joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565230
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56540e
movzx eax, byte [esp + 4]
cmp al, 0x61
jb 0x56525b
cmp al, 0x7a
ja 0x56525b
mov byte [esp + 0xc], 0
ret
cmp al, 0x41
jb 0x565407
cmp al, 0x5a
setbe cl
test cl, cl
jne 0x565255
cmp al, 0x30
jb 0x565400
cmp al, 0x39
setbe cl
test cl, cl
jne 0x565255
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x5653f2
cmp al, 0x2c
ja 0x5653cf
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x5652a5
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x56529f
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x56529f
cmp al, 0x2f
ja 0x565395
cmp al, 0x26
ja 0x56536d
cmp al, 0x24
jne 0x565362
cmp ecx, 2
jg 0x565326
cmp ecx, 1
je 0x56531b
cmp ecx, 2
jne 0x5652fd
cmp al, 0x2f
jne 0x5652eb
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x5652e1
cmp al, 0x2c
je 0x5652e1
cmp al, 0x3f
sete al
jmp 0x5652e6
cmp ecx, 7
jne 0x565315
cmp al, 0x21
jne 0x56530d
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x565307
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x56534c
cmp al, 0x40
jne 0x56533a
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x565330
cmp al, 0x3f
je 0x565330
cmp al, 0x3a
sete al
jmp 0x565335
cmp ecx, 6
je 0x56535c
cmp ecx, 7
jne 0x5652fd
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x5652cd
jmp 0x5652fd
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5652cd
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x565387
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x5652cd
jmp 0x5652fd
cmp al, 0x3d
ja 0x5653b4
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5652cd
cmp al, 0x3d
je 0x5652cd
jmp 0x5652fd
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x5652cd
cmp al, 0x5f
je 0x565381
cmp al, 0x7e
je 0x565381
jmp 0x5652fd
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x56529f
cmp al, 0x5b
je 0x56529f
cmp al, 0x5d
je 0x56529f
jmp 0x5652b2
cmp ecx, 4
je 0x56528e
jmp 0x5652b2
xor ecx, ecx
jmp 0x56527d
xor ecx, ecx
jmp 0x56526a
call fcn.0044eab0
jmp fcn.00565230
Function at 0x5f5e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f60a9
sub esp, 0x70
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x5f6092
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00450574
lea ecx, [0x6a60a0]
mov dword [esp], ecx
mov edx, dword [esp + 0x74]
mov dword [esp + 4], edx
lea ebx, [esp + 0x40]
mov dword [esp + 8], ebx
call fcn.0040c230
xor eax, eax
jmp 0x5f5f03
mov eax, dword [esp + 0x44]
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x40]
mov dword [esp], ecx
call fcn.0040c4a0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
add eax, ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
test ecx, ecx
jne 0x5f5ee2
lea ecx, [0x6690a0]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.0043bc50
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx]
lea ebx, [0x6a60a0]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], 0
call fcn.0040afc0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00450574
lea eax, [0x6a60a0]
mov dword [esp], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 8], ecx
call fcn.0040c230
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
jmp 0x5f5fb2
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.0040c4a0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
sub ecx, eax
mov edx, ecx
neg ecx
shl eax, 3
sar ecx, 0x1f
and eax, ecx
mov ecx, dword [esp + 0x38]
add eax, ecx
mov ecx, edx
mov edx, dword [esp + 0x40]
test edx, edx
je 0x5f6086
mov dword [esp + 0x38], eax
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 8]
mov esi, dword [ebx + 4]
mov ebx, dword [ebx]
mov edi, dword [edx + 4]
mov dword [esp + 0x2c], edi
mov edx, dword [edx]
mov dword [esp + 0x30], edx
lea edi, [0x6690a0]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebp
call fcn.00410400
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
cmp edx, ebx
ja 0x5f60a3
mov dword [esp + 0x28], edx
lea eax, [0x6a60a0]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x30]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
call fcn.0040f690
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, dword [0x98ef80]
test ecx, ecx
jne 0x5f606b
mov edx, dword [esp + 0x38]
mov dword [edi], edx
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jbe 0x5f5f88
jmp 0x5f609e
mov ecx, eax
mov eax, dword [esp + 0x38]
call fcn.004502f0
mov ebx, dword [esp + 0x24]
cmp ecx, ebx
mov eax, ecx
mov ecx, ebx
mov edx, dword [esp + 0x38]
jmp 0x5f6063
mov eax, dword [esp + 0x34]
mov dword [esp + 0x78], eax
add esp, 0x70
ret
mov dword [esp + 0x78], 0
add esp, 0x70
ret
call fcn.004503d0
call fcn.00450410
nop
call fcn.0044eab0
jmp fcn.005f5e90
Function at 0x40275c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402b78
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c10
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402bf0
xor eax, eax
push ebp
push 0x402be9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c2c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402bf0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4034cc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a044], 0
je 0x40352d
cmp word [0x40a218], 0xd7b2
jne 0x4034f5
cmp dword [0x40a220], 0
jbe 0x4034f5
mov eax, 0x40a214
call dword [0x40a230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409050
