joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431825
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov ecx, dword [ebp + 8]
mov ebx, edx
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
mov dword [ebp - 4], eax
lea eax, [edi + 0x60]
cmp dword [edi + 0x58], esi
jle 0x431864
cmp dword [eax], edx
jne 0x43185b
cmp dword [eax + 4], ecx
jne 0x43185b
cmp byte [eax + 8], 0
je 0x431876
cmp dword [ebp + 0x14], 0
jne 0x431876
inc esi
add eax, 0x10
cmp esi, dword [edi + 0x58]
jl 0x431846
test ecx, ecx
jns 0x431898
test ebx, ebx
je 0x43187e
cmp byte [ebx + 0x3d], 0
je 0x43187e
push 0xb
jmp 0x431880
mov eax, dword [eax + 0xc]
jmp 0x43192c
push 0x28
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
pop edx
push esi
push ebx
call fcn.004289ac
mov edx, dword [ebp + 8]
pop ecx
pop ecx
jmp 0x4318f8
mov esi, dword [ebp + 0x10]
push esi
push ecx
mov ecx, dword [ebp - 4]
push edx
push 3
lfence
pop edx
test ebx, ebx
jne 0x4318b5
call fcn.00428924
add esp, 0xc
jmp 0x4318f2
cmp byte [ebx + 0x3d], 0
push 0x32
pop eax
cmovne edx, eax
call fcn.00428924
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, ebx
push dword [ebp + 8]
call fcn.00444fe7
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
pop ecx
imul ecx, edx, 0x14
cmp byte [eax + ecx + 0x12], 0x65
jne 0x4318f5
mov ecx, dword [ebp - 4]
push esi
push 0x1d
pop edx
call fcn.00428998
pop ecx
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [edi + 0x54], 0
jne 0x43192a
mov ecx, dword [edi + 0x5c]
lea eax, [ecx + 6]
shl eax, 4
add eax, edi
mov dword [eax], ebx
mov dword [eax + 4], edx
mov dword [eax + 0xc], esi
mov byte [eax + 8], 0
lea eax, [ecx + 1]
cmp eax, 0xa
sbb ecx, ecx
and ecx, eax
cmp ecx, dword [edi + 0x58]
jle 0x431927
mov dword [edi + 0x58], ecx
mov dword [edi + 0x5c], ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4346cb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], esi
mov ebx, dword [edi]
test edx, edx
je 0x43471f
add edx, 0x1c
mov ecx, ebx
call fcn.00435595
mov dword [ebp + 0x10], eax
test eax, eax
je 0x43481a
push 0
push 0
push eax
mov edx, esi
mov ecx, edi
call fcn.00434c3e
add esp, 0xc
mov esi, eax
push dword [ebp + 0x10]
push ebx
call fcn.0041a0e3
pop ecx
pop ecx
test esi, esi
jne 0x43481a
push 0x24
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.0044f970
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x28], edi
call fcn.00434233
test eax, eax
jne 0x434817
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
call fcn.00434233
test eax, eax
jne 0x434817
mov edx, dword [ebp + 0x1c]
lea ecx, [ebp - 0x28]
call fcn.00434233
test eax, eax
jne 0x434817
mov ecx, edi
call fcn.0044149c
push 4
pop edx
mov ecx, edi
mov dword [ebp + 0x10], eax
call fcn.004331a0
mov edx, dword [ebp + 0x14]
mov esi, eax
push esi
mov ecx, edi
call fcn.00432700
mov edx, dword [ebp + 0x18]
pop ecx
lea ecx, [esi + 1]
push ecx
mov ecx, edi
call fcn.00432700
mov edx, dword [ebp + 0x1c]
lea eax, [esi + 2]
pop ecx
push eax
mov ecx, edi
call fcn.00432700
mov edi, dword [ebp + 0x10]
pop ecx
test edi, edi
je 0x43481a
lea eax, [esi + 3]
mov ecx, edi
sub esi, dword [ebp + 0xc]
push eax
add esi, 3
push esi
push 0
push 0x16
pop edx
call fcn.00428924
mov dl, byte [ebp + 0xc]
add esp, 0xc
mov ecx, edi
call fcn.00428ca8
push 0
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00457a20
