joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b8520
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x101e11b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.100d2020
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.100d2020
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x101b8659
mov edx, dword [0x102574ac]
mov cx, word [0x102574b0]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.100cbee0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.100d25c0
mov edx, dword [0x1020db10]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.100cc900
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.100d25c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.100cc680
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.100cc680
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x101b857b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x101c9062
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push SysReAllocStringLen
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x101c90f2
cmp eax, ebx
je 0x101c90f2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101c90fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x101c92a5
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x101c93f7
xor edx, edx
cmp eax, edx
je 0x101c93f7
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x101c92da
cmp eax, ecx
jb 0x101c92da
xor ecx, ecx
jmp 0x101c92df
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x101c92f9
jg 0x101c93f7
cmp eax, dword [esi + 8]
ja 0x101c93f7
cmp ecx, edx
jne 0x101c9313
cmp eax, dword [esi + 0x42c]
ja 0x101c9313
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x101c9358
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x101c9333
cmp edi, edx
jb 0x101c9333
xor edx, edx
jmp 0x101c9338
mov edx, 1
cmp ecx, ebx
ja 0x101c9358
cmp dword [esp + 0x14], edx
jg 0x101c9358
jl 0x101c9348
cmp eax, edi
ja 0x101c9358
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.101c9410
test eax, eax
je 0x101c93f7
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x101c93a6
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push SysReAllocString
push ecx
call edi
cmp eax, 0xffffffff
je 0x101c93e7
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x101c93e7
jmp 0x101c93b6
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101c93e7
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101c93e7
cmp dword [edi], ebp
jne 0x101c93e7
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x101c96c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x101c97a6
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x101c9733
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x101c978a
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x101c9746
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x101c9776
mov ebx, 0x3d
jmp 0x101c9784
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x101c96da
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0xb28f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x107044], 0x8088405
inc edx
mov dword [0x107044], edx
mul edx
mov eax, edx
ret

Function at 0xb8804
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0xc3b0c
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xc3c9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.000b364c
push 0xc3cac
call fcn.000b6ab0
mov esi, eax
test esi, esi
je 0xc3b4e
push 0xc3cb8
push esi
call fcn.000b6a48
mov edi, eax
test edi, edi
je 0xc3c6f
mov dword [ebp - 4], 0x400
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.000b3bdc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.000b3a6c
push eax
push 0
call edi
test eax, eax
jne 0xc3c6f
mov edx, dword [ebp - 4]
dec edx
lea eax, [ebp - 8]
call fcn.000b3bdc
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.000b36a0
mov eax, dword [ebx]
call fcn.000b38a8
cmp eax, 0xf5
jle 0xc3c6f
mov edx, dword [ebx]
mov eax, 0xc3cd8
call fcn.000b3b94
test eax, eax
je 0xc3bca
mov eax, ebx
mov edx, 0xc3ce8
call fcn.000b36a0
jmp 0xc3c6f
mov edx, dword [ebx]
mov eax, 0xc3d38
call fcn.000b3b94
test eax, eax
je 0xc3beb
mov eax, ebx
mov edx, 0xc3d4c
call fcn.000b36a0
jmp 0xc3c6f
mov edx, dword [ebx]
mov eax, 0xc3d9c
call fcn.000b3b94
test eax, eax
je 0xc3c09
mov eax, ebx
