joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x431290]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004143d0
add esp, 4
test eax, eax
je 0x408a13
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004143d0
add esp, 4
test eax, eax
jne 0x408a1a
xor eax, eax
jmp 0x408c1a
mov edx, dword [ebp + 8]
push edx
call fcn.004088e0
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x14
div ecx
mov dword [ebp - 4], eax
xor edx, edx
mov word [ebp - 0xc], dx
jmp 0x408a4c
mov ax, word [ebp - 0xc]
add ax, 1
mov word [ebp - 0xc], ax
movzx ecx, word [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jae 0x408c18
mov edx, dword [ebp + 8]
push edx
push 1
push 0x14
lea eax, [ebp - 0x128]
push eax
call fcn.0041606e
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
call fcn.004174f6
add esp, 4
mov dword [ebp - 0x114], eax
push 0
mov edx, dword [ebp - 0x11c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004087e0
add esp, 8
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415d49
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x100
lea eax, [ebp - 0x110]
push eax
call fcn.0041606e
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.00429261
add esp, 8
test eax, eax
jne 0x408bfe
cmp dword [ebp - 0x128], 0
je 0x408b06
push 0
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004087e0
add esp, 8
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00415d49
add esp, 0xc
jmp 0x408b28
push 0
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004087e0
add esp, 8
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00415d49
add esp, 0xc
xor eax, eax
mov word [ebp - 0x12c], ax
jmp 0x408b45
mov cx, word [ebp - 0x12c]
add cx, 1
mov word [ebp - 0x12c], cx
mov edx, dword [ebp + 8]
push edx
push 1
push 4
lea eax, [ebp - 0x238]
push eax
call fcn.0041606e
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
call fcn.004174f6
add esp, 4
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x238], 0
jne 0x408b7c
jmp 0x408bfe
push 0
mov edx, dword [ebp - 0x238]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004087e0
add esp, 8
add eax, 2
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415d49
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x100
lea eax, [ebp - 0x230]
push eax
call fcn.0041606e
add esp, 0x10
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x230]
push edx
call fcn.00429261
add esp, 8
test eax, eax
jne 0x408be4
movzx eax, word [ebp - 0x12c]
mov ecx, dword [ebp - 0x118]
lea eax, [ecx + eax*4]
jmp 0x408c1a
push 0
mov edx, dword [ebp - 0x234]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00415d49
add esp, 0xc
jmp 0x408b33
push 0
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00415d49
add esp, 0xc
jmp 0x408a40
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413f30
mov esp, ebp
pop ebp
ret
Function at 0x40ac90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x811c9dc5
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
je 0x40acc2
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
xor ecx, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x40ac9b
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x413f30
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431290]
jne 0x413f3a
repz ret
jmp fcn.004193ec

