joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0d4c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4b0e85
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4b0e3d
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
mov ecx, 1
mov dl, 1
mov eax, dword [0x403250]
call fcn.0040702c
mov dword [ebp - 8], eax
lea edx, [ebp - 0xc]
mov eax, dword [0x535d48]
mov eax, dword [eax]
call fcn.0048e280
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x4b0ea0
call fcn.004012c8
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b0eec
mov edx, dword [ebp - 4]
mov eax, dword [0x4a8ca8]
call fcn.004a98c4
test al, al
jne 0x4b0ddf
mov edx, 0x4b0eec
mov eax, 0x4b0f18
call fcn.00413c28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0e62
call fcn.00401c84
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x10]
mov eax, 0x4b0f48
call fcn.00401c94
mov eax, dword [ebp - 0x10]
call fcn.00401b0c
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.004071b0
test eax, eax
jle 0x4b0e29
mov edx, 0x4b0f5c
mov eax, dword [ebp - 8]
call fcn.004072bc
call fcn.00406f10
cmp ebx, eax
setg al
mov ebx, eax
jmp 0x4b0e2b
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.00401178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0e62
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0e8c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00401270
lea eax, [ebp - 4]
call fcn.00401268
ret
Function at 0x4b0f68
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4b113a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b10b6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov ecx, 1
mov dl, 1
mov eax, dword [0x403250]
call fcn.0040702c
mov dword [ebp - 8], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x403250]
call fcn.0040702c
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x10]
mov eax, dword [0x535d48]
mov eax, dword [eax]
call fcn.0048e280
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 0x4b1154
call fcn.004012c8
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b11a0
mov edx, dword [ebp - 4]
mov eax, dword [0x4a8ca8]
call fcn.004a98c4
test al, al
jne 0x4b1010
mov edx, 0x4b11a0
mov eax, 0x4b11c8
call fcn.00413c28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1117
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4b11a0
mov edx, dword [ebp - 4]
mov eax, dword [0x4a8ca8]
call fcn.004a98c4
test al, al
jne 0x4b1046
mov edx, 0x4b11a0
mov eax, 0x4b11c8
call fcn.00413c28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1117
call fcn.00401c84
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x14]
mov eax, 0x4b11ec
call fcn.00401c94
mov eax, dword [ebp - 0x14]
call fcn.00401b0c
mov esi, eax
mov eax, dword [ebp - 0xc]
call fcn.004071b0
dec eax
jge 0x4b1078
mov bl, 1
jmp 0x4b109c
mov eax, dword [ebp - 8]
call fcn.004071b0
test eax, eax
jle 0x4b109c
mov edx, 0x4b1200
mov eax, dword [ebp - 8]
call fcn.004072bc
call fcn.00406f10
sub esi, eax
dec esi
sete bl
mov eax, dword [ebp - 8]
call fcn.00401178
mov eax, dword [ebp - 0xc]
call fcn.00401178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1117
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1141
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00401270
lea eax, [ebp - 4]
call fcn.00401268
ret
Function at 0x4cc070
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cc272
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x403250]
call fcn.0040702c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4cc23b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x37c]
mov edx, eax
sub edx, 2
jae 0x4cc174
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x535d48]
mov eax, dword [eax]
call fcn.0048e280
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x380]
call fcn.00401adc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x4cc28c
call fcn.00401bfc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x535d48]
mov eax, dword [eax]
mov ecx, 0x4cc2f0
mov edx, dword [ebp - 4]
call fcn.00491bc8
test al, al
je 0x4cc221
mov eax, dword [ebp - 0xc]
call fcn.004071b0
test eax, eax
jle 0x4cc221
lea edx, [ebp - 0x28]
mov eax, 0x4cc30c
call fcn.004079b4
mov edx, dword [ebp - 0x28]
mov eax, dword [0x535d48]
mov eax, dword [eax]
mov ecx, 4
call fcn.0048f284
call fcn.00401238