mov edx, dword [ebp + 8]
pop ecx
push eax
mov ecx, ebx
call fcn.0043874c
push 0xfffffffffffffffb
push eax
or edx, 0xffffffff
mov ecx, edi
call fcn.00428d97
xor eax, eax
mov ecx, edi
cmp dword [ebp - 4], 0x18
sete al
push eax
push 0xe
pop edx
call fcn.00428998
add esp, 0x1c
jmp 0x43481a
inc dword [edi + 0x40]
mov edx, dword [ebp + 0x14]
mov ecx, ebx
call fcn.0042ff61
mov edx, dword [ebp + 0x18]
mov ecx, ebx
call fcn.0042ff61
mov edx, dword [ebp + 0x1c]
mov ecx, ebx
call fcn.0042ff61
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436f7e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [edx + 0x10]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov edx, dword [edx + 0x24]
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x44]
mov esi, dword [edi]
mov ecx, esi
mov dword [ebp - 4], eax
inc eax
mov dword [ebp - 0xc], eax
call fcn.0043f14c
mov ecx, dword [esi + 8]
mov ebx, eax
mov esi, dword [ebp - 0x10]
imul edx, ebx, 0x18
mov dword [ebp - 8], ebx
push dword [edx + ecx]
mov ecx, edi
push 0
push dword [esi]
push 0x1b
pop edx
call fcn.00434c3e
add esp, 0xc
test eax, eax
jne 0x437156
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov ecx, edi
push dword [eax + 4]
push 1
push dword [eax + 0x18]
call fcn.00434cfa
add esp, 0xc
mov ecx, edi
call fcn.0044149c
mov ebx, eax
test ebx, ebx
je 0x437156
cmp dword [ebp + 8], 0
jl 0x43700b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
jmp 0x437021
push dword [ebp - 8]
mov eax, dword [esi + 0x14]
mov ecx, ebx
push eax
push 0x61
pop edx
mov dword [ebp - 0x10], eax
call fcn.004289ac
pop ecx
pop ecx
mov edx, esi
mov ecx, edi
call fcn.00438433
push 0xfffffffffffffff0
push eax
push dword [ebp - 8]
mov ecx, ebx
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 9
pop edx
call fcn.004289c1
add esp, 0x14
cmp dword [ebp + 8], 0
jl 0x437052
mov dl, 1
mov ecx, ebx
call fcn.00428ca8
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov edx, dword [ebp - 4]
push 0xd
push eax
push dword [ebp - 8]
call fcn.00438a2a
add esp, 0xc
mov ecx, ebx
push 0
push dword [ebp - 4]
push 0x77
pop edx
call fcn.004289ac
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.0043315f
push 1
push eax
push dword [ebp - 4]
mov edx, esi
mov dword [ebp - 0x14], eax
call fcn.004391d1
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp byte [esi + 0x18], 0
je 0x437101
mov esi, dword [esi + 4]
mov ecx, ebx
push esi
push 0
push eax
push 0x41
pop edx
call fcn.00428924
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, esi
mov edi, eax
push 0xfffffffffffffff2
push dword [ebp - 0x14]
push ecx
push 0
push dword [ebp - 0xc]
mov ecx, ebx
push 0x23
pop edx
call fcn.004289c1
add esp, 0x14
mov ecx, ebx
mov esi, eax
push 0xfffffffffffffffe
push str.indexed_columns_are_not_unique
push 0
push 2
push 0x13
push 0x27
pop edx
call fcn.004289c1
add esp, 0x14
mov edx, edi
mov ecx, ebx
call fcn.00428cbe
mov edx, esi
mov ecx, ebx
call fcn.00428cbe
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, ebx
push esi
push dword [ebp - 0xc]
push 0x6b
pop edx
call fcn.004289ac
mov edx, esi
mov ecx, edi
call fcn.0043317b
mov edi, dword [ebp - 8]
mov ecx, ebx
mov esi, dword [ebp - 4]
lea eax, [edi + 1]
push eax
push esi
push 0x6a
pop edx
call fcn.004289ac
mov edx, edi
mov ecx, ebx
call fcn.00428cbe
push esi
push 0x21
pop edx
mov ecx, ebx
call fcn.00428998