Function at 0x41fe79
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41feaa
call fcn.00419934
mov dword [eax], esi
call fcn.00419921
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00417109
add esp, 0x14
push 0x16
pop eax
jmp 0x41feff
test dword [ebp + 0xc], 0xfffffff9
jne 0x41fe86
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41fed7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00419947
pop ecx
call fcn.00419921
mov eax, dword [eax]
jmp 0x41feff
test al, 0x10
jne 0x41fefd
test al, 1
je 0x41fefd
test byte [ebp + 0xc], 2
je 0x41fefd
call fcn.00419934
mov dword [eax], 5
call fcn.00419921
mov dword [eax], 0xd
jmp 0x41fece
xor eax, eax
pop esi
pop ebp
ret
Function at 0x425160
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00418dd7
and dword [ebp - 4], 0
cmp dword [0x43c058], 0
mov ebx, eax
jne 0x425211
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4252c2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4252c2
push eax
call fcn.00418d65
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43c058], eax
call esi
push eax
call fcn.00418d65
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43c05c], eax
call esi
push eax
call fcn.00418d65
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43c060], eax
call esi
push eax
call fcn.00418d65
pop ecx
mov dword [0x43c068], eax
test eax, eax
je 0x425211
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00418d65
pop ecx
mov dword [0x43c064], eax
mov eax, dword [0x43c064]
cmp eax, ebx
je 0x425269
cmp dword [0x43c068], ebx
je 0x425269
push eax
call fcn.00418de0
push dword [0x43c068]
mov esi, eax
call fcn.00418de0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x425269
test edi, edi
je 0x425269
call esi
test eax, eax
je 0x425260
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425260
test byte [ebp - 0xc], 1
jne 0x425269
or dword [ebp + 0x10], 0x200000
jmp 0x4252a2
mov eax, dword [0x43c05c]
cmp eax, ebx
je 0x4252a2
push eax
call fcn.00418de0
pop ecx
test eax, eax
je 0x4252a2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4252a2
mov eax, dword [0x43c060]
cmp eax, ebx
je 0x4252a2
push eax
call fcn.00418de0
pop ecx
test eax, eax
je 0x4252a2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43c058]
call fcn.00418de0
pop ecx
test eax, eax
je 0x4252c2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4252c4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6825e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x6826c7
jmp 0x68262d
mov word [esp + 6], bp
mov dword [esp + 0xb], edi
mov dword [esp + 0x1c], esp
push esi
jmp 0x682685
mov byte [esp + 1], bl
pop word [esp]
lea esp, [esp + 2]
push ebx
pushal
mov dword [esp + 0xe], esp
jmp 0x682617
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
jmp 0x6826ff
push word [esp]
ja 0x68266f
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], esi
jmp 0x6826c0
lea esp, [esp + 0x1c]
jmp 0x6826dd
push esi
push dword [esp + 2]
jmp 0x682708
rdtsc
lea ebp, reloc.KERNEL32.dll_SetErrorMode
sub esp, 7
jmp 0x68272d
pushfd
jmp 0x67b93f
xchg ch, ah
lea esp, [esp + 3]
jmp 0x682717
mov dword [esp + 0x18], esi
push esi
push dword [esp + 2]
push word [esp + 4]
lea esp, [esp + 2]
mov dword [esp + 0x1c], edi
jmp 0x6826a9
mov edi, dword [esp + 0x30]
mov dh, 0xa4
bts ebp, esp
jg 0x68286f
jle 0x6827d0
int 0x7a
mov ah, 0x86
in eax, 0x8d
and al, 3
jp 0x6826e3
xchg ch, ah
lea esp, [esp + 3]
jmp 0x6826e9
mov ebp, dword [esp]
mov al, 0x8c
call fcn.00682772
mov ebp, dword [esp]

Function at 0x6825f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
mov word [esp + 1], dx
mov dword [esp], edx
call fcn.006825e1
in al, 0x6b
sti
sahf
insd dword es:[edi], dx
mov eax, 0x240c890e
push ebp
call fcn.006825f7

Function at 0x68260e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
mov word [esp + 1], dx
mov dword [esp], edx
call fcn.006825e1
in al, 0x6b
sti
sahf
insd dword es:[edi], dx
mov eax, 0x240c890e
push ebp
call fcn.006825f7
Function at 0x69ca6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov dx, word [esp]
inc edx
jb 0x69ca93
jae 0x69d7fb
das
lodsd eax, dword [esi]
cmp eax, 0x3c5db744
setbe byte [ecx]
sar bh, 0x74
and al, 8

Function at 0x69d6d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x69d70d
xor eax, dword [eax]
add byte [eax], al
lea esp, [esp + 2]
mov dword [esp + 4], edx
call 0x69d6f4
stc
jle 0x69d6d6
mov eax, dword [esi - reloc.KERNEL32.dll_SetErrorMode]
add byte [ebx - 0x15], 0xb7
jmp 0x69d6ab
call 0x69d71a
cli
js 0x69d6ea
mov dword [eax - 0x4f], edi
aam 0x55
lds ebp, [edi + ebx*2 + 0x54c646b5]
xor ecx, esi
neg esi
mov word [esp], bx
pop word [esp]
call 0x69d6da
lea esp, [esp + 7]
jmp 0x69d724
lea esp, [esp + 1]
mov dword [esp], ebx
call fcn.0069d792
mov esi, 0x47b4ad3d
mov al, byte [0x91661f8c]