jmp 0x4cc242
cmp eax, 2
jne 0x4cc221
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x44]
mov eax, dword [0x535d48]
mov eax, dword [eax]
call fcn.0048e280
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0xb
lea edx, [ebp - 0x48]
mov eax, dword [ebx + 0x380]
call fcn.00401adc
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebx + 0x384]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x40]
mov ecx, 2
mov eax, 0x4cc328
call fcn.00401bfc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x535d48]
mov eax, dword [eax]
mov ecx, 0x4cc2f0
mov edx, dword [ebp - 4]
call fcn.00491bc8
test al, al
je 0x4cc221
mov eax, dword [ebp - 0xc]
call fcn.004071b0
test eax, eax
jle 0x4cc221
lea edx, [ebp - 0x4c]
mov eax, 0x4cc30c
call fcn.004079b4
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x535d48]
mov eax, dword [eax]
mov ecx, 4
call fcn.0048f284
call fcn.00401238
jmp 0x4cc242
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc242
lea eax, [ebp - 0xc]
call fcn.00401ce4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc279
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00401270
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00401270
lea eax, [ebp - 4]
call fcn.00401268
ret
Function at 0x4dd250
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004012e0
mov eax, dword [ebp - 8]
call fcn.004012e0
xor eax, eax
push ebp
push 0x4dd34b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4dd31c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov dl, 1
mov eax, dword [0x403250]
call fcn.0040702c
mov dword [ebp - 0x14], eax
push 0x4dd364
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00401adc
push dword [ebp - 0x18]
push 0x4dd3b4
push 0x4dd3c0
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00401adc
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.004012d0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x535d48]
mov eax, dword [eax]
mov ecx, 0x4dd3e0
mov edx, dword [ebp - 0xc]
call fcn.00491bc8
mov eax, dword [ebp - 0x14]
call fcn.004071b0
test eax, eax
setg byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd323
mov eax, dword [ebp - 0x14]
call fcn.00401178
ret

Function at 0x518dec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x534ac8]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x518e17
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4020a5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4020e4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4020e4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4020e4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4020e4
cmp dword [ecx + 0x74], 0xe
jbe 0x4020e4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40823a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416660
push 0x416658
push str.FlsAlloc
push 0x1f
call fcn.004080f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40826e
push dword [ebp + 8]
mov ecx, esi
call dword [0x415148]
call esi
jmp 0x408274
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4082b8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416670
push 0x416668
push str.FlsGetValue
push 0x21
call fcn.004080f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4082ef
push dword [ebp + 8]
mov ecx, esi
call dword [0x415148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4082f7
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416678
push 0x416670
push str.FlsSetValue
push 0x22
call fcn.004080f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408331
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x415148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40ba16
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40bab3
push ebx
push esi
call fcn.0040b9df
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b973
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40ba60
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bab2
push edi
push eax
call fcn.004089e9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40ba80
call fcn.00407f8b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bab1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b973
add esp, 0x20
test eax, eax
jne 0x40ba9f
push edi
call fcn.00407f8b
jmp 0x40baa7
push ebx
call fcn.00407f8b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x410045
