joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43d140
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43d15b
mov eax, 0xffffffff
jmp 0x43d15e
add eax, 0xa
push eax
call fcn.00408940
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43d1a1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43d190
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x2c2d2e2f
mov dword [esp + 0x24], 0
mov ecx, 0x8062a388
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x7f9d5c98]
xor edx, ecx
mov esi, edx
and esi, 0x57
xor edx, 0x57
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx + 0x7f9d5c98], dl
inc ecx
cmp ecx, 0x8062a390
jne 0x43d210
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44a598]
test ecx, ecx
je 0x43d289
xor edx, edx
mov ebx, dword [0x44a59c]
nop
nop
nop
cmp dword [ebx + edx*8], 0x50dc24c7
je 0x43d260
inc edx
cmp ecx, edx
jne 0x43d250
jmp 0x43d289
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43d289
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44a5a0]
mov ebx, eax
call fcn.004391b0
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.00408950
add esp, 4
test edi, edi
je 0x43d29c
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43d2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov eax, 0x8062a388
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x7f9d5c78]
xor ecx, eax
mov edx, ecx
and edx, 0x57
xor ecx, 0x57
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x7f9d5c78], cl
inc eax
cmp eax, 0x8062a390
jne 0x43d2e0
mov eax, dword [esp]
mov edx, dword [0x44a598]
test edx, edx
je 0x43d358
xor ebx, ebx
mov ecx, dword [0x44a59c]
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x43d330
inc ebx
cmp edx, ebx
jne 0x43d320
jmp 0x43d358
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43d358
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x20
test edi, edi
je 0x43d362
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43d36e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov eax, 0x8062a388
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x7f9d5c78]
xor edi, eax
mov ebx, edi
and ebx, 0x57
xor edi, 0x57
lea ebx, [edi + ebx*2]
inc bl
mov byte [esp + eax + 0x7f9d5c78], bl
inc eax
cmp eax, 0x8062a390
jne 0x43d3b0
mov eax, dword [esp]
mov ebx, dword [0x44a598]
test ebx, ebx
je 0x43d42e
xor ebp, ebp
mov edi, dword [0x44a59c]
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x43d400
inc ebp
cmp ebx, ebp
jne 0x43d3f0
jmp 0x43d42e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43d42e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x30
cmp eax, 0x103
jne 0x43d4c9
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov eax, 0x8062a388
nop
nop
nop
movzx ecx, byte [esp + eax + 0x7f9d5c78]
xor ecx, eax
mov edx, ecx
and edx, 0x57
xor ecx, 0x57
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x7f9d5c78], cl
inc eax
cmp eax, 0x8062a390
jne 0x43d450
mov eax, dword [esp]
mov ecx, dword [0x44a598]
test ecx, ecx
je 0x43d4c1
xor edx, edx
mov edi, dword [0x44a59c]
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43d4a0
inc edx
cmp ecx, edx
jne 0x43d490
jmp 0x43d4c1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43d4c1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x18
test eax, eax
js 0x43d4c9
mov eax, dword [esp + 8]
test esi, esi
je 0x43d4dc
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43d4da
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov eax, 0x8062a388
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x7f9d5c78]
xor edi, eax
mov ebx, edi
and ebx, 0x57
xor edi, 0x57
lea ebx, [edi + ebx*2]
inc bl
mov byte [esp + eax + 0x7f9d5c78], bl
inc eax
cmp eax, 0x8062a390
jne 0x43d520