Function at 0x69d6da
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
call 0x69d70d
xor eax, dword [eax]
add byte [eax], al
lea esp, [esp + 2]
mov dword [esp + 4], edx
call 0x69d6f4
stc
jle 0x69d6d6
mov eax, dword [esi - reloc.KERNEL32.dll_SetErrorMode]
add byte [ebx - 0x15], 0xb7
jmp 0x69d6ab
call 0x69d71a
cli
js 0x69d6ea
mov dword [eax - 0x4f], edi
aam 0x55
lds ebp, [edi + ebx*2 + 0x54c646b5]
xor ecx, esi
neg esi
mov word [esp], bx
pop word [esp]
call 0x69d6da
lea esp, [esp + 7]
jmp 0x69d724
lea esp, [esp + 1]
mov dword [esp], ebx
call fcn.0069d792
mov esi, 0x47b4ad3d
mov al, byte [0x91661f8c]

Function at 0x69d6f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x69d70d
xor eax, dword [eax]
add byte [eax], al
lea esp, [esp + 2]
mov dword [esp + 4], edx
call 0x69d6f4
stc
jle 0x69d6d6
mov eax, dword [esi - reloc.KERNEL32.dll_SetErrorMode]
add byte [ebx - 0x15], 0xb7
jmp 0x69d6ab
call 0x69d71a
cli
js 0x69d6ea
mov dword [eax - 0x4f], edi
aam 0x55
lds ebp, [edi + ebx*2 + 0x54c646b5]
xor ecx, esi
neg esi
mov word [esp], bx
pop word [esp]
call 0x69d6da
lea esp, [esp + 7]
jmp 0x69d724
lea esp, [esp + 1]
mov dword [esp], ebx
call fcn.0069d792
mov esi, 0x47b4ad3d
mov al, byte [0x91661f8c]

Function at 0x69d70d
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x69d70d
xor eax, dword [eax]
add byte [eax], al
lea esp, [esp + 2]
mov dword [esp + 4], edx
call 0x69d6f4
stc
jle 0x69d6d6
mov eax, dword [esi - reloc.KERNEL32.dll_SetErrorMode]
add byte [ebx - 0x15], 0xb7
jmp 0x69d6ab
call 0x69d71a
cli
js 0x69d6ea
mov dword [eax - 0x4f], edi
aam 0x55
lds ebp, [edi + ebx*2 + 0x54c646b5]
xor ecx, esi
neg esi
mov word [esp], bx
pop word [esp]
call 0x69d6da
lea esp, [esp + 7]
jmp 0x69d724
lea esp, [esp + 1]
mov dword [esp], ebx
call fcn.0069d792
mov esi, 0x47b4ad3d
mov al, byte [0x91661f8c]
Function at 0x69d71a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x69d70d
xor eax, dword [eax]
add byte [eax], al
lea esp, [esp + 2]
mov dword [esp + 4], edx
call 0x69d6f4
stc
jle 0x69d6d6
mov eax, dword [esi - reloc.KERNEL32.dll_SetErrorMode]
add byte [ebx - 0x15], 0xb7
jmp 0x69d6ab
call 0x69d71a
cli
js 0x69d6ea
mov dword [eax - 0x4f], edi
aam 0x55
lds ebp, [edi + ebx*2 + 0x54c646b5]
xor ecx, esi
neg esi
mov word [esp], bx
pop word [esp]
call 0x69d6da
lea esp, [esp + 7]
jmp 0x69d724
lea esp, [esp + 1]
mov dword [esp], ebx
call fcn.0069d792
mov esi, 0x47b4ad3d
mov al, byte [0x91661f8c]