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x41e190]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x410085
cmp byte [ebx], 0xa
jne 0x410085
or byte [edi + eax + 0x28], 4
jmp 0x41008a
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x410189
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41016c
inc eax
cmp dl, 0xd
je 0x4100b6
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4100dc
cmp eax, ecx
jae 0x4100ea
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41009e
jmp 0x410189
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410167
cmp dword [ebp - 0x10], 0
je 0x410167
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x41e190]
test byte [eax + edi + 0x28], 0x48
je 0x410141
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41012c
mov byte [esi], dl
jmp 0x41013d
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x41e190]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x410189
cmp byte [ebp - 1], 0xa
jne 0x410150
cmp esi, ebx
jne 0x410150
mov byte [esi], 0xa
jmp 0x410188
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00411a97
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x410189
mov byte [esi], 0xd
jmp 0x410188
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x41e190]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x410186
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x410189
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x410192
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x41e190]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4101d8
cmp word [ebx], dx
jne 0x4101d8
or byte [eax + edi + 0x28], 4
jmp 0x4101dd
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x410340
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x410320
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41021e
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x410254
cmp eax, edx
jae 0x410262
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4101f9
jmp 0x410340
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41031b
cmp dword [ebp - 0x18], 0
je 0x41031b
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x41e190]
test byte [eax + edi + 0x28], 0x48
je 0x4102f1
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x4102b5
mov word [esi], cx
jmp 0x4102ec
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x41e190]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x41e190]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x41e190]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x410340
pop eax
cmp word [ebp - 4], ax
jne 0x410301
cmp esi, ebx
jne 0x410301
mov word [esi], ax
jmp 0x41033d
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00411a97
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x410340
push 0xd
pop eax
jmp 0x4102fc
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x41e190]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41033a
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x410340
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4143c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4143ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4143ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10009a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push edi
mov ebx, 0x126
push ebx
call fcn.10009ca8
mov edi, eax
pop ecx
test edi, edi
je 0x10009abe
push esi
push 0x22
lea eax, [ebp - 0x50]
xor esi, esi
push eax
push esi
push 0x1bdeac
push 0x34
push 0x2732
call dword [0x1ba0cc]
test eax, eax
jne 0x10009a94
mov eax, esi
inc eax
cmp eax, 0x14
jb 0x10009a8c
jmp 0x10009a9c
mov ecx, esi
inc ecx
cmp ecx, 0x22
jb 0x10009a96
mov edx, 0x1bf660
sub edx, edi
mov eax, esi
lea ecx, [esi + edi]
and eax, 0xf
mov al, byte [eax + 0x1bdce0]
xor al, byte [edx + ecx]
inc esi
mov byte [ecx], al
cmp esi, ebx
jb 0x10009aa3
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x10009e79
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov ebx, dword [edi + 0x3c]
mov eax, dword [ebx + edi + 0x78]
test eax, eax
je 0x10009eed
lea ecx, [eax + edi]
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 0x14], eax
add edx, edi
mov eax, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x18]
add eax, edi
