joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010810
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, dl
push esi
mov esi, dword [ebp + 8]
shl eax, 2
mov dword [ebp - 0x18], 0
push edi
mov edi, ecx
test eax, eax
jne 0x1001083a
mov eax, dword [edi]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [edi]
test eax, eax
mov eax, dword [ebp + 8]
setne dl
mov byte [ebp - 0xc], dl
mov dword [eax], ecx
test dl, dl
je 0x10010878
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10013840
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.10009500
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe9
test eax, eax
je 0x1001389a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x100138da
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100138f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x18], 0
test edi, edi
jne 0x1001390d
mov byte [ebp - 0xc], cl
jmp 0x10013927
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
push edi
push 0x90
push esi
call fcn.1001f4f0
add esp, 0xc
cmp byte [ebp - 0xc], 0
je 0x10013953
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013960
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
sub edi, esi
jne 0x1001397f
mov byte [ebp - 8], 0
jmp 0x10013999
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
push edi
push 0x90
push esi
call fcn.1001f4f0
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x100139c5
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a3f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
xor ecx, ecx
mov word [esi], cx
test eax, eax
je 0x1001a439
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001a860
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
push eax
push 0x40
push 4
push esi
mov edi, ecx
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x1001a8a9
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001c340
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov ecx, 0x401000
call fcn.1001c520
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.1000cbb0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1001c39e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x1001c3b0
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.1001c7f0
cmp eax, 0x16197be9
jne 0x1001c3cb
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.1001c7f0
cmp eax, 0x94bf
jne 0x1001c3e6
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.1001c7f0
cmp eax, 0x94bf
jne 0x1001c401
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.1001c7f0
cmp eax, 0x94bf
jne 0x1001c41c
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.1001c7f0
cmp eax, 0x3539f633
jne 0x1001c437
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.1001c7f0
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001c780
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
movss dword [ebp - 8], xmm1
call fcn.1001c520
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 0xc]
push eax
call fcn.1000cbb0
mov dword [ebp - 0x18], 4
mov esi, dword [eax]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [ebp - 8]
test eax, eax
setne byte [ebp - 0x10]
movss dword [esi], xmm0
cmp byte [ebp - 0x10], 0
je 0x1001c7e7
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001c7f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
call fcn.1001c520
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.1000cbb0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1001c849
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100311a9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003101f

Function at 0x100334e5
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10033467
Function at 0x4695e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x36000]
push edi
jmp 0x4695fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x469601
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4695f0
mov eax, 1
add ebx, ebx
jne 0x469613
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x469608
jne 0x469624
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x469608
xor ecx, ecx
sub eax, 3
jb 0x469638
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4696aa
mov ebp, eax
add ebx, ebx
jne 0x469643
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x469650
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x469674
inc ecx
add ebx, ebx
jne 0x469660
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x469655
jne 0x469671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x469655
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x469694
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x469685
jmp 0x4695f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x469694
add edi, ecx
jmp 0x4695f6
pop esi
lea edi, [esi + 0x65000]
mov eax, dword [edi]
or eax, eax
je 0x4696fc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x69bb8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x69bf4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4696b1
mov ecx, edi
jns 0x4696e0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x69bfc]
or eax, eax
je 0x4696f6
mov dword [ebx], eax
add ebx, 4
jmp 0x4696ce
call dword [esi + 0x69bf8]
mov ebp, dword [esi + 0x69c00]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x469730
sub esp, 0xffffff80
jmp 0x401a3c
Function at 0x65b2f1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x653410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
test eax, eax
jne 0x65b314
push ebx
call dword [0x66c01c]
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [ebp - 0xc], 0x646f632e
mov dword [ebp - 8], 0x65
movzx edi, word [esi + 0x14]
push dword [esi + 0x88]
add edi, 0x18
push esi
add edi, esi
call fcn.00654824
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x65b3bd
movzx edx, word [esi + 6]
xor ecx, ecx
test edx, edx
jle 0x65b36a
lea eax, [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0x65b362
lea eax, [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, dword [edi + 4]
je 0x65b36a
add edi, 0x28
inc ecx
cmp ecx, edx
jl 0x65b34e
cmp ecx, edx
je 0x65b3bd
mov ecx, dword [esi + 0x34]
add ecx, dword [edi + 0xc]
mov edi, 0x654e30
xor edx, edx
mov eax, dword [ecx + edx*4]
cmp eax, dword [edi + edx*4]
jne 0x65b3bd
inc edx
cmp edx, 4
jne 0x65b37b
xor edx, edx
mov eax, dword [ecx + edx*4 + 0x140]
cmp eax, dword [edi + edx*4]
jne 0x65b3bd
inc edx
cmp edx, 4
jne 0x65b38b
cmp dword [ecx + 0x124], 0
je 0x65b3ad
push 0x65b67c
jmp 0x65b3b2
push 0x65b661
push esi
push ebx
push ecx
call fcn.0065b3ce
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0065cd46
mov esp, ebp
pop ebp
ret
Function at 0x69bb70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.006af670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.006aeef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0x69bc55
mov ecx, esi
call fcn.006aeef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.006aeef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.006aeef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.006aeef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.00699380
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.006aeef0
lea ecx, [ebx + eax]
call fcn.00699380
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.006aeef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.00699380
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.006aed20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.006b01c0

