joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403192
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
mov edi, 0x414108
push 0
push 0xa
push edi
call fcn.004018eb
push edi
call fcn.0040176e
add edi, eax
lea edx, [eax + 1]
inc edi
push edi
mov esi, 0x40a3ee
mov ecx, 0x14
rep movsb byte es:[edi], byte [esi]
mov esi, 0x40a38a
mov ecx, 0x64
rep movsb byte es:[edi], byte [esi]
mov esi, 0x40a402
mov ecx, 0x4188
rep movsb byte es:[edi], byte [esi]
pop edi
lea eax, [edx + 0x4200]
push eax
push 0x414108
call fcn.0040183e
mov edi, eax
push section..bss
call fcn.00403142
push 0
push section..bss
push 0x40e83d
call fcn.00402691
push 1
push 0
push 0
push 0
call fcn.00403260
push section..bss
push 0x40e620
call fcn.004017de
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
cmp eax, 0
jne 0x40325d
push edi
push 0x414108
push 3
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegSetValueExA]
popal
leave
ret

Function at 0x403632
Capabilities:
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 0x24], 1
pushal
mov dword [ebp - 0x28], 0
mov edi, 0x40ea46
cld
mov eax, 0x402e40
stosd dword es:[edi], eax
mov eax, 0x402bc6
stosd dword es:[edi], eax
mov eax, 0x402d85
stosd dword es:[edi], eax
mov eax, 0x402de3
stosd dword es:[edi], eax
mov eax, 0x402ca9
stosd dword es:[edi], eax
mov eax, 0x402cb2
stosd dword es:[edi], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00403515
cmp eax, 1
je 0x4036f7
push 0x3e8
push 0x42cbd0
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov al, byte [0x42cbd0]
mov byte [0x42ccd4], al
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
push dword [ebp - 0x24]
pop dword [0x42c938]
push 0x42c93c
push 0x40e8c7
call fcn.004022da
mov dword [0x42c954], eax
test eax, eax
jne 0x4036dc
push 0x42c93c
push 0x40e90b
call fcn.004022da
test eax, eax
je 0x4036f7
mov dword [0x42c954], eax
push 0x42c95c
push 0x40e94c
call fcn.004022da
mov dword [0x42c958], eax
test eax, eax
je 0x4036f7
mov dword [ebp - 0x28], eax
popal
mov eax, dword [ebp - 0x28]
leave
ret
Function at 0x404359
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
xor ebx, ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040577a
mov esi, eax
mov edi, dword [ebp + 0xc]
push 0
push 0x2c
lea edx, [ebp - 0x38]
push edx
call fcn.00401721
mov ecx, esi
lea edx, [ebp - 0x38]
call fcn.004026fd
test eax, eax
je 0x4043ee
cmp byte [ebp - 0x25], 0xcc
jne 0x4043af
inc dword [ebp - 0xc]
jmp 0x4043de
mov ecx, dword [ebp - 0xc]
jecxz 0x4043de
cmp ecx, dword [ebp + 0x14]
jb 0x4043d7
mov eax, edi
sub eax, ecx
push ecx
push eax
push dword [ebp + 0x18]
call fcn.004042e6
cmp eax, 1
jne 0x4043ee
add dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x28]
jae 0x4043ee
mov dword [ebp - 0xc], 0
xor eax, eax
mov al, byte [ebp - 0x38]
add esi, eax
add edi, eax
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jb 0x404396
popal
mov eax, dword [ebp - 8]
leave
ret 0x24

