fcn.031a3968
mov ecx, dword [ebx]
mov edx, edi
call fcn.031a6a00
mov eax, dword [ebp - 8]
call fcn.031a3798
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea ecx, [ebp - 0x24]
mov edx, 0x31b3ce0
mov eax, 0x31b3cec
call fcn.031e681c
lea eax, [ebp - 0x24]
mov edx, dword [0x31fbbc8]
mov edx, dword [edx]
call fcn.031a37a0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.031a7e34
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.031a3cc8
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
call fcn.031a3968
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.031dc518
mov ebx, eax
push 0xea60
push ebx
call fcn.031a6894
push 0
push ebx
call fcn.031a6864
lea eax, [ebp - 0x14]
call fcn.031b386c
mov edx, dword [ebp - 0x14]
mov eax, 0x31b3cfc
call fcn.031a3a84
dec eax
jne 0x31b3c8a
mov eax, dword [ebp - 0x14]
call fcn.031a3798
cmp eax, 0x100
jge 0x31b3c8a
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 0x14]
call fcn.031a39a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31b3cd1
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.031a359c
lea eax, [ebp - 0x1c]
call fcn.031a3b48
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.031a359c
lea eax, [ebp - 0xc]
call fcn.031a3b48
lea eax, [ebp - 8]
call fcn.031a3578
ret
Function at 0x31cda64
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x31cda6c
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x31cdbfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 3
call fcn.031cd9c4
call fcn.031e6b20
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x31cdba4
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0x31cdba4
mov edi, dword [edx + 0x50]
add edi, ecx
add edi, 4
mov esi, dword [edx + 0x50]
add esi, eax
mov edx, dword [esi]
lea eax, [ebp - 4]
call fcn.031a3acc
lea eax, [ebp - 4]
call fcn.031a3968
mov ecx, dword [esi]
mov edx, edi
call fcn.031a6a00
lea ecx, [ebp - 0x1c]
mov edx, 0x31cdc14
mov eax, 0x31cdc20
call fcn.031e681c
lea eax, [ebp - 0x1c]
mov edx, dword [0x31fbbc8]
mov edx, dword [edx]
call fcn.031a37a0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.031a7e34
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.031a3cc8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.031e5744
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.031a3784
mov eax, dword [esi]
push eax
mov eax, dword [0x31fbcb4]
push eax
push 0
push 0
lea eax, [ebp - 4]
call fcn.031a3968
push eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.031a3cc8
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
call fcn.031e5c80
mov eax, dword [ebp - 0x24]
pop edx
pop ecx
call fcn.031dc518
mov esi, eax
test esi, esi
je 0x31cdb9b
push 0x6ddd00
push esi
call fcn.031a6894
mov eax, dword [0x31fbcb4]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.031a66ec
neg eax
sbb eax, eax
neg eax
cmp al, 1
jne 0x31cdb9b
cmp dword [ebp - 0xc], 0xa
je 0x31cdbb5
cmp dword [ebp - 0xc], 0x14
mov eax, dword [0x31fbcb4]
xor edx, edx
mov dword [eax], edx
push 0x493e0
call fcn.031a685c
dec ebx
jne 0x31cda8a
call fcn.031cce58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31cdc03
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.031a3b60
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.031a359c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.031a3b60
lea eax, [ebp - 8]
mov edx, 2
call fcn.031a359c
ret
Function at 0x31cf2ac
Capabilities:
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x31cf2b5
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.031a394c
mov eax, dword [ebp - 8]
call fcn.031a394c
mov eax, dword [ebp - 0xc]
call fcn.031a394c
xor eax, eax
push ebp
push 0x31cf415
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.031a3578
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.031cea80
lea eax, [ebp - 0x24]
call fcn.031ceb88
push dword [ebp - 0x24]
push 0x31cf42c
push dword [ebp - 0x14]
push 0x31cf45c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.031a3858
mov eax, 5
call fcn.031a28a4
add eax, 4
lea edx, [ebp - 0x20]
call fcn.031e3f04
push dword [ebp - 0x10]
push 0x31cf48c
push dword [ebp - 0x14]
push 0x31cf498
push dword [ebp - 0x20]
push 0x31cf4bc
push dword [ebp - 4]
push 0x31cf4cc
lea eax, [ebp - 0x10]
mov edx, 8
call fcn.031a3858
lea edx, [ebp - 0x1c]
mov eax, 4
call fcn.031cea80
lea eax, [ebp - 0x28]
call fcn.031cd1d4
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.031cec48
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0x31cf4d8
push dword [ebp - 0x14]
push 0x31cf4e4
push dword [ebp - 0x18]
push 0x31cf4f4
push dword [ebp - 0x20]
push 0x31cf508
lea eax, [ebp - 0x10]
mov edx, 9
call fcn.031a3858
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.031cf1d8
cmp byte [ebp + 0xc], 0
je 0x31cf3e5
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.031e0444
jmp 0x31cf3fa
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000001
call fcn.031e0444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31cf41c
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.031a359c
