joyce8/EMBER2024-capa huggingface dataset:
Function at 0x327834
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
push dword [esp + 0x30]
mov ebp, ecx
push ebx
push dword [esp + 0x30]
push edx
push ebp
call fcn.00326dc3
and dword [esp + 0x30], 0
add esp, 0x14
and dword [esp + 0x20], 0
xor edx, edx
mov ecx, dword [ebx + 0x3c]
mov dword [esp + 0x18], 0xeded2
add ecx, ebx
mov dword [esp + 0xc], 0xa6709b
mov eax, dword [esp + 0xc]
push 0x1a
pop esi
div esi
mov dword [esp + 0xc], eax
xor dword [esp + 0xc], 0x666cf
mov eax, dword [esp + 0xc]
sub ebp, dword [ecx + 0x34]
mov dword [esp + 0xc], ebp
mov edx, dword [ecx + eax*8 + 0x78]
mov ebp, dword [ecx + eax*8 + 0x7c]
add edx, ebx
add ebp, edx
mov dword [esp + 0x14], ebp
cmp edx, ebp
jae 0x3278f1
push edi
mov edi, dword [edx + 4]
lea esi, [edx + 8]
add edi, edx
cmp esi, edi
jae 0x3278e9
mov ebp, dword [esp + 0x10]
movzx eax, word [esi]
mov ecx, eax
mov dword [esp + 0x14], 0x3000
and ecx, 0xfff
and eax, 0xf000
add ecx, dword [edx]
add ecx, ebx
cmp ax, word [esp + 0x14]
jne 0x3278de
add dword [ecx], ebp
add esi, 2
cmp esi, edi
jb 0x3278b9
mov ebp, dword [esp + 0x18]
add edx, dword [edx + 4]
cmp edx, ebp
jb 0x3278a9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x329319
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
push dword [esp + 0x3c]
push ebp
push dword [esp + 0x3c]
push edx
push ecx
call fcn.00326dc3
mov eax, dword [ebp + 0x3c]
xor esi, esi
mov dword [esp + 0x3c], 0xd9fc2
add eax, ebp
mov dword [esp + 0x40], esi
add esp, 0x14
mov dword [esp + 0x38], 0x1e8e79
mov edi, esi
or dword [esp + 0x38], 0x8c620c89
xor dword [esp + 0x38], 0x8c7e8ef9
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov ebx, dword [eax + ecx*8 + 0x78]
add ebx, ebp
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
add eax, ebp
mov dword [esp + 0x1c], eax
add ecx, ebp
mov eax, dword [ebx + 0x24]
add eax, ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [ebx + 0x18], esi
jbe 0x32941a
mov eax, dword [ecx + edi*4]
mov ecx, dword [esp + 0x34]
add eax, ebp
mov dword [esp + 0x10], 0xa37fae
shl dword [esp + 0x10], 0xd
xor dword [esp + 0x10], 0x6ff08ee6
mov dword [esp + 0x38], 0x7490db
or dword [esp + 0x38], 0xbbfffefa
xor dword [esp + 0x38], 0xbbf8104b
push dword [esp + 0x38]
mov edx, dword [esp + 0x14]
push eax
call fcn.00337fe1
pop ecx
pop ecx
test eax, eax
je 0x3293f0
mov ecx, dword [esp + 0x14]
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x32939a
jmp 0x32941a
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
movzx eax, word [eax + edi*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, ebx
jb 0x32941a
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + eax*8 + 0x7c]
xor eax, eax
add ecx, ebx
cmp esi, ecx
cmovb esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x32f201
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push dword [esp + 0x38]
push dword [esp + 0x38]
push edx
push ecx
call fcn.00326dc3
mov dword [esp + 0x30], 0xb07bf
lea edi, [esp + 0x34]
xor eax, eax
lea ebp, [ecx + 4]
mov ebx, dword [ebp]
add esp, 0x10
stosd dword es:[edi], eax
add ebp, 4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ecx]
xor ebx, eax
mov dword [esp + 0x14], 0x81dc8e
add dword [esp + 0x14], 0xffffd7f0
xor dword [esp + 0x14], 0x81b47f
mov dword [esp + 0x10], 0xcb9660
mov dword [esp + 0x18], eax
imul eax, dword [esp + 0x10], 0x63
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x4ebb2724
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add ecx, ebx
mov esi, dword [esp + 0x14]
dec eax
add esi, ebx
test eax, ecx
je 0x32f293
mov eax, dword [esp + 0x10]
dec eax
not eax
and esi, eax
add esi, dword [esp + 0x10]
mov dword [esp + 0x10], 0x59bd5a
lea edx, [esi + esi]
xor dword [esp + 0x10], 0xf925609d
imul eax, dword [esp + 0x10], 0x25
push ecx
mov dword [esp + 0x14], eax
shl dword [esp + 0x14], 0xa
xor dword [esp + 0x14], 0x303e246a
mov dword [esp + 0x18], 0x44df6d
shr dword [esp + 0x18], 4
shr dword [esp + 0x18], 9
xor dword [esp + 0x18], 0x13f4c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
call fcn.003232c0
mov edi, eax
mov dword [esp + 0x18], edi
pop ecx
test edi, edi
je 0x32f35c
shr esi, 2
xor eax, eax
lea ecx, [esi*4]
mov esi, edi
add ecx, ebp
mov edx, ecx
sub edx, ebp
add edx, 3
shr edx, 2
cmp ebp, ecx
cmova edx, eax
test edx, edx
je 0x32f356
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [ebp]
lea ebp, [ebp + 4]
xor ecx, edi
movzx eax, cl