Function at 0x4043f6
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
mov dword [ebp - 7], 0
mov dword [ebp - 0xf], 0
mov dword [ebp - 0xb], 0
xor ebx, ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040577a
mov esi, eax
mov edi, dword [ebp + 0xc]
push 0
push 0x39
lea edx, [ebp - 0x48]
push edx
call fcn.00401721
mov ecx, esi
lea edx, [ebp - 0x48]
call fcn.00401985
test eax, eax
je 0x40448b
cmp byte [ebp - 0x30], 0xcc
jne 0x40444c
inc dword [ebp - 0xf]
jmp 0x40447b
mov ecx, dword [ebp - 0xf]
jecxz 0x40447b
cmp ecx, dword [ebp + 0x14]
jb 0x404474
mov eax, edi
sub eax, ecx
push ecx
push eax
push dword [ebp + 0x18]
call fcn.004042e6
cmp eax, 1
jne 0x40448b
add dword [ebp - 0xb], ecx
mov eax, dword [ebp - 0xb]
cmp eax, dword [ebp + 0x28]
jae 0x40448b
mov dword [ebp - 0xf], 0
xor eax, eax
mov al, byte [ebp - 0x48]
add esi, eax
add edi, eax
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jb 0x404433
popal
mov eax, dword [ebp - 0xb]
leave
ret 0x24
Function at 0x404493
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
mov dword [ebp - 7], 0
mov dword [ebp - 0xf], 0
mov dword [ebp - 0xb], 0
xor ebx, ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040577a
mov esi, eax
mov edi, dword [ebp + 0xc]
push 0
push 0x39
lea edx, [ebp - 0x48]
push edx
call fcn.00401721
mov ecx, esi
lea edx, [ebp - 0x48]
call fcn.00401985
test eax, eax
jne 0x404503
mov edx, dword [ebp + 0xc]
add edx, ebx
push edx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push dword [ebp + 8]
call fcn.004056b6
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp + 0x10]
cmp ecx, eax
jbe 0x40454d
sub eax, edx
jmp 0x404542
cmp byte [ebp - 0x30], 0xcc
jne 0x40450e
inc dword [ebp - 0xf]
jmp 0x40453d
mov ecx, dword [ebp - 0xf]
jecxz 0x40453d
cmp ecx, dword [ebp + 0x14]
jb 0x404536
mov eax, edi
sub eax, ecx
push ecx
push eax
push dword [ebp + 0x18]
call fcn.004042e6
cmp eax, 1
jne 0x40454d
add dword [ebp - 0xb], ecx
mov eax, dword [ebp - 0xb]
cmp eax, dword [ebp + 0x28]
jae 0x40454d
mov dword [ebp - 0xf], 0
xor eax, eax
mov al, byte [ebp - 0x48]
add esi, eax
add edi, eax
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jb 0x4044d0
popal
mov eax, dword [ebp - 0xb]
leave
ret 0x24
Function at 0x40480a
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
pushal
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
push 0x41023a
push 0x41012c
push dword [ebp + 8]
call fcn.0040399e
cmp eax, 0
je 0x404a62
push dword [ebp + 8]
call fcn.00404768
mov dword [ebp - 4], eax
push eax
call fcn.004047e3
push 0
push 0x41012c
push 0x406624
call fcn.00402691
push 0
push 0x41023a
push 0x40661a
call fcn.00402691
lea edx, [ebp - 0x88]
push edx
push 0
push 0
push dword [ebp + 8]
call fcn.0040233c
test eax, eax
je 0x404a62
mov dword [ebp - 0x8c], eax
push 0x10000
call fcn.00402071
test eax, eax
je 0x404a62
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x60]
push edx
lea edx, [ebp - 0x7c]
push edx
lea edx, [ebp - 0x80]
push edx
lea edx, [ebp - 0x84]
push edx
lea edx, [ebp - 0x6c]
push edx
lea edx, [ebp - 0x78]
push edx
push dword [ebp - 0x8c]
call fcn.00403925
cmp dword [ebp - 0x84], 0
je 0x404a62
push dword [ebp - 4]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x10]
push edx
push 0xa6
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x6c]
push dword [ebp - 0x84]
push dword [ebp - 0x8c]
call fcn.00404088
push dword [ebp - 0xc]
push 0x40e846
call fcn.00404555
push dword [ebp - 0x10]
push 0x40e864
call fcn.00404555
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x8c]
call fcn.00404579
push eax
push 0x40e878
call fcn.00404555
cmp eax, dword [ebp - 0xc]
jae 0x404967
jmp 0x404a62
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x8c]
call fcn.00404627
test eax, eax
je 0x404a62
mov byte [0x42dfe1], 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0xa6
push 0x40ecfa
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x8c]
call fcn.00403e60
push eax
push 0x40e88a
call fcn.00404555
cmp eax, 0
je 0x404a62
push dword [ebp + 8]
push 0x40e598
call fcn.0040202e
push 0x41012c
push 0x40e5a8
call fcn.0040202e
push dword [ebp - 0x14]
call fcn.0040208e
push dword [ebp - 0x18]
call fcn.0040208e
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push 0x41012c
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_MoveFileA]
push 0
push dword [ebp + 8]
push 0x41012c
call dword [sym.imp.kernel32.dll_CopyFileA]
push 0
push 0x42dfe1
push dword [ebp + 8]
push 0x41012c
call fcn.00403260
push 0
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
push dword [ebp + 8]
call fcn.0040226e
test eax, eax
je 0x404a62
push dword [ebp - 0x84]
push 0x41023a
call fcn.00405111
mov dword [ebp - 0xa0], 1
cmp dword [ebp - 0x14], 0
je 0x404a70
push dword [ebp - 0x14]
call fcn.0040208e
cmp dword [ebp - 0x18], 0
je 0x404a7e
push dword [ebp - 0x18]
call fcn.0040208e
popal
mov eax, dword [ebp - 0xa0]
leave
ret 4
Function at 0x404acd
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
push 1
push 6
call dword [sym.imp.kernel32.dll_OpenFileMappingA]
test eax, eax
jne 0x404b09
push 0xc8
call dword [sym.imp.kernel32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x14
jb 0x404ae2
jmp 0x404b7c
mov ebx, eax
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
push 0
push 0
push 6
push ebx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
test eax, eax
jne 0x404b3c
push 0xc8
call dword [sym.imp.kernel32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x14
jb 0x404b12
jmp 0x404b75
mov esi, eax
mov edi, dword [ebp + 8]
push 0xc8
call dword [sym.imp.kernel32.dll_Sleep]
push dword [ebp + 0xc]
push esi
push edi
call fcn.00401736
mov dword [esi], 0x21444e45
push 0xc8
call dword [sym.imp.kernel32.dll_Sleep]
push esi
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov dword [ebp - 8], 1
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
popal
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x40504d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x14], 1
pushal
mov dword [ebp - 4], 0
lea esi, [ebp - 0x58]
lea edi, [ebp - 0x14]
push 0
push 0x44
push esi
call fcn.00401721
push 0
push 0x10
push edi
call fcn.00401721
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], 0
mov eax, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x4050e7
push dword [ebp + 8]
lea edx, [ebp - 0x260]
push edx
call fcn.004015ee
lea edx, [ebp - 0x260]
push edx
call fcn.0040176e
lea ecx, [ebp - 0x260]
mov dword [eax + ecx], 0x20
push dword [ebp + 0xc]
lea edx, [ebp - 0x260]
push edx
call fcn.00401702
lea eax, [ebp - 0x260]
push edi
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
je 0x405109
mov dword [ebp - 4], 1
popal
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x405159
Capabilities:
Get file attributes
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], pe_nt_image_headers32
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
inc eax
je 0x40519a
dec eax
mov dword [ebp - 0x18], eax
push pe_nt_image_headers32
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
inc eax
je 0x4052ca
push 0
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp + 0x14]
jae 0x4051de
mov dword [ebp + 0x14], eax
mov dword [ebp - 8], 1
test eax, eax
je 0x40524c
push eax
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
test eax, eax
je 0x4052b8
mov edi, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_ReadFile]
dec eax
jne 0x4052a9
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
jne 0x4051f8
push 0
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_SetFilePointer]
inc eax
je 0x4052a9
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_WriteFile]
dec eax
jne 0x4052a9
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
jne 0x405230
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_WriteFile]
dec eax
jne 0x4052a9
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
jne 0x405252
cmp dword [ebp - 8], 1
je 0x4052a9
cmp dword [ebp - 0xc], 0
je 0x4052b8
mov edi, dword [ebp - 0xc]
add edi, dword [ebp + 0x14]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_WriteFile]
dec eax
jne 0x4052a9
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
jne 0x405286
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0xc], 0
je 0x4052b8
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_LocalFree]
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0
je 0x4052ca
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
popal
mov eax, dword [ebp - 0x1c]
leave
ret 0x10
Function at 0xb836ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0xbc864f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00b9f564
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0xb836d2

