joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410daa
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x42aa85
call fcn.00428650
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.00410e09
push dword [esi + 0x24]
call fcn.00402153
push dword [esi + 0x18]
call fcn.00402153
push dword [esi + 0xc]
call fcn.00402153
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x42d13c
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x41221f
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x42acb0
call fcn.00428650
sub esp, 0x320
push ebx
mov dword [ebp - 0x1c], ecx
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00402679
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp byte [esi], 0
je 0x41228c
push dword [esi + 0xc]
lea ecx, [ebp - 0x40]
push dword [esi + 8]
call fcn.004120db
push eax
mov edx, 0xdb0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.0041217b
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040281c
push dword [ebp - 0x58]
call fcn.00402153
push dword [ebp - 0x40]
and byte [ebp - 4], 0
call fcn.00402153
pop ecx
pop ecx
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.00402b19
lea ebx, [eax + 1]
lea eax, [ebp - 0x4c]
push ebx
push eax
mov ecx, edi
call fcn.004096fb
mov eax, dword [edi]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
lea eax, [eax + ebx*2]
push eax
call fcn.004026bc
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x4c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.004121c1
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.004121c1
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040274c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00402996
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402a09
lea ecx, [ebp - 0x18]
call fcn.00402996
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402a09
lea ecx, [ebp - 0x18]
call fcn.00402996
cmp byte [esi + 1], 0
je 0x412368
mov edx, 0x3f4
lea ecx, [ebp - 0x40]
call fcn.00405970
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.00402a09
push dword [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.00402153
lea ecx, [ebp - 0x18]
mov dword [esp], 0x42d230
call fcn.00402a45
push 0
lea edx, [ebp - 0x78]
lea ecx, [esi + 0x10]
call fcn.00405924
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402a45
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call esi
push dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [edi]
push 0x110
lea eax, [ebp - 0x32c]
push 0x2b4
push eax
push 0x80
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4123bf
push dword [ebp + 0xc]
push dword [ebx + 4]
call esi
push 0
push dword [ebp - 0x32c]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x18]
call fcn.00402153
push dword [ebp - 0x34]
call fcn.00402153
push dword [ebp - 0x4c]
call fcn.00402153
push dword [ebp - 0x28]
call fcn.00402153
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x412596
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x42ace8
call fcn.00428650
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov byte [esi + 3], bl
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.00402679
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.00402679
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.00402679
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
call fcn.0041262c
lea ecx, [esi + 0x98]
call fcn.004273d0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x414dc7
Capabilities:
Get file system object information

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret 0xc

Function at 0x414fd8
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
lea eax, [esp]
neg cl
sbb ecx, ecx
and cl, 1
add ecx, 0x100
or cx, 0x4010
push ecx
push 0x2b4
push eax
push 0x90
push 0x42c960
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0x2b4
ret

Function at 0x415587
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x42b163
call fcn.00428650
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x42d108
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
call fcn.00402679
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402679
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], bl
mov byte [esi + 0x25], bl
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi], 0x42d3cc
mov byte [esi + 0x30], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x421730
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x42176d
push 0x42dc98
push 0x42c874
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42176d
push 0xc00
call eax
test eax, eax
jne 0x421806
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421806
cmp eax, 0x104
ja 0x421806
cmp word [esp + eax*2 + 6], 0x5c
je 0x42179c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [0x42dc40]
cmp byte [esi], 0
je 0x421806
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x4217db
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x4217c7
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x4217bc
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x1001934
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10060ac]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
xor esi, esi
lea eax, [ebp - 0x210]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x10012b0
push 0x80000000
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001ac4
cmp dword [ebp - 0x214], 1
jne 0x1001ac4
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, 0x10012b8
push ebx
call edi
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push esi
push esi
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x1001ac2
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x10012c8
push 0x80000000
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001ac2
push 0x10012d8
call edi
push eax
push 0x10012d8
push 1
push esi
push esi
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x1001ac2
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x10012e4
push 0x80000000
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001ac2
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010018e9
lea eax, [ebp - 0x20c]
push eax
push 0x1001308
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push esi
push esi
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x1001ac2
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x210], esi
pop edi
pop ebx
cmp dword [ebp - 0x210], esi
pop esi
je 0x1001ad9
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
call fcn.0100491e
leave
ret
Function at 0x1002772
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10060ac]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
je 0x100284e
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push ebx
push 0x1001434
push 0x80000002
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100283a
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
push 0x1001433
push dword [ebp - 0x10c]
mov dword [ebp - 0x114], 0x103
mov byte [ebp - 5], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100283a
cmp dword [ebp - 0x110], 2
lea eax, [ebp - 0x108]
jne 0x100281d
push dword [ebp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x114], eax
jmp 0x100283a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100283a
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x10c], ebx
je 0x100284e
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0100491e
leave
ret 8
Function at 0x1004237
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x10042f8
cmp dword [ebp + 0x10], ebx
je 0x10042f8
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x100427c
mov dword [ebp - 4], 0x80040116
jmp 0x10042ec
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1004295
mov dword [ebp - 4], 0x80040116
jmp 0x10042e4
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
jne 0x10042ae
mov dword [ebp - 4], 0x8007000e
jmp 0x10042e3
push ebx
lea eax, [ebp - 8]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10042cb
mov dword [ebp - 4], 0x80040116
jmp 0x10042e3
cmp esi, dword [ebp - 8]
je 0x10042d9
mov dword [ebp - 4], 0x80004005
jmp 0x10042e3
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
pop edi
mov eax, dword [ebp + 8]
cmp eax, ebx
pop esi
je 0x10042f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x10042fd
mov eax, 0x80070057
pop ebx
leave
ret 0xc