mov edx, 0xc3db0
call fcn.000b36a0
jmp 0xc3c6f
mov edx, dword [ebx]
mov eax, 0xc3e00
call fcn.000b3b94
test eax, eax
je 0xc3c27
mov eax, ebx
mov edx, 0xc3e14
call fcn.000b36a0
jmp 0xc3c6f
mov edx, dword [ebx]
mov eax, 0xc3eac
call fcn.000b3b94
test eax, eax
je 0xc3c45
mov eax, ebx
mov edx, 0xc3ec0
call fcn.000b36a0
jmp 0xc3c6f
mov edx, dword [ebx]
mov eax, 0xc3f40
call fcn.000b3b94
test eax, eax
je 0xc3c63
mov eax, ebx
mov edx, 0xc3f54
call fcn.000b36a0
jmp 0xc3c6f
mov eax, ebx
mov edx, 0xc3ce8
call fcn.000b36a0
mov eax, dword [ebx]
call fcn.000b38a8
cmp eax, 0xa
jge 0xc3c87
mov eax, ebx
mov edx, 0xc3ce8
call fcn.000b36a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc3ca4
lea eax, [ebp - 8]
call fcn.000b364c
ret
Function at 0xc41f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xc41f8
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0xc43e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.000f2098
call fcn.000f2f38
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xc4383
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0xc4383
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.000b3bdc
lea eax, [ebp - 4]
call fcn.000b3a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.000b6ce4
call fcn.000f2afc
cmp eax, 1
jne 0xc4276
lea eax, [ebp - 0x10]
call fcn.000c415c
mov eax, dword [ebp - 4]
call fcn.000b38a8
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 1
lea ecx, [ebp - 0x1c]
mov edx, 0xc43f8
mov eax, 0xc4404
call fcn.000f2c34
lea eax, [ebp - 0x1c]
mov edx, dword [0x1063bc]
mov edx, dword [edx]
call fcn.000b38b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.000b80f8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.000b3dd8
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
mov edx, 0xc4414
mov eax, 0xc4420
call fcn.000f2c34
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.000b3dd8
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 4]
call fcn.000b3a78
mov ecx, eax
pop eax
pop edx
call fcn.000e4408
test eax, eax
jne 0xc4359
mov eax, dword [ebp - 4]
call fcn.000b38a8
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 1
lea ecx, [ebp - 0x30]
mov edx, 0xc43f8
mov eax, 0xc4404
call fcn.000f2c34
lea eax, [ebp - 0x30]
mov edx, dword [0x1063bc]
mov edx, dword [edx]
call fcn.000b38b0
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.000b80f8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.000b3dd8
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 4]
call fcn.000b3a78
mov ecx, eax
mov eax, dword [ebp - 8]
pop edx
call fcn.000e4408
push 0x7530
push eax
call fcn.000b6ba8
call fcn.000f2afc
cmp eax, 1
jne 0xc4383
lea eax, [ebp - 0x34]
call fcn.000c406c
mov edx, dword [ebp - 0x34]
mov eax, dword [0x106554]
call fcn.000b36a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc43ea
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.000b3670
lea eax, [ebp - 0x28]
call fcn.000b3c58
lea eax, [ebp - 0x24]
call fcn.000b364c
lea eax, [ebp - 0x20]
call fcn.000b3c58
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.000b3670
lea eax, [ebp - 0x14]
call fcn.000b3c58
lea eax, [ebp - 0x10]
call fcn.000b364c
lea eax, [ebp - 8]
call fcn.000b3c58
lea eax, [ebp - 4]
call fcn.000b364c
ret
Function at 0xc4854
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0xc485c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xc49d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.000b364c
lea eax, [ebp - 0xc]
call fcn.000f2098
call fcn.000f2f38
mov ebx, eax
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0xc4992
mov edi, ebx
mov esi, edi
add esi, dword [eax + 0x3c]
cmp dword [esi], 0x4550
jne 0xc4992
lea eax, [ebp - 0x18]
call fcn.000c4740
mov eax, dword [esi + 0x50]
add eax, edi
mov edx, eax
add edx, 4
mov edi, edx
mov ebx, eax
mov edx, dword [ebx]
lea eax, [ebp - 8]
call fcn.000b3bdc
lea eax, [ebp - 8]
call fcn.000b3a78
mov ecx, dword [ebx]
mov edx, edi
call fcn.000b6ce4
mov eax, dword [ebp - 8]
call fcn.000b38a8
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea ecx, [ebp - 0x24]
mov edx, 0xc49e8
mov eax, 0xc49f4
call fcn.000f2c34
lea eax, [ebp - 0x24]
mov edx, dword [0x1063bc]
mov edx, dword [edx]
call fcn.000b38b0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.000b80f8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.000b3dd8