add esp, 0x14
lea eax, [esi + 1]
mov ecx, ebx
push eax
push 0x21
pop edx
call fcn.00428998
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43ade3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
mov ebx, edx
mov edi, ecx
cmp byte [eax + 0x3c], 0
je 0x43ae94
mov eax, dword [edi]
mov ecx, dword [edi + 0x44]
imul edx, ebx, 0x18
push esi
mov esi, dword [edi + 0xc]
push 9
mov dword [ebp - 4], ecx
add edx, dword [eax + 8]
inc dword [edi + 0x48]
mov eax, dword [edi + 0x48]
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x14]
mov edx, ecx
mov ecx, edi
mov dword [ebp + 8], esi
push dword [eax + 0x54]
push ebx
call fcn.00438a2a
mov edi, dword [ebp + 0xc]
mov ecx, esi
lea ebx, [edi + 1]
push ebx
push 0x42
pop edx
call fcn.00428998
mov ecx, dword [ebp + 8]
mov esi, eax
push ebx
push dword [ebp - 4]
push 0x1a
pop edx
call fcn.004289ac
mov ecx, dword [ebp + 8]
mov edx, esi
call fcn.00428cbe
mov esi, dword [ebp - 8]
lea eax, [edi - 1]
mov edi, dword [ebp + 8]
mov ecx, edi
push esi
push 2
push eax
push 0x59
pop edx
call fcn.00428924
push ebx
mov ebx, dword [ebp - 4]
mov ecx, edi
push esi
push ebx
push 0x6c
pop edx
call fcn.00428924
mov dl, 8
mov ecx, edi
call fcn.00428ca8
push ebx
push 0x21
pop edx
call fcn.00428998
add esp, 0x34
pop esi
pop edi
pop ebx
leave
ret
Function at 0x43fce1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [edx]
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edi
mov eax, dword [edi + 0xc]
mov dword [ebp - 4], eax
lea eax, [esi + 2]
mov edx, eax
mov dword [ebp - 0x10], eax
call fcn.004331a0
mov ecx, edi
mov ebx, eax
call fcn.0043315f
mov edx, dword [ebp - 8]
mov edi, eax
push 0
push ebx
call fcn.0043287d
mov eax, dword [ebp - 8]
add esi, ebx
mov ecx, dword [ebp - 4]
push esi
push dword [eax + 8]
push 5
pop edx
call fcn.004289ac
mov edx, dword [ebp + 0xc]
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
push 1
push eax
call fcn.004319b6
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
push edi
push esi
push ebx
push 0x59
pop edx
call fcn.00428924
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push edi
push dword [eax + 8]
push 0x6b
pop edx
call fcn.004289ac
mov ecx, dword [ebp - 0xc]
mov edx, edi
call fcn.0043317b
mov ecx, dword [ebp - 0xc]
mov edx, ebx
push esi
call fcn.004331d9
mov eax, dword [ebp + 8]
add esp, 0x30
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x43fdf4
mov eax, dword [eax + 0x38]
test eax, eax
mov ebx, dword [ebp - 4]
lea esi, [eax + 1]
cmove esi, ecx
mov ecx, ebx
push esi
push 0x7b
pop edx
call fcn.00428998
push 0xffffffffffffffff
push esi
push 0x2a
pop edx
mov ecx, ebx
mov edi, eax
call fcn.004289ac
push 0x5e
pop edx
mov ecx, ebx
call fcn.0042898a
mov edx, edi
mov ecx, ebx
mov esi, eax
call fcn.00428cbe
mov edi, dword [ebp - 8]
mov ecx, ebx
push dword [edi + 8]
push 0x34
pop edx
call fcn.00428998
push dword [edi + 8]
mov ecx, ebx
push 0x5b
pop edx
call fcn.00428998
add esp, 0x14
mov edx, esi
mov ecx, ebx
call fcn.00428cbe
mov eax, dword [ebp + 8]
and dword [eax + 0x34], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43fdf9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi + 0x38], 0
je 0x43fe48
cmp dword [ebp + 8], 0
je 0x43fe48
push 0xffffffffffffffff
push dword [esi + 0x38]
push 0x2a
pop edx
call fcn.004289ac
push dword [esi + 0x38]
mov ecx, edi
push 0x17
pop edx