Function at 0x100491e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10060ac]
jne 0x100492f
test ecx, 0xffff0000
jne 0x100492f
ret
jmp fcn.01004939
Function at 0x1004a1e
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001770
call fcn.01004c44
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x1000000], 0x5a4d
jne 0x1004a71
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1004a71
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1004a89
cmp ecx, 0x20b
je 0x1004a76
mov dword [ebp - 0x1c], ebx
jmp 0x1004a9d
cmp dword [eax + 0x84], 0xe
jbe 0x1004a71
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x1004a97
cmp dword [eax + 0x74], 0xe
jbe 0x1004a71
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x1006404], edi
mov dword [0x1006408], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1006400]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10063fc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100640c], eax
call fcn.01004c3a
cmp dword [0x10060b0], ebx
jne 0x1004afa
push fcn.01004c3a
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01004c23
push 0x1001190
push 0x100118c
call sub.msvcrt.dll__initterm
mov eax, dword [0x10063f8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10063f4]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1001188
push 0x1001180
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x1004b85
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1004b65
cmp cl, 0x22
jne 0x1004b56
cmp byte [eax], 0x22
jne 0x1004b6e
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1004b79
cmp cl, 0x20
jbe 0x1004b6a
test byte [ebp - 0x54], 1
je 0x1004b90
movzx ecx, word [ebp - 0x50]
jmp 0x1004b93
cmp byte [eax], 0x20
jbe 0x1004b6e
inc eax
mov dword [ebp - 0x20], eax
jmp 0x1004b85
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call fcn.0100292d
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1004bb1
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x1004bed
mov eax, esi
jmp 0x1004c01
call fcn.01004c7f
ret
Function at 0x180b9cae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
je 0x180b9cc2
cmp ecx, 1
je 0x180b9cc2
jmp 0x180b9cbc
mov dword [esi], 2
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp + 0xc]
call 0x1b805d52
or dword [esi], 1
mov ecx, dword [ebp + 0xc]
mov eax, ebx
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x10]
pop edi
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x70]
pop esi
pop ebx
xor ecx, esp
call 0xda698277
and byte [eax], al
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x1822500c]
xor eax, esp
mov dword [esp + 0x78], eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x34], ebx
mov eax, dword [esi + 0x14]
and eax, 0x3000
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], edx
cmp eax, 0x3000
jne 0x180b9d44
push edx
push esi
push ecx
push edi
push ebx
push dword [ebp + 8]
call 0x12461bf
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 4]
mov dword [esp + 0x30], ecx
and al, 0x30
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x2c]
push eax
call 0xa5e428ae
dec esp
and al, 0x2c
mov dword [esp + 0x40], ebx
call 0x5c98b0ec
and al, 0x5c
push eax
mov ecx, ebx
call dword [edx + 0x14]
mov eax, dword [esi + 0x30]
mov ebx, dword [esp + 0x34]
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
mov ecx, dword [eax + 4]
mov dword [esp + 0x30], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x2c]
push eax
call 0x3c582ae9
sub al, 0x8b
invalid