ret
Function at 0x31cf524
Capabilities:
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x31cf52d
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.031a394c
mov eax, dword [ebp - 8]
call fcn.031a394c
mov eax, dword [ebp - 0xc]
call fcn.031a394c
xor eax, eax
push ebp
push 0x31cf685
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.031a3578
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.031cea80
lea eax, [ebp - 0x24]
call fcn.031ceb88
push dword [ebp - 0x24]
push 0x31cf69c
push dword [ebp - 0x14]
push 0x31cf6cc
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.031a3858
mov eax, 5
call fcn.031a28a4
add eax, 4
lea edx, [ebp - 0x20]
call fcn.031e3f04
push dword [ebp - 0x10]
push 0x31cf6fc
push dword [ebp - 0x14]
push 0x31cf708
push dword [ebp - 0x20]
push 0x31cf72c
push dword [ebp - 4]
push 0x31cf73c
lea eax, [ebp - 0x10]
mov edx, 8
call fcn.031a3858
lea edx, [ebp - 0x1c]
mov eax, 4
call fcn.031cea80
lea eax, [ebp - 0x28]
call fcn.031cd1d4
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.031cec48
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0x31cf748
push dword [ebp - 0x14]
push 0x31cf754
push dword [ebp - 0x18]
push 0x31cf764
push dword [ebp - 0x20]
push 0x31cf778
lea eax, [ebp - 0x10]
mov edx, 9
call fcn.031a3858
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.031cf1d8
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000001
call fcn.031e0444
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.031e0444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31cf68c
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.031a359c
ret
Function at 0x31e4100
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x31e418c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.031a3578
call fcn.031e6b20
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x31e4176
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0x31e4176
mov esi, dword [edx + 0x50]
add esi, ecx
mov ecx, esi
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [esi]
lea eax, [ebp - 4]
call fcn.031a3acc
lea eax, [ebp - 4]
call fcn.031a3968
mov ecx, dword [esi]
mov edx, dword [ebp - 8]
call fcn.031a6a00
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.031a35cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31e4193
lea eax, [ebp - 4]
call fcn.031a3578
ret

Function at 0x31e419c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.031a40a8
xor eax, eax
push ebp
push 0x31e426f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.031e6b20
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x31e4242
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0x31e4242
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 0x10]
call fcn.031a3acc
lea eax, [ebp - 0x10]
call fcn.031a3968
mov ecx, dword [ebx]
mov edx, esi
call fcn.031a6a00
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.031a3968
push eax
lea eax, [ebp - 0x14]
call fcn.031e5c80
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
pop ecx
call fcn.031dc518
mov ebx, eax
test ebx, ebx
je 0x31e4249
mov dword [ebp - 0xc], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31e4276
lea eax, [ebp - 0x14]
call fcn.031a3b48
lea eax, [ebp - 0x10]
call fcn.031a3578
lea eax, [ebp - 4]
call fcn.031a3b48
ret
Function at 0x31e5160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
xor edx, edx
push ebp
push 0x31e519e
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x31e5190
add eax, dword [edx + 0x3c]
cmp dword [eax], 0x4550
jne 0x31e5190
test byte [eax + 0x17], 0x20
je 0x31e5190
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31e51a5
ret

Function at 0x31e51ac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x31e51b5
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.031a40a8
xor eax, eax
push ebp
push 0x31e536a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.031e6b20
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x31e5318
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0x31e5318
mov esi, dword [edx + 0x50]
add esi, ecx
mov ebx, esi
add ebx, 4
mov edx, dword [esi]
lea eax, [ebp - 0x14]
call fcn.031a3acc
lea eax, [ebp - 0x14]
call fcn.031a3968
mov ecx, dword [esi]
mov edx, ebx
call fcn.031a6a00
mov eax, dword [ebp - 0xc]
call fcn.031e5160
test al, al
je 0x31e52b9
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 1
lea ecx, [ebp - 0x1c]
mov edx, 0x31e5384
mov eax, 0x31e5390
call fcn.031e681c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.031a3cc8
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
call fcn.031a3968
mov ecx, eax
mov edx, dword [ebp - 4]
pop eax
call fcn.031dc518
mov ebx, eax
test ebx, ebx
jne 0x31e5318
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
call fcn.031a3968
push eax
lea eax, [ebp - 0x20]
call fcn.031e5c80
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
pop ecx
call fcn.031dc518
mov ebx, eax
jmp 0x31e5318
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea ecx, [ebp - 0x28]
mov edx, 0x31e5384