Function at 0x69bc70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.006af670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.006aeef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0x69bd55
mov ecx, esi
call fcn.006aeef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.006aeef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.006aeef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.006aeef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.00699420
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.006aeef0
lea ecx, [ebx + eax]
call fcn.00699420
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.006aeef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.00699420
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.006aed20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.006b01c0
Function at 0x69bd70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov ecx, ebx
push edi
call fcn.006af670
mov ecx, ebx
call fcn.006aeef0
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0x69bdff
mov ecx, ebx
call fcn.006af670
cmp dword [edi + 0x28], 0xffffffff
jne 0x69bdab
cmp dword [edi + 0x2c], 0xffffffff
je 0x69bde9
push esi
mov esi, dword [edi + 0x28]
lea ecx, [esp + 0xc]
mov edi, dword [edi + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
call fcn.0069bb20
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call fcn.0069bb20
pop esi
push dword [esp + 0x24]
mov ecx, ebx
push dword [esp + 0x24]
call fcn.006aed20
mov ecx, ebx
call fcn.006b01c0
pop edi
mov ecx, ebx
pop ebx
add esp, 0x10
jmp fcn.006b01c0

Function at 0x69be10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
mov ecx, esi
push edi
call fcn.006af670
mov ecx, esi
call fcn.006aeef0
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0x69be92
mov ecx, esi
call fcn.006af670
cmp dword [edi + 0x28], 0xffffffff
jne 0x69be4b
cmp dword [edi + 0x2c], 0xffffffff
je 0x69be7c
push dword [edi + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push dword [edi + 0x28]
mov dword [esp + 0x18], 0xffffffff
push esi
mov dword [esp + 0x20], 0xffffffff
call fcn.006980a0
lea ecx, [esp + 8]
call fcn.00696780
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
call fcn.006aed20
mov ecx, esi
call fcn.006b01c0
pop edi
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.006b01c0