Function at 0xb8d883
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0xb8d8ab
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0xb8d89d
pop edi
pop esi
pop ebp
ret 4
Function at 0xb90c8a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0xc42323]
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], al
push 0x8000
push edi
mov esi, edx
call fcn.00b9e5f5
pop ecx
push eax
call fcn.00b9e416
cmp dword [esi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0xbd0a14
lea ecx, [ebp - 0x18]
call fcn.00b82e83
mov ecx, esi
call fcn.00b73e4c
mov ecx, dword [esi + 8]
lea edx, [ebp - 0x18]
call fcn.00b90ed3
push dword [ebp - 0x18]
push 0xc0fcbc
push edi
call fcn.00b90d2c
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0xbd0a34
lea ecx, [ebp - 0x18]
call fcn.00b80a62
mov esi, dword [ebp - 8]
push edi
call fcn.00b9ea39
push edi
call fcn.00b9e5f5
pop ecx
pop ecx
cmp ebx, 0xffffffff
jne 0xb90d1a
mov ebx, 0x4000
push ebx
push eax
call fcn.00b9e416
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov ecx, esi
call fcn.00be3a3f
push eax
push 1
call fcn.00be39f2
push eax
call fcn.00b9e853
add esp, 0x10
mov esi, eax
jmp 0xb90d02
mov ecx, esi
call fcn.00b73e4c
mov eax, dword [esi + 8]
push dword [eax]
call dword [0xc0d240]
jmp 0xb90cf7

Function at 0xb920c9
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0xb920e0
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0xb920e2
xor eax, eax
ret