mov eax, dword [esp]
mov ebx, dword [0x44a598]
test ebx, ebx
je 0x43d59e
xor ebp, ebp
mov edi, dword [0x44a59c]
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x7e66a1b5
je 0x43d570
inc ebp
cmp ebx, ebp
jne 0x43d560
jmp 0x43d59e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43d59e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x30
cmp eax, 0x103
jne 0x43d639
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov eax, 0x8062a388
nop
nop
nop
movzx ecx, byte [esp + eax + 0x7f9d5c78]
xor ecx, eax
mov edx, ecx
and edx, 0x57
xor ecx, 0x57
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x7f9d5c78], cl
inc eax
cmp eax, 0x8062a390
jne 0x43d5c0
mov eax, dword [esp]
mov ecx, dword [0x44a598]
test ecx, ecx
je 0x43d631
xor edx, edx
mov edi, dword [0x44a59c]
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43d610
inc edx
cmp ecx, edx
jne 0x43d600
jmp 0x43d631
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43d631
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x18
test eax, eax
js 0x43d639
mov eax, dword [esp + 8]
test esi, esi
je 0x43d643
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43d670
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 8], bx
add ebx, 2
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov eax, 0x8062a388
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x7f9d5c78]
xor edi, eax
mov ebx, edi
and ebx, 0x57
xor edi, 0x57
lea ebx, [edi + ebx*2]
inc bl
mov byte [esp + eax + 0x7f9d5c78], bl
inc eax
cmp eax, 0x8062a390
jne 0x43d6e0
mov eax, dword [esp]
mov edi, dword [0x44a598]
test edi, edi
je 0x43d752
xor ebx, ebx
mov ebp, dword [0x44a59c]
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x43d731
inc ebx
cmp edi, ebx
jne 0x43d720
jmp 0x43d752
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43d752
lea eax, [esp + 0x10]
push esi
push eax
push edx
push ecx
push 0x10
push edi
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x10001b50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
jmp 0x10001b8f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x10], ecx
jge 0x10001cab
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x10001c1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jle 0x10001c17
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001bf0
xor eax, eax
jmp 0x10001cb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.10001930
add esp, 0xc
jmp 0x10001b7d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10001b30
add esp, 8
test eax, eax
jne 0x10001c3d
xor eax, eax
jmp 0x10001cb0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001c74
xor eax, eax
jmp 0x10001cb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10001980
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
jmp 0x10001b7d
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100027b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x13800
mov ecx, dword [ebp - 4]
push ecx
push 0x10004070
call fcn.10001000
add esp, 8
mov dword [ebp - 0xc], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x405e50
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dh, 0x45
loope 0x405eab
mov ebx, dword [ebp + 0x10]
push esi
test dword [ecx], ebp
push edi
jge 0x405e79
mov ebx, 0xd2566e
adc dh, byte [edi + 0x38]
fdiv dword [ebp - 0x6b]
cmp word [eax + 2], 0
je 0x405e79
fild word [ebx - 0x4814fd40]
sub eax, dword [ebp + 0xc]
shl byte gs:[ecx + edx*8 - 8], 0x89
inc ebp
adc byte [ebp + 0x66049d04], cl
fadd qword [eax]
push eax
inc dword [esi]
pop esp
insd dword es:[edi], dx
pop eax
add byte [ebx + 0x10458bf8], cl
lea esi, [eax + edi*4 + 1]
push esi
mov dword [ebx], esi
cld
invalid
mov dword [edi], eax
lea edx, [ebp + 0x10]
push ecx
push eax
adc byte [ecx + 0x50], dl