Function at 0x69d73f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf06890fc
jmp 0x69d79d
pushal
jmp 0x69d770
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x69d7b3
pop word [esp + 0x12]
lea esp, [esp + 2]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], esi
push eax
mov word [esp + 1], si
jmp 0x69d75a
sbb dh, bl
jb 0x69d7cf
mov ebp, 0xdfb2d0f1
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0x69d7d6
pushfd
jmp 0x69bb9a
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0x69d7d6
mov ebp, 0xdfb2d0f1
jmp 0x69d7b9
mov esi, dword [esp + 0x44]
clc
jmp 0x69e3cf
sets ch
lea edx, [ecx*4]
mov dh, 0x9f
jmp 0x69e2b2
je 0x69defa
lea esp, [esp + 1]
jmp 0x69defe
lea esp, [esp + 1]
sub esp, 0xa0
jmp 0x69dde6
lea edi, [esp + 0x18]
mov ebp, esi
mov edx, ebx
xchg bp, cx
sub esp, 9
jmp 0x69de47
mov dh, 0x9f
jmp 0x69e2b2
ja 0x69d7e1
sets ch
lea edx, [ecx*4]
jmp 0x69e32a

Function at 0x69d792
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
mov dword [esp + 4], esp
push esi
call fcn.0069d755

Function at 0x6e6df4
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [ecx - 8], eax
jmp 0x6e6dd7
lea esp, [esp + 4]
add dword [ebp - 4], 4
jmp 0x6e6cf5
mov dword [ecx - 4], eax
jmp 0x6e6d49
pop ebx
mov edi, dword [ecx - 4]
pushal
clc
jmp 0x6e6d15
mov edi, dword [ecx]
jmp 0x6e6d71
mov eax, dword [edx]
mov dword [edx - 4], edi
bswap edi
jmp 0x6e6d33
mov edi, dword [esp]
push edx
mov edx, ecx
jmp 0x6e6d7a
mov dword [ecx + 4], eax
sub esp, 0x1a
mov dword [esp + 0xf], eax
lea esp, [esp + 2]
jmp 0x6e6d84
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [edx], edi
jmp 0x6e6d52
add edx, 4
mov edi, dword [edx]
pop edx
stc
stc
jmp 0x6e6d5a
push esi
mov esi, edx
add esi, 4
jmp 0x6e6db3
pop dword [esp + 7]
lea esp, [esp + 3]
jmp 0x6e6de3
push ebx
mov ebx, edx
add ebx, 0xfffffff8
mov dword [ebx], edi
jmp 0x6e6d2b
mov dword [esi], edi
pop esi
lea esp, [esp + 0x38]
sub ebx, 4
sub esp, 0x1b
jmp 0x6e6d8c
mov eax, dword [edx - 4]
cmc
push cx
lea esp, [esp + 2]
jmp 0x6e6da3
lea esp, [esp + 0x14]
add ecx, 0x10
sub edx, 0x10
pushal
call 0x6e6df4
fsubp st(3)
inc esp
jl 0x68a635
mov al, byte [esp]
jmp 0x6e6e1f
mov eax, dword [ebp - 8]
jmp 0x68a64b

Function at 0x6e6f49
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, dword [edi*4 + reloc.KERNEL32.dll_SetErrorMode]
call 0x6e6f49
add al, ch
add dword [eax], eax
add byte [eax], al
out 0xeb, eax
or ecx, dword ds:[edx + eax - reloc.KERNEL32.dll_SetErrorMode]
sbb dword [ecx - 0x62fe418], ecx
jp 0x6e6f42
invalid
Function at 0x6e6fae
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp], ebx
movzx edi, byte [edi*4 + 0x699394]
call 0x6e6e77
Function at 0x6e7069
Capabilities:
Encrypt data using aes

Disassembly:
not bh
movzx ebx, byte [esi + 5]
call fcn.006e6fbe
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_SetErrorMode]
inc bl
mov ebx, 0xcdd130cb
jmp 0x6e6fd4
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_SetErrorMode]
push dx
add esp, 1
lea esp, [esp + 1]
jmp 0x6e6ffa
movzx ebx, byte [esi + 2]
push ax
lea esp, [esp + 2]
jmp 0x6e7039
Function at 0x6e7231
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x6e7293
pop word [esp]
lea esp, [esp + 2]
and edx, ecx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_SetErrorMode]
jmp 0x6e727d