Function at 0xb926b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
push eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
pop eax
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov dword [ebp - 0xc], edi
mov esi, dword [edi]
cmp esi, edi
je 0xb9276b
xor eax, eax
mov ebx, eax
cmp dword [esi + 0x30], eax
je 0xb9273b
cmp dword [esi + 0x30], 0xffff
je 0xb9273b
lea eax, [ebp - 0x78]
push 0x64
push eax
call fcn.00b9207f
mov eax, dword [esi + 0x30]
pop ecx
pop ecx
xor ecx, ecx
jmp 0xb9270a
inc ebx
lea eax, [eax + 2]
cmp word [eax], cx
jne 0xb92706
test ebx, ebx
jle 0xb9272e
mov edi, ecx
mov eax, dword [esi + 0x30]
mov cx, word [eax + edi*2]
call fcn.00b920b1
mov word [ebp + edi*2 - 0x78], ax
inc edi
cmp edi, ebx
jl 0xb92715
mov edi, dword [ebp - 0xc]
lea ecx, [ebp - 0x78]
call fcn.00b9216d
cmp dword [ebp - 0x10], eax
je 0xb92743
mov eax, dword [esi]
mov esi, eax
cmp eax, edi
jmp 0xb926da
mov edi, dword [ebp - 0x14]
test edi, edi
je 0xb92766
push dword [esi + 0x28]
call fcn.00b92669
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x28]
push edi
call fcn.00b9262c
add esp, 0x10
les edx, [eax]
mov eax, dword [esi + 0x18]
jmp 0xb9276d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0xb92852
Capabilities:
Authenticate hmac

Disassembly:
push esi
mov esi, ecx
push esi
call fcn.00b92669
pop ecx
test eax, eax
je 0xb92873
lea ecx, [esi + eax*2]
mov edx, ecx
dec eax
sub ecx, 2
cmp word [ecx], 0x5c
je 0xb92878
test eax, eax
jne 0xb92863
or eax, 0xffffffff
pop esi
ret
mov ecx, edx
pop esi
jmp fcn.00b9216d
Function at 0xb929ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
mov byte [ebp + 0xb], cl
shr eax, 0x18
mov byte [ebp + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp + 9], al
mov eax, ecx
push edi
mov edi, edx
shr eax, 8
xor ecx, ecx
mov byte [ebp + 0xa], al
mov edx, ecx
test edi, edi
je 0xb92a36
mov al, byte [ebp + ecx + 8]
xor byte [edx + esi], al
lea eax, [ecx + 1]
sub ecx, 3
inc edx
neg ecx
sbb ecx, ecx
and ecx, eax
cmp edx, edi
jb 0xb92a1e
pop edi
pop esi
pop ebp
ret

Function at 0xb92a3a
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
movzx edi, word [ecx + 6]
xor esi, esi
test edi, edi
je 0xb92a66
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
cmp edx, dword [ecx + 0xc]
jb 0xb92a5e
mov eax, dword [ecx + 0x10]
add eax, dword [ecx + 0xc]
cmp edx, eax
jbe 0xb92a6c
inc esi
add ecx, 0x28
cmp esi, edi
jb 0xb92a4f
or eax, 0xffffffff
pop edi
pop esi
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edx
jmp 0xb92a69
Function at 0xb94333
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0xb94365

Function at 0xb95643
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
call fcn.00b920c9
mov dword [ebp - 4], eax
push 4
push 0x1000
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x50]
push edx
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
call ecx
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x6c], 0
jne 0xb95689
xor al, al
jmp fcn.00b95753
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x54]
push esp

Function at 0xb9568e
Capabilities:
Enumerate pe sections

Disassembly:
push esp
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x6c]
push eax
call fcn.00b9262c
add esp, 0xc
mov ecx, dword [ebp - 4]

Function at 0xb956a9
Capabilities:
Enumerate pe sections

Disassembly:
movzx edx, word [ecx + 6]
mov dword [ebp - 0x14], edx
push ebp
in al, dx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
jmp 0xb956dc

Function at 0xb95cb3
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
and eax, 0x20000000
je 0xb95cd3
mov dword [ebp - 0x14], 1
jmp 0xb95cda
mov dword [ebp - 0x14], 0
Function at 0xb95e23
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 0
jmp 0xb95e6f
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 0xc], eax
jge fcn.00b95ef1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0xb95eec
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
push eax
call fcn.00b95cb3
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
dec ebp
in al, dx
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00b94523
add esp, 0x18
movzx edx, al
test edx, edx
jne 0xb95eec
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x38]
call eax
jmp 0xb95e5d

Function at 0xb95f28
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor byte [esi - 0x75], dl
inc ebp
or al, 0x99
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp + 8]
call fcn.00b920c9
mov dword [ebp - 0x18], eax
mov eax, 8
imul ecx, eax, 5
mov edx, dword [ebp - 0x18]
lea eax, [edx + ecx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
xor edx, edx
sub ecx, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
dec ebp
fmul dword [ecx + 0x458bdc55]
in al, dx