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403554
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x40901c], 0
jne 0x403549
push 0
push 0x409070
push 0x409050
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x403fa0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4041d0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404023
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4041d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404023
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4041ec
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4040ac
xor eax, eax
push ebp
push 0x4040a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403de8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40408a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40420c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40408a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040ac
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4041c6
cmp byte [ebp - 0xd], 0
jne 0x4040f3
cmp byte [ebp - 0x12], 0
je 0x4041c6
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40410c
dec ebx
cmp byte [ebx], 0x2e
je 0x40411b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40410b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4041c6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404158
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4041c6
cmp byte [ebp - 0xd], 0
je 0x4041c6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4041c6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4060dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x406115
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403738
jmp 0x40611e
mov eax, ebx
mov edx, esi
call fcn.0040369c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406128
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x406149
mov al, byte [esp]
jmp 0x40614b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407200
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407264
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040388c
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00405408
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40726b
lea eax, [ebp - 0xc]
call fcn.00403648
ret
Function at 0x40881c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, 0x4087d4
call fcn.004044e8
mov esi, 0x40a84c
mov edi, 0x40a880
xor eax, eax
push ebp
push 0x4089de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40a710]
mov dword [esi + 0x10], eax
mov dword [0x40a8a4], 0x12c
mov dword [0x40a8a8], 0x9b
xor eax, eax
mov dword [esi], eax
push 0x4089f0
mov eax, dword [esi + 0x10]
push eax
call sub.user32.dll_LoadIconA
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x408690
mov dword [esi + 0x1c], 0x10
mov eax, 0x4089fc
mov dword [esi + 0x24], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0xc], eax
mov eax, 0x408a08
mov dword [esi + 0x20], eax
push esi
call sub.user32.dll_RegisterClassA
push 0x80000000
push 0x80000000
mov eax, dword [0x40a8a4]
push eax
mov eax, dword [0x40a8a8]
push eax
push 0
push 0
mov eax, dword [0x40a710]
push eax
push 0
mov edx, 0x408a0c
mov ecx, 0xc80000
mov eax, dword [esi + 0x24]
call fcn.0040469c
mov ebx, eax
test ebx, ebx
jne 0x408903
mov eax, dword [0x40a710]
push eax
mov eax, dword [esi + 0x24]
push eax
call sub.user32.dll_UnregisterClassA
jmp 0x4089d0
push 0
mov eax, dword [0x40a710]
push eax
push 0
push ebx
push 0x14
push 0x113
push 0xa
push 0xa
push 0x50000081
push 0x408a20
push 0x408a2c
push 0x200
call sub.user32.dll_CreateWindowExA
mov dword [0x40a87c], eax
push 0
mov eax, dword [0x40a710]
push eax
push 0
push ebx
push 0x14
push 0x113
push 0x28
push 0xa
push 0x50000081
push 0x408a20
push 0x408a2c
push 0x200
call sub.user32.dll_CreateWindowExA
mov dword [0x40a874], eax
push 0
mov eax, dword [0x40a710]
push eax
push 0
push ebx
push 0x14
push 0x113
push 0x5a
push 0xa
push 0x50000881
push 0x408a08
push 0x408a2c
push 0x200
call sub.user32.dll_CreateWindowExA
mov dword [0x40a878], eax
call fcn.00407d34
push 1
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_UpdateWindow
jmp 0x4089c0
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
push 0
push 0
push 0
push edi
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x4089b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4089e5
ret
Function at 0x10001ccb
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov al, byte [ecx]
and dword [esp + 0x18], 0
push ebx
push esi
mov byte [edx], al
lea eax, [edx + 1]
push edi
xor edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.10001e7d
test eax, eax
je 0x10001e2f
lea ecx, [esp + 0x18]
call fcn.10001e7d
lea ecx, [esp + 0x18]
test eax, eax
je 0x10001d9e
call fcn.10001e7d
test eax, eax
je 0x10001d5c
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.10001e7d
lea edi, [eax + edi*2]
dec ebx
jne 0x10001d2e
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x10001d4f
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x10001d52
mov byte [edx], 0
mov ebx, dword [esp + 0x10]
inc edx
jmp 0x10001e41
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x10001d92
test ecx, ecx
je 0x10001e2a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x10001d84
jmp 0x10001e26
xor ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
jmp 0x10001e2a
call fcn.10001e5c
test edi, edi
jne 0x10001dd3
cmp eax, 2
jne 0x10001dce