Function at 0x6e7362
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 0x10]
lea esp, [esp + 2]
jmp 0x6e72ff
mov ebx, dword [edx]
pop edx
neg di
mov edi, edx
pushal
jmp 0x6e72c8
push ebp
jmp 0x6e733f
shr edi, 0x18
clc
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x6e72e9
push edx
mov edx, ebx
lea edx, [edx*4]
lea edx, reloc.KERNEL32.dll_SetErrorMode
jmp 0x6e72de
pop ebp
call fcn.006e73de
sbb bl, byte [ecx + 0x7c9b6809]
jl 0x6e7331
or dword [eax - 0x65], ebp
jl 0x6e73b2
cli
push 0x5b04fa0f
mov dl, 0xad
mov esp, 0x2c8def8b
lodsd eax, dword [esi]
add byte [eax], al
add byte [eax], al
mov ebp, edi
lea ebp, [ebp*4]
lea ebp, reloc.KERNEL32.dll_SetErrorMode
mov edi, dword [ebp]
jmp 0x6e7329
jmp 0x6e7317
pop es
Function at 0x796b84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x38
mov eax, dword [0x84c604]
xor eax, esp
mov dword [esp + 0x34], eax
push ebp
push esi
mov esi, edx
movzx eax, word [esi + 0x46]
test ax, ax
mov dword [esp + 0x10], ecx
jne 0x796bc6
mov eax, dword [esp + 0x44]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov eax, 1
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.007f360e
add esp, 0x38
ret
jbe 0x796c62
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ebp, [ecx + edx + 0x18]
push 0
mov eax, ebp
cdq
push edx
push eax
mov eax, dword [edi + 8]
push ebx
call eax
test eax, eax
jne 0x796c62
cmp word [esi + 0x46], ax
mov dword [esp + 0xc], eax
jbe 0x796c62
mov edi, edi
mov edx, dword [edi + 4]
push 0x28
lea ecx, [esp + 0x18]
push ecx
push ebx
call edx
cmp eax, 0x28
jne 0x796c62
lea eax, [esp + 0x14]
call fcn.00796974
test eax, eax
je 0x796c62
mov ecx, dword [esp + 0x44]
cmp ecx, dword [esp + 0x20]
jb 0x796c75
cmp dword [esp + 0x28], 0
je 0x796c3b
lea eax, [esp + 0x14]
mov ecx, esi
call fcn.00796b44
mov ecx, dword [esp + 0x20]
add eax, ecx
cmp dword [esp + 0x44], eax
jb 0x796c9f
add ebp, 0x28
push 0
mov eax, ebp
cdq
push edx
push eax
mov eax, dword [edi + 8]
push ebx
call eax
test eax, eax
jne 0x796c62
mov eax, dword [esp + 0xc]
movzx ecx, word [esi + 0x46]
add eax, 1
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x796bf4
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.007f360e
add esp, 0x38
ret
cmp dword [esp + 0xc], 0
jne 0x796c62
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
mov dword [eax + 4], 0
mov eax, 1
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.007f360e
add esp, 0x38
ret
cmp word [esi + 0x44], 0x8664
mov esi, dword [esi + 0x78]
cmp esi, 0x1000
mov eax, dword [esp + 0x28]
jl 0x796cb9
and eax, 0xfffffe00
xor edx, edx
xor esi, esi
sub eax, ecx
sbb edx, esi
xor ecx, ecx
add eax, dword [esp + 0x44]
pop esi
adc edx, ecx
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x38]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.007f360e
add esp, 0x38
ret
Function at 0x796cf4
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov ebx, ecx
mov esi, eax
mov eax, dword [edi + 0xc]
push ebx
call eax
mov ecx, dword [edi + 8]
push 2
push 0
push 0
push ebx
mov ebp, eax
mov dword [esp + 0x28], edx
call ecx
mov edx, dword [edi + 0xc]
push ebx
call edx
mov ecx, dword [edi + 8]
push 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push eax
push ebp
push ebx
mov dword [esp + 0x20], edx
call ecx
mov ebp, dword [esp + 0x10]
test ebp, ebp
ja 0x796d45
cmp dword [esp + 0xc], 0x40
jb 0x796e7c
mov edx, dword [edi + 8]
push 0
push 0
push 0
push ebx
call edx
test eax, eax
jne 0x796e7c
mov eax, dword [edi + 4]
push 0x40
push esi
push ebx
call eax
cmp eax, 0x40
jne 0x796e7c
cmp byte [0x84da14], 0
jne 0x796da9
movsx cx, byte [esi + 1]
movsx dx, byte [esi]
shl cx, 8
add cx, dx
mov word [esi], cx
movsx eax, byte [esi + 0x3f]
movsx ecx, byte [esi + 0x3e]
movsx edx, byte [esi + 0x3d]
shl eax, 8
add eax, ecx