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x10009eed
mov esi, dword [edx + eax*4]
add esi, edi
push 0
push esi
call fcn.1000da1e
pop ecx
mov edx, eax
mov ecx, esi
call fcn.1000f1d2
xor eax, 0x218fe95b
cmp eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
pop ecx
je 0x10009ef4
mov edx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0xc]
jb 0x10009ebc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebx + edi + 0x78]
add ecx, edi
mov esi, dword [esi + eax*4]
add esi, edi
cmp esi, ecx
jb 0x10009f61
mov eax, dword [ebx + edi + 0x7c]
add eax, ecx
cmp esi, eax
jae 0x10009f61
xor eax, eax
mov cl, byte [esi + eax]
cmp cl, 0x2e
je 0x10009f2f
test cl, cl
je 0x10009f2f
mov byte [ebp + eax - 0x58], cl
inc eax
cmp eax, 0x40
jb 0x10009f19
cmp byte [eax + esi], 0
mov dword [ebp + eax - 0x58], 0x6c6c642e
mov byte [ebp + eax - 0x54], 0
je 0x10009f45
inc esi
add esi, eax
lea eax, [ebp - 0x58]
push eax
call dword [0x1ba0c8]
test eax, eax
je 0x10009eed
push esi
push eax
call dword [0x1ba0b4]
test eax, eax
je 0x10009eed
jmp 0x10009eef
mov eax, esi
jmp 0x10009eef
Function at 0x10009f65
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
test eax, eax
je 0x10009fba
mov edx, dword [eax + esi + 0x20]
xor edi, edi
mov ebx, dword [eax + esi + 0x24]
add edx, esi
mov ecx, dword [eax + esi + 0x1c]
add ebx, esi
mov eax, dword [eax + esi + 0x18]
add ecx, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp + 8], eax
test eax, eax
je 0x10009fba
mov edx, dword [edx + edi*4]
mov ecx, dword [ebp + 0xc]
add edx, esi
call fcn.1000c012
test eax, eax
je 0x10009fc1
mov edx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 8]
jb 0x10009fa0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
movzx eax, word [ebx + edi*2]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0x10009fbc

Function at 0x1000a776
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, edi
mov dword [ebp - 4], ecx
cmp edi, edx
jae 0x1000a7a0
mov ebx, dword [ebp + 8]
mov eax, esi
and eax, 0x7f
mov al, byte [eax + ebx]
cmp al, byte [esi + ecx]
je 0x1000a7ca
inc esi
cmp esi, edx
jb 0x1000a78e
push 0x22
lea eax, [ebp - 0x54]
xor ebx, ebx
push eax
push ebx
push 0x1bdec0
push 0x172
push 0xdc
call dword [0x1ba0cc]
test eax, eax
jne 0x1000a808
inc ebx
cmp ebx, 0x14
jb 0x1000a7c2
jmp 0x1000a80e
sub esi, edi
je 0x1000a7a0
lea eax, [esi + 1]
push eax
call fcn.10009ca8
pop ecx
mov ecx, eax
mov dword [ebp + 0x10], ecx
test ecx, ecx
jne 0x1000a7e8
mov eax, 0x1c107a
jmp 0x1000a815
mov edx, ecx
mov ecx, dword [ebp - 4]
sub edx, edi
mov eax, edi
and eax, 0x7f
mov al, byte [eax + ebx]
xor al, byte [edi + ecx]
mov byte [edx + edi], al
inc edi
sub esi, 1
jne 0x1000a7ef
mov ecx, dword [ebp + 0x10]
jmp 0x1000a813
inc ebx
cmp ebx, 0x22
jb 0x1000a808
mov ecx, 0x1c107a
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000a81a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov ebx, edi
cmp esi, edx
jae 0x1000a855
mov ecx, dword [ebp + 8]
mov eax, esi
and eax, 0x7f
mov al, byte [eax + ecx]
mov ecx, dword [ebp - 4]
cmp al, byte [esi + ecx]
je 0x1000a84e
inc esi
cmp esi, edx
jb 0x1000a831
mov esi, dword [ebp + 0x10]
jmp 0x1000a855
mov ebx, esi
mov esi, dword [ebp + 0x10]
sub ebx, esi
push 0x22
lea eax, [ebp - 0x54]
push eax
push edi
push 0x1bded0
push 0xb4
push 0x7d3
call dword [0x1ba0cc]
test eax, eax
jne 0x1000a87f
mov eax, edi
inc eax
cmp eax, 0x14
jb 0x1000a877
jmp 0x1000a887
mov ecx, edi
inc ecx
cmp ecx, 0x22
jb 0x1000a881
lea eax, [ebx*2 + 2]
push eax
call fcn.10009ca8
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x1000a8a2
mov eax, 0x1c10ac
jmp 0x1000a8c6
test ebx, ebx
je 0x1000a8c4
mov edx, dword [ebp + 8]
mov eax, esi
and eax, 0x7f
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
xor al, byte [esi + edx]
movzx eax, al
mov word [ecx + edi*2], ax
inc edi
inc esi
cmp edi, ebx
jb 0x1000a8a6
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000c077
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
inc eax
push eax
call fcn.10009ca8
mov edx, eax
pop ecx
test edx, edx
je 0x1000c0a8
xor ecx, ecx
cmp dword [esi], ecx
jbe 0x1000c0a8
mov eax, ecx
and eax, 3
mov al, byte [eax + esi + 0x108]
xor al, byte [esi + ecx + 4]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi]
jb 0x1000c090
mov eax, edx
pop esi
ret