Function at 0x180dd5d9
Capabilities:
Encode data using xor

Disassembly:
mov byte [ebx], dh
leave
push ecx
mov dword [ebp - 0x2c], eax
mov ecx, edi
push 0xffffffffffffffff
movsx eax, word [eax + 0x40]
push eax
call 0xdc91c679
or al, 0x85
test byte [edi], 0x84
mov edi, dword [ebp - 0x2c]
xor eax, eax
push dword [esi + 0x30]
inc eax
or dword [esi + 8], eax
mov byte [esi + 2], al
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 8]
xor eax, dword [esi + 8]
push ecx
and eax, 4
or byte [ecx - 0x7d], dl
loopne 0x180dd622
xor dword [esi + 8], eax
mov ecx, dword [edi + 0x10]
push 4
dec edi
adc byte [edx + 4], ch
pop eax
push eax
call 0xdc91c6b8
or al, 0x89
jne 0x180dd619
jmp 0x9d1a19c1
Function at 0x181082ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [edi], cl
mov bh, 0x46
or al, 0x89
inc esp
and al, 0x34
test eax, 0x1ff
jne 0x3434cf4c
xor eax, eax
push eax
push 0x198
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call 0x716a5b61
test ebx, ebx
je 0x225f0644
and byte [ebx], dh
leave
mov eax, 0x400
mov dword [esi + 0x18], ebx
push 0x180
mov word [esi + 0xc], ax
lea esi, [ebx + 0x18]
push ecx
push esi
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
call 0x4c34c78f
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov ecx, ebx
mov eax, dword [eax]
mov dword [ebx], eax
xor eax, eax
mov byte [ebx + 9], al
mov dword [ebx + 4], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 8
mov dword [ebx + 0x14], esi
mov edx, dword [edx]
push 0x2c
call 0x9b1cf6ba
out dx, al
add dword [ecx + 0x78], ebx
sbb byte [ebx + 0x5630247c], cl
mov edi, dword [esp + 0x30]
push esi
mov edx, ebx
mov ecx, edi
call 0x711271c5
jns 0x18108334
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0x51], 0
jne 0x181083a6
mov esi, dword [ebx + 0x14]
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jle 0x181083a6
mov edi, dword [esp + 0x34]
mov eax, dword [esi]
movzx ecx, byte [eax]
call 0x218643f6
push 0x40
pop eax
cmp word [esi + 0xc], ax
jne 0x18108392
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [ecx + 0x1e8]
call 0x6c1a7b97
and al, 0x38
add esi, 0x30
sub ebx, 1
jne 0x1810835f
jmp 0x18108395
leave
mov dword [esp + 0x34], edi
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
and ecx, dword [esp + 0x34]
and edx, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
jmp 0x22573ace

Function at 0x181277b0
Capabilities:
Encode data using xor

Disassembly:
xor ebx, dword [edx]
sub esi, 4
mov eax, ebx
add edx, 4
shr eax, 0x10
movzx ecx, al
mov eax, ebx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x181ea250]
xor ecx, dword [eax*4 + 0x181ea650]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x181e9e50]
sbb byte [edi], cl
mov dh, 0xc3
sbb byte [edi], cl
mov dh, 0xc3
xor ecx, dword [eax*4 + 0x181eaa50]
mov ebx, ecx
sub edi, 1
jne 0x1812777f
pop edi
test esi, esi
je 0x181277df
movzx eax, byte [edx]
xor eax, ebx
shr ebx, 8
movzx eax, al
invalid
sbb al, 0x85
push eax
sahf