movsx ecx, byte [esi + 0x3c]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
mov dword [esi + 0x3c], eax
cmp word [esi], 0x5a4d
jne 0x796e7c
mov eax, dword [esi + 0x3c]
cdq
cmp ebp, edx
jb 0x796e7c
ja 0x796dcc
cmp dword [esp + 0xc], eax
jb 0x796e7c
push edx
push eax
push edi
mov edx, ebx
call fcn.00794754
add esp, 0xc
test eax, eax
je 0x796e7c
mov edx, dword [edi + 4]
push 4
lea ebp, [esi + 0x40]
push ebp
push ebx
call edx
cmp eax, 4
jne 0x796e7c
cmp byte [0x84da74], 0
jne 0x796e21
movsx eax, byte [ebp + 3]
movsx ecx, byte [ebp + 2]
movsx edx, byte [ebp + 1]
shl eax, 8
add eax, ecx
movsx ecx, byte [ebp]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
mov dword [ebp], eax
cmp dword [ebp], reloc.KERNEL32.dll_SetErrorMode
jne 0x796e7c
mov edx, dword [edi + 4]
push 0x14
lea ebp, [esi + 0x44]
push ebp
push ebx
call edx
cmp eax, 0x14
jne 0x796e7c
mov eax, ebp
call fcn.00796924
test eax, eax
je 0x796e7c
movzx eax, word [ebp]
cmp ax, 0x14c
jne 0x796e63
add esi, 0x58
push edi
call fcn.007967a4
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp ax, 0x8664
jne 0x796e7c
add esi, 0x58
push edi
call fcn.00796624
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x7d7b0d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.007f4ba4
mov eax, dword [0x84c604]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
test eax, eax
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
jbe 0x7d7ca0
push ebx
add eax, reloc.KERNEL32.dll_SetErrorMode
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
add eax, 1
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
xor eax, eax
mov ah, byte [esi + 1]
add esi, 1
movzx ecx, byte [esi + 1]
add esi, 1
movzx edx, byte [esi + 1]
or ebx, eax
add esi, 1
movzx eax, byte [esi + 1]
shl ecx, 0x10
add esi, 1
or ebx, ecx
xor ecx, ecx
mov ch, byte [esi + 1]
add esi, 1
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 1]
or eax, ecx
add esi, 1
movzx ecx, byte [esi + 1]
add esi, 1
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 1
mov byte [edi], dl
mov byte [ebp], al
call fcn.007e1784
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.007e1804
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00811a04
push ebp
call fcn.007e1784
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.007e1804
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00811a04
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
add eax, 1
shr edx, 8
add esp, 0x30
mov byte [eax], dl
add eax, 1
add eax, 1
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
add eax, 1
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
add eax, 1
add eax, 1
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
add eax, 1
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
add eax, 1
mov byte [eax], cl
mov edx, ecx
shr edx, 8
add eax, 1
mov byte [eax], dl
mov edx, ecx
add eax, 1
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x7d7b2b
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.007f360e
add esp, 0xa0
ret
Function at 0x7e7344
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x7e735d
mov esi, edi
mov edi, eax
jmp 0x7e735f
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x7e736f
mov eax, ebx
jmp 0x7e7379
push eax
push ebx
call fcn.007aa024
add esp, 8
test eax, eax
jne 0x7e7381
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x7e739f
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x7e7388
cmp eax, dword [esi + 4]
jge 0x7e73b6
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x7e73a4
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x7e73d9
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x7e73d6
sub eax, 1
test eax, eax
jg 0x7e73c6
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x899c79
Capabilities:
Check http status code

Disassembly:
call fcn.008992fb
push eax
call fcn.0068cfe4
jmp 0x8992f6