call fcn.00428998
push dword [ebp + 8]
mov ecx, edi
mov esi, eax
push 0
push 0x5e
pop edx
call fcn.004289ac
add esp, 0x14
mov ecx, edi
mov edx, esi
pop edi
pop esi
pop ebp
jmp fcn.00428cbe
pop edi
pop esi
pop ebp
ret
Function at 0x4414c6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
mov esi, ecx
cmp dword [edi + 0x34], ebx
jne 0x4415e0
cmp dword [edi + 0x2c], ebx
je 0x441524
inc dword [esi + 0x48]
mov ebx, dword [esi + 0x48]
mov dword [edi + 0x34], ebx
call fcn.0044149c
mov dword [ebp - 8], eax
test eax, eax
je 0x4415e0
mov edx, dword [edi + 0x2c]
mov ecx, esi
push ebx
call fcn.00432700
mov ecx, dword [ebp - 8]
push ebx
push 0x26
pop edx
call fcn.00428998
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
push ebx
push 0x7b
pop edx
call fcn.004289ac
add esp, 0x10
cmp dword [edi + 0x30], 0
je 0x4415e0
inc dword [esi + 0x48]
cmp dword [edi + 0x2c], 0
mov eax, dword [esi + 0x48]
mov dword [ebp - 4], eax
mov dword [edi + 0x38], eax
je 0x441543
inc dword [esi + 0x48]
mov ecx, esi
call fcn.0044149c
mov dword [ebp - 8], eax
test eax, eax
je 0x4415e0
push dword [ebp - 4]
mov edx, dword [edi + 0x30]
mov ecx, esi
call fcn.00432700
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
push 0x26
pop edx
call fcn.00428998
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
push 0x7f
pop edx
call fcn.00428998
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov esi, eax
push 0
push 0x30
pop edx
call fcn.004289ac
add esp, 0x14
mov edx, esi
mov esi, dword [ebp - 8]
mov ecx, esi
call fcn.00428cbe
cmp dword [edi + 0x2c], 0
je 0x4415e0
mov eax, dword [ebp - 4]
mov ecx, esi
lea edi, [eax + 1]
push edi
push eax
push ebx
push 0x4e
pop edx
call fcn.00428924
push ebx
push 0x7f
mov ebx, esi
pop edx
mov ecx, ebx
call fcn.00428998
push edi
push 0xffffffffffffffff
push 0x30
pop edx
mov ecx, ebx
mov esi, eax
call fcn.004289ac
add esp, 0x18
mov edx, esi
mov ecx, ebx
call fcn.00428cbe
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4487f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [edx]
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push edi
test esi, esi
jg 0x448819
call fcn.0043315f
mov esi, eax
mov eax, ecx
mov cl, byte [edx]
mov edi, dword [ebp + 8]
cmp cl, 0x44
jne 0x448837
mov edx, dword [edx + 0xc]
mov ecx, eax
push esi
call fcn.00431b22
pop ecx
mov dword [ebp + 0xc], eax
jmp 0x4488fa
mov dword [ebp + 0xc], esi
cmp cl, 0x41
jne 0x448852
push esi
push 0
push 0x74
pop edx
mov ecx, ebx
call fcn.004289ac
pop ecx
jmp 0x4488f3
push 0
mov ecx, eax
call fcn.00431133
pop ecx
mov ecx, dword [ebp - 8]
push 0
mov dword [ebp - 0xc], eax
mov ecx, dword [ecx + 0x24]
push ecx
mov dword [ebp - 8], ecx
mov ecx, ebx
push 0x77
pop edx
call fcn.004289ac
mov eax, dword [edi + 0x3c]
pop ecx
pop ecx
test eax, eax
jne 0x44888b
mov ecx, ebx
call fcn.004289f0
mov dword [edi + 0x20], eax
mov eax, dword [edi + 0x3c]
mov ecx, dword [ebp - 4]
inc eax
mov edx, dword [edi + 0x40]
mov dword [edi + 0x3c], eax
shl eax, 3
mov ecx, dword [ecx]
push eax
call fcn.0041a35e
pop ecx
mov ecx, eax
mov dword [ebp - 4], ecx
mov dword [edi + 0x40], ecx
test ecx, ecx
je 0x4488f6
cmp dword [ebp - 0xc], 1
mov edx, dword [edi + 0x3c]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], edx
push esi
mov dword [ecx + edx*8 - 8], eax
mov ecx, ebx
jne 0x4488d0
push eax
push 0x28
pop edx