Function at 0x1816d040
Capabilities:
Encode data using xor

Disassembly:
dec esi
or al, 0x56
call 0xd89bd3d3
je 0x1816d07d
xor ecx, dword [ebx - 0x7afb88]
mov edi, dword [eax + 4]
test edi, edi
je 0x1816d07d
xor edx, edx
lea eax, [edi + 0x18]
inc edx
xchg dword [eax], edx
push 0xfffffc19
lea ecx, [edi - 0x5c]
call 0x67a3d0d0
movsb byte es:[edi], byte [esi]
call 0x218b0ba7
mov eax, dword [edi + 4]
mov edi, eax
test eax, eax
jne 0x1816d049
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 1
add byte [eax], al
call 0x181f936c
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
sete al
pop ebp
ret
Function at 0x1818368f
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x78380000
out 0xa8, al
push 0xffffffffffffffbf
mov dl, 0x5b
push cs
add al, 0xd
sub eax, 0xbd3d
cmp byte [edx - 0x5b], dl
invalid
Function at 0x4059e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4059c6
add esp, 0xfffffff0
call fcn.00402ac8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x405a1c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00404cdc
mov edi, dword [edx + 0x643695fd]
xor edx, 0x3dec6bfa
push edx
mov esi, 0x10540310
mov ecx, 0x49aa94c0
xor esi, ecx
mov edi, esi
xor edi, 0xffffffff
and edi, 0x64b8bf
and esi, 0xff9b4740
or esi, edi
pop ebx
xor esi, ebx
mov ebx, 0
xor ebx, esi
mov edx, ebx
mov edi, edx
mov edx, 0x54
sub edi, edx
push 0x36ec070
mov ebx, 0x36ec071
pop ecx
xor ebx, ecx
sub edi, ebx
mov eax, dword [edi + 0x55]
mov ebx, 0x739365b8
xor ebx, 0x739365b8
push ebx
mov ecx, 0
mov edx, 0
xor ecx, edx
xor ecx, esp
mov esi, ecx
mov edx, esi
mov esi, 4
sub esp, esi
mov dword [esp], edx
push 0x3970b8d7
mov esi, 0x3970b897
pop edi
xor esi, edi
push esi
mov ebx, 0x1600
mov edx, 0x8800
xor ebx, edx
push ebx
mov edi, 0x400fa7
add edi, 0x59
push edi
call eax
pop eax
mov ebx, 0x1daf52d0
xor ebx, 0x11b9fc39
mov ecx, 0x298d5bdd
mov eax, 0x25dbd535
xor eax, ecx
xor eax, ebx
mov esi, 0x9d064
mov ebx, 0x1d500911
xor esi, ebx
mov edi, esi
xor edi, 0xffffffff
and edi, 0x1d59c3f3
and esi, 0xe2a63c0c
or esi, edi
xor eax, esi
push 0x77e14058
mov edx, 0x382e820d
pop esi
xor edx, esi
mov esi, 0x149a68a6
mov ecx, 0x1ee2c074
xor ecx, esi
xor ecx, edx
mov edx, 0x749b207f
mov ebx, 0x3503e6
xor ebx, edx
mov edi, 0xb9a40f2
xor ebx, edi
xor ebx, 0x3a830acd
xor ebx, ecx
push 0x52727e2f
mov edx, 0x65bab2f1
pop edi
xor edx, edi
mov esi, edx
xor esi, 0xffffffff
and esi, 0x44b821e5
and edx, 0xbb47de1a
or edx, esi
mov ecx, 0x3db1a25e
xor ecx, 0x2d81a274
mov edi, 0x41000800
mov esi, 0x22004000
xor edi, esi
xor ecx, edi
xor ecx, edx
mov esi, 0xfffffffc
add esp, esi
push esp
pop esi
push esi
pop edx
mov dword [edx], ebx
mov edx, eax
xor esi, esi
add esi, edx
mov edi, esi
push edi
xor ebx, ebx
mov bl, byte [ecx]
add eax, ebx
mov bl, byte [eax]
mov edi, 0x46e2c023
xor edi, 0xc0497250
push edi
push 0x2b2dd589
mov edx, 0x2f7ed7a3
pop edi
xor edx, edi
pop esi
xor edx, esi
mov edi, eax
mov esi, edi
xor esi, 0
je 0x405b41
pop eax
mov byte [ecx], bl
mov edx, 0xa350fef1
add edx, 0x61
push edx
mov esi, 0x48ab00ac
mov edx, 0x14040001
xor esi, edx
pop edi
xor esi, edi
add ecx, esi
pop ebx
mov edx, 0
mov edi, 0
xor edx, edi
mov esi, 0x39673325
xor esi, 0x39673324
xor edx, esi
sub ebx, edx
mov edx, 0
xor edx, ebx
mov esi, 4
sub esp, esi
mov dword [esp], edx
pop edi
sub edi, 0
jne 0x405b41
push 0x4333e23
mov ebx, 0x555d479d
pop edx
xor ebx, edx
push ebx
mov ecx, 0x5d4c002e
xor ecx, 0x4ca62e55
push ecx
push 0x59607736
mov eax, 0x19a48102
pop ecx
xor eax, ecx
pop ebx
xor eax, ebx
pop edi
xor eax, edi
call eax
pop eax
pop eax
ret