mov eax, 0x31e5390
call fcn.031e681c
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.031a3cc8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.031dc518
mov ebx, eax
test ebx, ebx
jne 0x31e5318
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x2c]
call fcn.031e5c80
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.031dc518
mov ebx, eax
test ebx, ebx
je 0x31e531f
mov dword [ebp - 0x10], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31e5371
lea eax, [ebp - 0x2c]
call fcn.031a3b48
lea eax, [ebp - 0x28]
call fcn.031a3578
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.031a3b60
lea eax, [ebp - 0x1c]
call fcn.031a3578
lea eax, [ebp - 0x18]
call fcn.031a3b48
lea eax, [ebp - 0x14]
call fcn.031a3578
lea eax, [ebp - 4]
call fcn.031a3b48
ret
Function at 0x31e5900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x31e59db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.031a3578
test esi, esi
je 0x31e5952
mov eax, esi
and eax, 0xf
cdq
xor eax, edx
sub eax, edx
mov dl, byte [eax + 0x31fb7d8]
lea eax, [ebp - 4]
call fcn.031a3720
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.031a37e4
shr esi, 4
test esi, esi
jne 0x31e5927
cmp dword [ebx], 0
jne 0x31e5974
jmp 0x31e5967
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0x31e59f0
call fcn.031a37e4
mov eax, dword [ebx]
call fcn.031a3798
cmp edi, eax
jg 0x31e5959
jmp 0x31e59c5
mov eax, dword [ebx]
call fcn.031a3798
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x2d
jne 0x31e59ba
mov eax, dword [ebx]
call fcn.031a3798
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.031a39e0
mov edx, ebx
mov ecx, 1
mov eax, 0x31e59fc
call fcn.031a3a28
jmp 0x31e59ba
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0x31e59f0
call fcn.031a37e4
mov eax, dword [ebx]
call fcn.031a3798
cmp edi, eax
jg 0x31e59ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31e59e2
lea eax, [ebp - 4]
call fcn.031a3578
ret
Function at 0x31ee14c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x31ee1f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.031a3b48
call fcn.031e6b20
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x31ee1a7
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0x31ee1a7
mov esi, dword [edx + 0x50]
add esi, ecx
mov ecx, esi
mov esi, dword [edx + 0x50]
add esi, eax
add esi, 4
add esi, dword [ecx]
lea eax, [ebp - 4]
mov edx, esi
call fcn.031a3c70
mov eax, dword [ebp - 4]
call fcn.031a3ce8
cmp eax, 0xa
jge 0x31ee1ce
call fcn.031a66bc
mov edx, eax
lea eax, [ebp - 8]
call fcn.031a3c70
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.031e5744
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.031e5744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31ee1fa
lea eax, [ebp - 8]
mov edx, 2
call fcn.031a3b60
ret
Function at 0x6f5063c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_GetProxyDllInfo___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.GetProxyDllInfo
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f506420
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_400___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_400
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f506480
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_402___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_402
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f5064e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_403___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_403
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f506540
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_404___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_404
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f5065a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_405___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_405
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f506600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_406___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_406
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f506660
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_407___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_407
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f5066c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_408___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_408
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f506720
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_409___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_409
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f506780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_410___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_410
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f5067e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_PROPSYS_411___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.PROPSYS_411
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4