call fcn.004289ac
pop ecx
pop ecx
jmp 0x4488de
push 0
push eax
push 3
pop edx
call fcn.00428924
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
push esi
push 0x41
mov dword [ecx + edx*8 - 4], eax
mov ecx, ebx
pop edx
call fcn.00428998
pop ecx
jmp 0x4488fa
and dword [edi + 0x3c], 0
mov edx, dword [ebp - 0x14]
mov ecx, edi
call fcn.0044876a
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x41d190
cmp edx, dword [eax]
je 0x41978b
add eax, 8
inc ecx
cmp eax, 0x41d220
jl 0x41977c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x41d190]
jne 0x4198b9
mov eax, dword [0x41dbb0]
cmp eax, 1
je 0x419893
test eax, eax
jne 0x4197bc
cmp dword [0x41d0e4], 1
je 0x419893
cmp edx, 0xfc
je 0x4198b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4197f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041a670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041a490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x419836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041a490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41c45c
push edi
call fcn.0041af00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041a670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041a680
lea eax, [ebp - 0xa0]
push 0x41c43c
push eax
call fcn.0041a680
push dword [esi + 0x41d194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041a680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041ae75
add esp, 0x2c
pop edi
jmp 0x4198b9
lea eax, [ebp + 8]
lea esi, [esi + 0x41d194]
push 0
push eax
push dword [esi]
call fcn.0041a490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x256261d7
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..text
nop
mov ebx, 0x42e1d0
mov ecx, 0x268014f9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10002760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x1017208c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x168], edi
test ecx, ecx
je 0x10002925
push 0x40
lea eax, [ebp - 0x6c]
mov dword [edi], ecx
push eax
push 0
call fcn.100043c0
mov ecx, dword [ebp - 0x30]
mov eax, 0x5a4d
mov dword [edi + 0xc], ecx
cmp word [ebp - 0x6c], ax
je 0x100027b3
mov eax, dword [edi]
cmp ecx, dword [eax + 0x56]
ja 0x10002925
push 0xf8
lea eax, [ebp - 0x164]
push eax
push ecx
mov ecx, dword [edi]
call fcn.100043c0
cmp dword [ebp - 0x164], 0x4550
jne 0x10002925
mov ax, word [ebp - 0x14c]
mov edx, 0x10b
movzx ecx, word [ebp - 0x15e]
mov dword [edi + 8], ecx
cmp ax, dx
jne 0x100027fb
mov dword [edi + 4], 1
jmp 0x1000280c
mov edx, 0x20b
cmp ax, dx
jne 0x1000280c
mov dword [edi + 4], 2
mov eax, dword [ebp - 0xcc]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0xc8]
mov dword [edi + 0x20], eax
cmp ecx, 0x100
ja 0x10002925
lea eax, [ecx + ecx*4]
mov ecx, dword [edi]
shl eax, 3
push eax
call fcn.10001100
mov esi, eax
mov dword [ebp - 0x170], esi
test esi, esi
je 0x10002925
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0xc]
push ebx
lea ecx, [ecx + ecx*4]
shl ecx, 3
push ecx
movzx ecx, word [ebp - 0x150]
add ecx, 0x18
add eax, ecx
mov ecx, dword [edi]
push esi
push eax
call fcn.100043c0
mov eax, dword [edi + 8]
mov ecx, 1
mov dword [ebp - 0x16c], ecx
cmp eax, ecx
jbe 0x100028f3
nop dword [eax]
lea ebx, [eax - 1]
cmp ebx, ecx
jb 0x100028e8
lea eax, [ebx + ebx*4]
sub ebx, ecx
lea esi, [esi + eax*8]
add esi, 0xffffffd8
inc ebx