mov eax, dword [ebp + 0xc]
push edx
push eax
call 0xa2ebb9
mov edx, dword [ebp - 4]
mov edi, esp
sub esi, edx
push esi
push eax
call dword [0x5940d620]
test eax, 0x4b0001
add esp, 0x2e
cmp ebx, ecx
mov dword [edi + 0x7e], ebx
sub dword [ebp + 0x478dffbe], ecx
add al, 0x89
dec ebp
or al, 0x1d
mov ebx, dword [esi + 0x2c283fc]
mov dword [esi - 0x2960cf84], ebp
inc esi
test dl, dl
mov dword [eax], esi
jne 0x405f74
mov edi, dword [edi + 0xc]
add dword [ecx + 4], 0x4a
mov dword [ebp + 0xc], edx
jne 0x405ee3
pop es
inc ebp
or bh, al
xchg esi, eax
pop dword [eax]
add byte [eax], al
add byte [ecx - 0x3c7458c8], cl
pop esi
ror byte [ebx - 0x2ce3a21b], 1
lodsb al, byte [esi]
dec edi
nop
nop
nop
loop 0x405eaf
nop
push ebp
mov ebp, esp
sub esp, 0x1f3
mov eax, dword [0x410388]
mov ecx, eax
inc eax
test ecx, ecx
cmp eax, 0xc5410345
je 0x405f40
xor edx, ecx
mov edi, dword [eax + 0x55eec35d]
out dx, al
push ebp
clc
push edx
call fcn.0040a730
add esp, 4
test eax, eax
jle 0x405ed5
sub byte [eax], al
add byte [eax], al
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xfd410954], eax
call 0x363f6f40
test eax, eax
jne 0x405fdb
das
push eax
push eax
lea eax, [ebp - 4]
leave
call fcn.00404f60
test eax, eax
je 0x405f81
mov eax, 0x924e22
jnp 0x405f64
pop ebp
ret
mov ecx, dword [ebp - 4]
push 0x6b90f424
push ecx
call fcn.004055f0
lea edx, [ebp - 0x198]
push edx
push 2
sub al, 0x15
rcl byte [eax + 0x40]
add byte [ebp + 0x6686eac0], al
mov eax, dword [ebp - 0x198]
cmp al, 2
and si, word [ebx]
leave
add ecx, esp
mov ecx, ecx
jne 0x405fd0
mov ecx, dword [esp + edi*8]
push edx
jbe 0x40601d
xor dword [eax], eax
enter 0x4516, 0xffffffffffffff96
push eax
call 0xf640a430
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, 0x11
add byte [ebx - 0x6f3ca27a], cl
mov eax, dword [0x410388]
dec eax
test al, 0x88
add eax, dword [ecx]
jne 0x406004
mov eax, dword [esi - 0x5e6f3ca3]
mov byte [ebx], al
inc ecx
add byte [eax - 0x58], cl
mov byte [ebx], al
inc ecx
add byte [ebp + 0x17], dh
call fcn.00404a20
call dword [0x2040ddd4]
mov eax, dword [0xb20954]
push eax
call dword [0x6540c064]
ret
or byte [ecx - 0x39], cl
add bl, al
add byte [eax], al
mov cl, byte [edx - 0x79]
adc dword [ecx], eax
add byte [ebp - 0x3e], bl
fstp dword [esi]
or dword [ebp + 0xc], edi
cmp edi, 0x400
jbe 0x405fda
mov ecx, dword [ebp + 8]
mov eax, 0x3b3f0016
pop edi
mov dword [ecx], 0
pop ebp
ret 0x10
Function at 0x691ca58d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x691ca5fc
jmp 0x691ca65a
jmp 0x691ca6b8
jmp 0x691ca716
jmp 0x691ca774
jmp 0x691ca7d2
jmp 0x691ca830
jmp 0x691ca88e
jmp 0x691ca8ec
jmp 0x691ca94a
jmp 0x691ca9a8
jmp 0x691caa06
jmp 0x691caa64
jmp 0x691caac2
jmp 0x691cab20
jmp 0x691cab7e
jmp 0x691cabdc
jmp 0x691cac3a
jmp 0x691cac98
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x691cacfc
jmp 0x691cad5a
jmp 0x691cadb8
jmp 0x691cae16
jmp 0x691cae74
jmp 0x691caed2
jmp 0x691caf30
jmp 0x691caf8e
jmp 0x691cafec
jmp 0x691cb04a
jmp 0x691cb0a8
jmp 0x691cb106
jmp 0x691cb164
jmp 0x691cb1c2
jmp 0x691cb220
jmp 0x691cb27e
jmp 0x691cb2dc
jmp 0x691cb33a
jmp 0x691cb398
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x691cb410
jmp 0x691cb46e
jmp 0x691cb4cc
jmp 0x691cb52a
jmp 0x691cb588
jmp 0x691cb5e6
jmp 0x691cb644
jmp 0x691cb6a2
jmp 0x691cb700
jmp 0x691cb75e
jmp 0x691cb7bc
jmp 0x691cb81a
jmp 0x691cb878
jmp 0x691cb8d6
jmp 0x691cb934
jmp 0x691cb992
jmp 0x691cb9f0
jmp 0x691cba4e
jmp 0x691cbaac
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x691cbb13
jmp 0x691cbb71
jmp 0x691cbbcf
jmp 0x691cbc2d
jmp 0x691cbc8b
jmp 0x691cbce9
jmp 0x691cbd47
jmp 0x691cbda5
jmp 0x691cbe03
jmp 0x691cbe61
jmp 0x691cbebf
jmp 0x691cbf1d
jmp 0x691cbf7b