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
call fcn.000b3a78
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.000e4408
mov ebx, eax
push 0xea60
push ebx
call fcn.000b6ba8
push 0
push ebx
call fcn.000b6b78
lea eax, [ebp - 0x14]
call fcn.000c4574
mov edx, dword [ebp - 0x14]
mov eax, 0xc4a04
call fcn.000b3b94
dec eax
jne 0xc4992
mov eax, dword [ebp - 0x14]
call fcn.000b38a8
cmp eax, 0x100
jge 0xc4992
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 0x14]
call fcn.000b3ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc49d9
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.000b3670
lea eax, [ebp - 0x1c]
call fcn.000b3c58
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.000b3670
lea eax, [ebp - 0xc]
call fcn.000b3c58
lea eax, [ebp - 8]
call fcn.000b364c
ret
Function at 0xd8ab8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0xd8ac0
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0xd8c50
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 3
call fcn.000d8a18
call fcn.000f2f38
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xd8bf8
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0xd8bf8
mov edi, dword [edx + 0x50]
add edi, ecx
add edi, 4
mov esi, dword [edx + 0x50]
add esi, eax
mov edx, dword [esi]
lea eax, [ebp - 4]
call fcn.000b3bdc
lea eax, [ebp - 4]
call fcn.000b3a78
mov ecx, dword [esi]
mov edx, edi
call fcn.000b6ce4
lea ecx, [ebp - 0x1c]
mov edx, 0xd8c68
mov eax, 0xd8c74
call fcn.000f2c34
lea eax, [ebp - 0x1c]
mov edx, dword [0x1063bc]
mov edx, dword [edx]
call fcn.000b38b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.000b80f8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.000b3dd8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.000f1b70
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.000b3894
mov eax, dword [esi]
push eax
mov eax, dword [0x106524]
push eax
push 0
push 0
lea eax, [ebp - 4]
call fcn.000b3a78
push eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.000b3dd8
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
call fcn.000f2098
mov eax, dword [ebp - 0x24]
pop edx
pop ecx
call fcn.000e4408
mov esi, eax
test esi, esi
je 0xd8bef
push 0x6ddd00
push esi
call fcn.000b6ba8
mov eax, dword [0x106524]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.000b69f8
neg eax
sbb eax, eax
neg eax
cmp al, 1
jne 0xd8bef
cmp dword [ebp - 0xc], 0xa
je 0xd8c09
cmp dword [ebp - 0xc], 0x14
mov eax, dword [0x106524]
xor edx, edx
mov dword [eax], edx
push 0x493e0
call fcn.000b6b70
dec ebx
jne 0xd8ade
call fcn.000d7f60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd8c57
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.000b3c70
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.000b3670
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.000b3c70
lea eax, [ebp - 8]
mov edx, 2
call fcn.000b3670
ret
Function at 0xda22c
Capabilities:
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0xda235
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.000b3a5c
mov eax, dword [ebp - 8]
call fcn.000b3a5c
mov eax, dword [ebp - 0xc]
call fcn.000b3a5c
xor eax, eax
push ebp
push 0xda38d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.000b364c
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.000d9aa8
lea eax, [ebp - 0x24]
call fcn.000d9bb0
push dword [ebp - 0x24]
push 0xda3a4
push dword [ebp - 0x14]
push 0xda3d4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.000b3968
mov eax, 5
call fcn.000b28f4
add eax, 4
lea edx, [ebp - 0x20]
call fcn.000f057c
push dword [ebp - 0x10]
push 0xda404
push dword [ebp - 0x14]
push 0xda410
push dword [ebp - 0x20]
push 0xda434
push dword [ebp - 4]
push 0xda444
lea eax, [ebp - 0x10]
mov edx, 8
call fcn.000b3968
lea edx, [ebp - 0x1c]
mov eax, 4
call fcn.000d9aa8
lea eax, [ebp - 0x28]
call fcn.000d8228
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.000d9c70
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0xda450
push dword [ebp - 0x14]
push 0xda45c
push dword [ebp - 0x18]
push 0xda46c
push dword [ebp - 0x20]
push 0xda480
lea eax, [ebp - 0x10]
mov edx, 9
call fcn.000b3968
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.000da158