lea ecx, [esp + 0x18]
call fcn.10001e5c
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x10001e2a
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x10001dc3
jmp 0x10001e26
sub eax, 3
jmp 0x10001dd6
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.10001e5c
mov ecx, eax
cmp esi, 0x7d00
jb 0x10001dfd
inc ecx
cmp esi, 0x500
jb 0x10001e06
inc ecx
cmp esi, 0x80
jae 0x10001e11
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x10001e2a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x10001e1d
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x10001e47
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebx, ebx
je 0x10001cfe
sub edx, dword [esp + 0x14]
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002dda
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
mov dword [ebp - 4], edi
test ebx, ebx
je 0x10002e20
mov edi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov edx, dword [esi]
add al, bl
cmp dword [ebp + 0x10], 0
movzx ecx, al
je 0x10002e0f
add edx, ebx
xor edx, edi
rol edx, cl
jmp 0x10002e15
ror edx, cl
xor edx, edi
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x10002df7
mov edi, dword [ebp - 4]
test edi, edi
je 0x10002e2d
mov eax, dword [ebp + 8]
xor byte [esi], al
inc esi
dec edi
jne 0x10002e27
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10002e34
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push esi
mov esi, ecx
xor ecx, ecx
mov edx, dword [esi + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
add edx, esi
mov dword [eax], ecx
mov eax, 0x14c
push edi
mov edi, ecx
cmp word [edx + 4], ax
jne 0x10002f8a
push ebx
mov ebx, dword [edx + 0x88]
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x10002f89
cmp dword [edx + 0x8c], ecx
je 0x10002f89
movzx eax, word [edx + 0x14]
add eax, 0x18
add eax, edx
movzx edx, word [edx + 6]
test edx, edx
je 0x10002f89
cmp dword [eax + 0xc], ebx
je 0x10002ea5
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x10002e93
jmp 0x10002f89
mov edx, dword [eax + 0x14]
add edx, esi
push 0
movzx ecx, word [edx + 0xe]
movzx eax, word [edx + 0xc]
add ecx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
pop ebx
je 0x10002f89
xor eax, eax
mov esi, dword [edx + eax*8 + 0x14]
and esi, 0x7fffffff
add esi, edx
mov dword [ebp - 0x10], 0
movzx eax, word [esi + 0xe]
mov dword [ebp - 4], eax
movzx eax, word [esi + 0xc]
add dword [ebp - 4], eax
je 0x10002f7d
xor eax, eax
mov ecx, dword [ebp + 8]
cmp word [esi + eax*8 + 0x10], cx
mov ecx, dword [ebp - 4]
jne 0x10002f64
mov ecx, dword [esi + eax*8 + 0x14]
and ecx, 0x7fffffff
add ecx, edx
mov dword [ebp - 0xc], 0
movzx eax, word [ecx + 0xe]
mov dword [ebp - 8], eax
movzx eax, word [ecx + 0xc]
add dword [ebp - 8], eax
je 0x10002f5d
xor eax, eax
mov edx, 0x409
cmp word [ecx + eax*8 + 0x10], dx
mov edx, dword [ebp - 0x14]
je 0x10002f40
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
movzx eax, ax
cmp eax, dword [ebp - 8]
jb 0x10002f20
jmp 0x10002f5d
mov ecx, dword [ecx + eax*8 + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [ecx + edx]
sub eax, dword [ebp - 0x18]
add eax, edx
mov dword [edi], eax
mov eax, dword [ecx + edx + 4]
mov ecx, dword [ebp + 0x10]
xor edi, edi
mov dword [ecx], eax
inc edi
test edi, edi
jne 0x10002f89
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
movzx eax, ax
cmp eax, ecx
jb 0x10002eee
test edi, edi
jne 0x10002f89
mov ecx, dword [ebp - 0x1c]
inc ebx
movzx eax, bx
cmp eax, ecx
jb 0x10002ec5
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 0xc
Function at 0x10003001
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
add ebx, esi
push 0x40
lea eax, [ebx + 0x18]
push 0x3000
push dword [eax + 0x38]
mov dword [ebp - 4], ecx
push 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
call dword [0x445070]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1000316b
push 0x40
mov edx, esi
mov ecx, edi
call 0x10005240
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call 0x10005240
mov eax, dword [ebp - 8]
lea ebx, [esi + 0x18]
movzx ecx, word [eax + 0x14]
movzx esi, word [esi + 0x14]
lea edx, [eax + 0x18]
movzx eax, word [eax + 6]
add ecx, edx
add esi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x100030c9
mov ebx, ecx
sub ebx, esi
mov edi, eax
push 0x28
lea edx, [ebx + esi]
mov ecx, esi
call 0x10005240
add esi, 0x28
dec edi
jne 0x10003087
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x100030c9
lea esi, [ecx + 0x14]
mov ebx, eax
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call 0x10005240
lea esi, [esi + 0x28]
dec ebx
jne 0x100030ae
mov ebx, dword [ebp - 0xc]
push ebx
mov edx, edi
mov ecx, edi
call fcn.10001f85
push dword [ebp - 0x18]
mov ecx, dword [0x446438]
mov edx, edi
call fcn.10001ee1
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10003168
cmp dword [ebx + 0x64], 0
je 0x10003168
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10003110
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, eax
xor eax, eax
jmp 0x10003114
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 4]
push 2
mov dword [edx + 4], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x1000313d
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, eax
xor eax, eax
jmp 0x1000313f
mov ecx, eax
mov edx, dword [ebp - 4]
push 3
mov dword [edx + 8], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10003162
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8