jmp 0x691cbfd9
jmp 0x691cc037
jmp 0x691cc095
jmp 0x691cc0f3
jmp 0x691cc151
jmp 0x691cc1af
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x691cc226
jmp 0x691cc284
jmp 0x691cc2e2
jmp 0x691cc340
jmp 0x691cc39e
jmp 0x691cc3fc
jmp 0x691cc45a
jmp 0x691cc4b8
jmp 0x691cc516
jmp 0x691cc574
jmp 0x691cc5d2
jmp 0x691cc630
jmp 0x691cc68e
jmp 0x691cc6ec
jmp 0x691cc74a
jmp 0x691cc7a8
jmp 0x691cc806
jmp 0x691cc864
jmp 0x691cc8c2
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x691cc93a
jmp 0x691cc998
jmp 0x691cc9f6
jmp 0x691cca54
jmp 0x691ccab2
jmp 0x691ccb10
jmp 0x691ccb6e
jmp 0x691ccbcc
jmp 0x691ccc2a
jmp 0x691ccc88
jmp 0x691ccce6
jmp 0x691ccd44
jmp 0x691ccda2
jmp 0x691cce00
jmp 0x691cce5e
jmp 0x691ccebc
jmp 0x691ccf1a
jmp 0x691ccf78
jmp 0x691ccfd6
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x20]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x30], eax
jmp 0x691cd04e
jmp 0x691cd0ac
jmp 0x691cd10a
jmp 0x691cd168
jmp 0x691cd1c6
jmp 0x691cd224
jmp 0x691cd282
jmp 0x691cd2e0
jmp 0x691cd33e
jmp 0x691cd39c
jmp 0x691cd3fa
jmp 0x691cd458
jmp 0x691cd4b6
jmp 0x691cd514
jmp 0x691cd572
Function at 0x691debac
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x69ad6018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x69ad6018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x691dec2a
jmp 0x691dec88
jmp 0x691dece6
jmp 0x691ded44
jmp 0x691deda2
jmp 0x691dee00
jmp 0x691dee5e
jmp 0x691deebc
jmp 0x691def1a
jmp 0x691def78
jmp 0x691defd6
jmp 0x691df034
jmp 0x691df092
jmp 0x691df0f0
jmp 0x691df14e
jmp 0x691df1ac
jmp 0x691df20a
jmp 0x691df268
jmp 0x691df2c6
mov dword [ebp - 0x14], 0
jmp 0x691df32b
jmp 0x691df389
jmp 0x691df3e7
jmp 0x691df445
jmp 0x691df4a3
jmp 0x691df501
jmp 0x691df55f
jmp 0x691df5bd
jmp 0x691df61b
jmp 0x691df679
jmp 0x691df6d7
jmp 0x691df735
jmp 0x691df793
jmp 0x691df7f1
jmp 0x691df84f
jmp 0x691df8ad
jmp 0x691df90b
jmp 0x691df969
jmp 0x691df9c7
mov dword [ebp - 0x18], 0
jmp 0x691dfa2c
jmp 0x691dfa8a
jmp 0x691dfae8
jmp 0x691dfb46
jmp 0x691dfba4
jmp 0x691dfc02
jmp 0x691dfc60
jmp 0x691dfcbe
jmp 0x691dfd1c
jmp 0x691dfd7a
jmp 0x691dfdd8
jmp 0x691dfe36
jmp 0x691dfe94
jmp 0x691dfef2
jmp 0x691dff50
jmp 0x691dffae
jmp 0x691e000c
jmp 0x691e006a
jmp 0x691e00c8
mov dword [ebp - 0x10], 0
jmp 0x691e012d
jmp 0x691e018b
jmp 0x691e01e9
jmp 0x691e0247
jmp 0x691e02a5
jmp 0x691e0303
jmp 0x691e0361
jmp 0x691e03bf
jmp 0x691e041d
jmp 0x691e047b
jmp 0x691e04d9
jmp 0x691e0537
jmp 0x691e0595
jmp 0x691e05f3
jmp 0x691e0651
jmp 0x691e06af
jmp 0x691e070d
jmp 0x691e076b
jmp 0x691e07c9
mov dword [ebp - 0x10], 0
jmp 0x691e2aff
jmp 0x691e0833
jmp 0x691e0891
jmp 0x691e08ef
jmp 0x691e094d
jmp 0x691e09ab
jmp 0x691e0a09
jmp 0x691e0a67
jmp 0x691e0ac5
jmp 0x691e0b23
jmp 0x691e0b81
jmp 0x691e0bdf
jmp 0x691e0c3d
jmp 0x691e0c9b
jmp 0x691e0cf9
jmp 0x691e0d57
jmp 0x691e0db5
jmp 0x691e0e13
jmp 0x691e0e71
jmp 0x691e0ecf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x69ad6014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x691e0f3e
jmp 0x691e0f9c
jmp 0x691e0ffa
jmp 0x691e1058
jmp 0x691e10b6
jmp 0x691e1114
jmp 0x691e1172
jmp 0x691e11d0
jmp 0x691e122e
jmp 0x691e128c
jmp 0x691e12ea
jmp 0x691e1348
jmp 0x691e13a6
jmp 0x691e1404
jmp 0x691e1462
jmp 0x691e14c0
jmp 0x691e151e
jmp 0x691e157c
jmp 0x691e15da
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x69ad601c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x691e1649
jmp 0x691e16a7
jmp 0x691e1705
jmp 0x691e1763
jmp 0x691e17c1
jmp 0x691e181f
jmp 0x691e187d
jmp 0x691e18db
jmp 0x691e1939
jmp 0x691e1997
jmp 0x691e19f5
jmp 0x691e1a53
jmp fcn.691e1ab1
mov eax, dword [0x69ad6018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x691e07d5
nop
leave
ret