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000001
call fcn.000e864c
mov eax, dword [ebx]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.000e864c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xda394
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.000b3670
ret
Function at 0xdfe58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0xdff5a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.000f2098
call fcn.000f2f38
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xdff27
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0xdff27
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.000b3bdc
lea eax, [ebp - 4]
call fcn.000b3a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.000b6ce4
mov eax, dword [ebp - 4]
call fcn.000b38a8
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea ecx, [ebp - 0x18]
mov edx, 0xdff70
mov eax, 0xdff7c
call fcn.000f2c34
lea eax, [ebp - 0x18]
mov edx, dword [0x1063bc]
mov edx, dword [edx]
call fcn.000b38b0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.000b80f8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.000b3dd8
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
call fcn.000b3a78
mov ecx, eax
mov eax, dword [ebp - 8]
pop edx
call fcn.000e4408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xdff61
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.000b3670
lea eax, [ebp - 0x10]
call fcn.000b3c58
lea eax, [ebp - 8]
call fcn.000b3c58
lea eax, [ebp - 4]
call fcn.000b364c
ret
Function at 0xf0778
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xf0804
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.000b364c
call fcn.000f2f38
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xf07ee
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0xf07ee
mov esi, dword [edx + 0x50]
add esi, ecx
mov ecx, esi
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [esi]
lea eax, [ebp - 4]
call fcn.000b3bdc
lea eax, [ebp - 4]
call fcn.000b3a78
mov ecx, dword [esi]
mov edx, dword [ebp - 8]
call fcn.000b6ce4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.000b36a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf080b
lea eax, [ebp - 4]
call fcn.000b364c
ret

Function at 0xf0814
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.000b411c
xor eax, eax
push ebp
push 0xf08e7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
call fcn.000f2f38
mov edx, eax
cmp word [edx], 0x5a4d
jne 0xf08ba
mov edx, dword [edx + 0x3c]
mov ecx, eax
add edx, ecx
cmp dword [edx], 0x4550
jne 0xf08ba
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 0x10]
call fcn.000b3bdc
lea eax, [ebp - 0x10]
call fcn.000b3a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.000b6ce4
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.000b3a78
push eax
lea eax, [ebp - 0x14]
call fcn.000f2098
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
pop ecx
call fcn.000e4408
mov ebx, eax
test ebx, ebx
je 0xf08c1
mov dword [ebp - 0xc], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf08ee
lea eax, [ebp - 0x14]
call fcn.000b3c58
lea eax, [ebp - 0x10]
call fcn.000b364c
lea eax, [ebp - 4]
call fcn.000b3c58
ret
Function at 0xf1d2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0xf1e07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.000b364c
test esi, esi
je 0xf1d7e
mov eax, esi
and eax, 0xf
cdq
xor eax, edx
sub eax, edx
mov dl, byte [eax + 0x105fcc]
lea eax, [ebp - 4]
call fcn.000b37f4
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.000b38f4
shr esi, 4
test esi, esi
jne 0xf1d53
cmp dword [ebx], 0
jne 0xf1da0
jmp 0xf1d93
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0xf1e1c
call fcn.000b38f4
mov eax, dword [ebx]
call fcn.000b38a8
cmp edi, eax
jg 0xf1d85
jmp 0xf1df1
mov eax, dword [ebx]
call fcn.000b38a8
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x2d
jne 0xf1de6
mov eax, dword [ebx]
call fcn.000b38a8
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.000b3af0
mov edx, ebx
mov ecx, 1
mov eax, 0xf1e28
call fcn.000b3b38
jmp 0xf1de6
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0xf1e1c
call fcn.000b38f4
mov eax, dword [ebx]
call fcn.000b38a8
cmp edi, eax
jg 0xf1dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf1e0e
lea eax, [ebp - 4]
call fcn.000b364c
ret