Function at 0x69bea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.006af670
mov ecx, edi
call fcn.006aeef0
mov esi, eax
add esi, dword [esp + 0x10]
lea ecx, [esi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0x69bf3d
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
cmp ecx, 0xffffffff
jne 0x69bed7
cmp eax, ecx
je 0x69bee0
push eax
push ecx
mov ecx, edi
call fcn.006aed20
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0xffffffff
jne 0x69beef
cmp eax, ecx
je 0x69bef8
push eax
push ecx
mov ecx, edi
call fcn.006aed20
cmp dword [esi + 0x18], 0xffffffff
jne 0x69bf04
cmp dword [esi + 0x1c], 0xffffffff
je 0x69bf13
push dword [esi + 0x1c]
push dword [esi + 0x18]
push edi
call fcn.0069bb70
add esp, 0xc
cmp dword [esi + 0x20], 0xffffffff
jne 0x69bf1f
cmp dword [esi + 0x24], 0xffffffff
je 0x69bf2e
push dword [esi + 0x24]
push dword [esi + 0x20]
push edi
call fcn.0069bc70
add esp, 0xc
push dword [esp + 0x14]
mov ecx, edi
push dword [esp + 0x14]
call fcn.006aed20
mov ecx, edi
pop edi
pop esi
jmp fcn.006b01c0
Function at 0x69bf50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
push edi
call fcn.006af670
mov ecx, esi
call fcn.006aeef0
mov edi, eax
add edi, dword [esp + 0x10]
lea ecx, [edi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0x69bfb4
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
cmp ecx, 0xffffffff
jne 0x69bf87
cmp eax, ecx
je 0x69bf90
push eax
push ecx
mov ecx, esi
call fcn.006aed20
mov edx, dword [edi + 0x10]
mov eax, edx
mov ecx, dword [edi + 0x14]
or eax, ecx
je 0x69bfa5
push ecx
push edx
mov ecx, esi
call fcn.006aed20
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.006aed20
pop edi
mov ecx, esi
pop esi
jmp fcn.006b01c0
Function at 0x743380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
xor ebp, ebp
push edi
test ebx, ebx
je 0x7433e6
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov dword [esp + 0x14], eax
mov edi, dword [eax + 0x78]
add edi, ebx
cmp dword [edi + 0x18], esi
jbe 0x7433e6
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x20]
lea eax, [eax + esi*4]
mov ecx, dword [eax + ebx]
add ecx, ebx
test ecx, 0xffff0000
je 0x7433d5
test edx, 0xffff0000
je 0x7433d5
push edx
push ecx
call dword [0x100df134]
mov edx, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
jmp 0x7433dc
xor eax, eax
cmp ecx, edx
sete al
test eax, eax
jne 0x7433ed
inc esi
cmp esi, dword [edi + 0x18]
jb 0x7433a7
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov ebp, dword [eax + ebx]
add ebp, ebx
cmp ebp, edi
jb 0x7433e6
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x7c]
add eax, edi
cmp ebp, eax
ja 0x7433e6
xor ecx, ecx
mov eax, ebp
cmp byte [ebp], cl
je 0x743429
lea esp, [esp]
lea eax, [eax + 1]
inc ecx
cmp byte [eax], 0
jne 0x743420
lea esi, [ecx + 1]
xor edi, edi
test esi, esi
je 0x74343d
push esi
call fcn.0073d830
add esp, 4
mov edi, eax
push esi
push ebp
push edi
call fcn.0073d930
add esp, 0xc
mov esi, edi
cmp byte [edi], 0
je 0x74345b
nop
cmp byte [esi], 0x2e
je 0x74346d
inc esi
cmp byte [esi], 0
jne 0x743450
push edi
xor esi, esi
call fcn.0073d820
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov byte [esi], 0
call dword [0x100df1e0]
mov ecx, eax
lea eax, [esi + 1]
push eax
push ecx
call fcn.00743380
add esp, 8
mov esi, eax
push edi
call fcn.0073d820
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x427d10
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x427d38
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x427d47
mov eax, 1
ret 4

Function at 0x4289a0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x434158]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x428fb0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
mov edi, edx
cmp eax, 0x38
jbe 0x428ff3
cmp eax, 0x40
je 0x428fe5
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
lea ecx, [esi + 0x20]
mov edx, 4
mov eax, dword [ecx + 4]
mov ebp, dword [ecx]
bswap ebp
bswap eax
mov dword [edi], ebp
mov dword [edi + 4], eax
add edi, 8
add ecx, 8
dec edx
jne 0x429038
xor eax, eax
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret

Function at 0xdbc4b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdbc4ba
pushal
call 0xdbc4c0
pop ebp
sub ebp, 0x10
sub ebp, 0x9bc4b0
jmp 0xdbc4d6
mov eax, 0x9bc4b0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0xb4ce778e
xor byte [eax], dl
inc eax
dec ecx
jne 0xdbc4ed
jmp 0xdbc500
add eax, 0xb2070543
mov cs, word [esi + 0x764f0f8e]
mov cs, word [esi + 0x36438d8e]
mov byte [esi - 0x59cb7172], cl
mov cs, word [esi - 0x72938672]
inc esi
add eax, 0x8e8e820f
mov cs, word [ebp - 0x5515fcb5]
jb 0xdbc532
mov ch, byte [edx + 0x6ceee6de]
scasd eax, dword es:[edi]
mov fs, esi
fisubr word [edi + esi*8 - 0x72]
invalid