mov eax, dword [esi + 0x3c]
cmp eax, dword [esi + 0x14]
jae 0x100028d1
mov ecx, dword [ebp - 0x168]
lea edi, [esi + 0x28]
push 0x28
push edi
lea eax, [ebp - 0x2c]
mov ecx, dword [ecx]
push eax
call fcn.10004c40
push 0x28
push esi
push edi
mov edi, dword [ebp - 0x168]
mov ecx, dword [edi]
call fcn.10004c40
mov ecx, dword [edi]
lea eax, [ebp - 0x2c]
push 0x28
push eax
push esi
call fcn.10004c40
sub esi, 0x28
sub ebx, 1
jne 0x10002893
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0x16c]
mov esi, dword [ebp - 0x170]
inc ecx
mov dword [ebp - 0x16c], ecx
cmp ecx, eax
jb 0x10002880
mov ebx, dword [edi]
lea eax, [eax + eax*4]
lea esi, [esi + eax*8]
mov eax, dword [esi - 0x14]
add eax, dword [esi - 0x18]
mov edx, dword [ebx + 0x56]
sub edx, dword [edi + 0x20]
cmp edx, eax
jbe 0x10002917
mov dword [edi + 0x14], eax
sub edx, dword [esi - 0x18]
sub edx, dword [esi - 0x14]
mov dword [edi + 0x18], edx
push dword [ebp - 0x170]
mov ecx, ebx
call fcn.100010e0
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100ad37d
mov esp, ebp
pop ebp
ret 4
Function at 0x10032eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
mov dword [ebp - 8], edi
cmp word [edi + 0x1e83], 5
je 0x10032ed2
mov eax, 5
pop edi
mov esp, ebp
pop ebp
ret 4
movzx eax, word [ebp + 8]
add eax, 0x1e7a
add eax, edi
push ebx
mov dword [ebp + 8], eax
mov bl, 5
lea eax, [edi + 0x1e85]
mov edi, dword [ebp + 8]
push esi
mov esi, 5
mov dword [ebp - 4], eax
mov edx, eax
mov al, byte [edi]
lea edx, [edx + 1]
xor al, byte [edx - 1]
mov ecx, esi
and ecx, 7
dec esi
rol al, cl
mov byte [edx - 1], al
add bl, 0xff
jne 0x10032ef7
mov edi, dword [ebp - 8]
mov ecx, edi
push 5
push dword [ebp - 4]
push dword [edi + 0x13a7c]
call fcn.10004450
push 0xc00
push 0
push dword [edi + 0x13a80]
mov ecx, edi
call fcn.10003b20
pop esi
pop ebx
mov eax, 3
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10032f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov si, word [ebp + 8]
mov eax, 0x200
cmp si, ax
mov edx, 0x2f
push edi
mov edi, ecx
sbb eax, eax
and eax, 0xffffd000
lea ebx, [edi + 0x4a7a]
add ebx, eax
mov eax, dword [edi + 0x1ab5]
mov dword [ebp + 8], eax
cmp si, dx
jbe 0x10032fa3
movzx ecx, dx
add edx, 4
mov eax, dword [ecx + ebx]
xor eax, dword [ebp + 8]
xor eax, 0x130
mov dword [ecx + edi + 0x2a7a], eax
cmp dx, si
jb 0x10032f86
pop edi
movzx eax, si
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100364f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100365af
cmp dword [0x10172b10], 0
jne 0x10036543
push 0x1c
call fcn.100ad535
add esp, 4
test eax, eax
je 0x1003652a
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], 0
jmp 0x1003652c
xor eax, eax
mov dword [0x10172b10], eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], 0
push 0x100c0738
push esi
call fcn.100b08f7
mov esi, eax
add esp, 8
test esi, esi
je 0x100365af
push edi
push esi
push 0x1c
push 1
push dword [0x10172b10]
call fcn.100b0dbf
mov eax, dword [0x10172b10]
add esp, 0x10
mov edi, dword [eax + 4]
mov eax, dword [0x10172b14]
sub edi, 0x1c
test eax, eax
jne 0x1003659b
push edi
call fcn.100ad573
push edi
push 0
push eax
mov dword [0x10172b14], eax
call fcn.100ae310
mov eax, dword [0x10172b14]
add esp, 0x10
push esi
push edi
push 1
push eax
call fcn.100b0dbf
push esi
call fcn.100b07b6
add esp, 0x14
pop edi
xor eax, eax
pop esi
pop ebp
ret