mov word [esi], ax
mov eax, ecx
shr eax, 8
lea esi, [esi + 8]
movzx eax, al
mov word [esi - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebx
mov word [esi - 4], ax
movzx eax, cl
mov word [esi - 2], ax
cmp ebx, edx
jb 0x32f318
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x334496
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x98
push ebx
mov ebx, dword [esp + 0xa4]
push ebp
push esi
push edi
push dword [esp + 0xb4]
mov edi, edx
push ebx
push dword [esp + 0xb4]
mov dword [esp + 0x24], edi
push edi
push ecx
call fcn.00326dc3
mov dword [esp + 0x30], 0x5d27c
xor ebp, ebp
mov dword [esp + 0x34], ebp
add esp, 0x14
mov dword [esp + 0x24], ebp
mov esi, ebp
mov dword [esp + 0x10], 0x4b4c7a
shl dword [esp + 0x10], 2
or dword [esp + 0x10], 0x8e590156
imul eax, dword [esp + 0x10], 0x21
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x7f2371bf
mov eax, dword [esp + 0x10]
test edi, eax
je 0x334518
push 0x61
pop eax
mov word [esp + esi*2 + 0x28], ax
inc esi
inc eax
cmp ax, 0x7a
jbe 0x33450b
mov dword [esp + 0x10], 0xa371ac
xor edx, edx
mov eax, dword [esp + 0x10]
push 0x5e
pop ecx
div ecx
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x1bd1d
mov eax, dword [esp + 0x10]
test edi, eax
je 0x33454f
push 0x41
pop eax
mov word [esp + esi*2 + 0x28], ax
inc esi
inc eax
cmp ax, 0x5a
jbe 0x334542
mov dword [esp + 0x10], 0xa719d2
shr dword [esp + 0x10], 0x10
xor dword [esp + 0x10], 0xa3
mov eax, dword [esp + 0x10]
test edi, eax
je 0x33457c
push 0x30
pop eax
mov word [esp + esi*2 + 0x28], ax
inc esi
inc eax
cmp ax, 0x39
jbe 0x33456f
test ebx, ebx
je 0x3345f1
mov edi, dword [esp + 0xb4]
mov dword [esp + 0x14], 0x6f03c8
xor edx, edx
or dword [esp + 0x14], 0xd40a41b0
xor dword [esp + 0x14], 0xd46ac1b0
mov dword [esp + 0x10], 0x3d64a0
mov eax, dword [esp + 0x10]
push 0x28
pop ecx
div ecx
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xffff929f
xor dword [esp + 0x10], 0x26b2625b
xor dword [esp + 0x10], 0x26b4643a
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
call fcn.0033f7c2
xor edx, edx
div esi
mov ax, word [esp + edx*2 + 0x28]
mov word [edi + ebp*2], ax
inc ebp
cmp ebp, ebx
jb 0x334587
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], 0xdd4ae6
shr dword [esp + 0x10], 4
shr dword [esp + 0x10], 2
xor dword [esp + 0x10], 0x37523
mov eax, dword [esp + 0x10]
test edi, eax
je 0x334620
mov eax, dword [esp + 0xb4]
xor ecx, ecx
mov word [eax + ebx*2], cx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret
Function at 0x3346ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
push ebx
push ebp
mov ebp, dword [esp + 0x44]
mov eax, ecx
push esi
push edi
push ebp
push dword [esp + 0x4c]
mov dword [esp + 0x24], eax
push edx
push eax
call fcn.00326dc3
mov eax, dword [ebp + 0x3c]
xor esi, esi
mov dword [esp + 0x44], 0xb4c3d
add eax, ebp
mov dword [esp + 0x48], 0xfa4cc
add esp, 0x10
mov dword [esp + 0x3c], esi
mov ebx, esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x4c], 0xd57ebc
add dword [esp + 0x4c], 0xffff9d75
xor dword [esp + 0x4c], 0xd51c31
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov edi, dword [eax + ecx*8 + 0x78]
add edi, ebp
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebp
mov dword [esp + 0x28], eax
add ecx, ebp
mov eax, dword [edi + 0x24]
add eax, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
cmp dword [edi + 0x18], esi
jbe 0x33484f
mov eax, dword [ecx + ebx*4]
mov dword [esp + 0x4c], 0x4e564f
add eax, ebp
add dword [esp + 0x4c], 0xffff0e9c
add dword [esp + 0x4c], 0xbf39
xor dword [esp + 0x4c], 0x151ee554
xor dword [esp + 0x4c], 0x155f51d9
mov dword [esp + 0x18], 0x4ca640
xor dword [esp + 0x18], 0x33910216
xor dword [esp + 0x18], 0x33d064ee
mov dword [esp + 0x14], 0xbedd0c
shr dword [esp + 0x14], 3
xor dword [esp + 0x14], 0x1938a8
mov dword [esp + 0x10], 0xe28260
or dword [esp + 0x10], 0x6500356a
xor dword [esp + 0x10], 0x65ee114e
push dword [esp + 0x10]
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x54]
push eax
call fcn.00336dbf
xor eax, 0x13513119
add esp, 0xc
cmp eax, dword [esp + 0x1c]
je 0x33481f
mov ecx, dword [esp + 0x20]
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x334779
jmp 0x33484f
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
movzx eax, word [eax + ebx*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, edi
jb 0x33484f
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov eax, dword [eax + ecx*8 + 0x7c]
add eax, edi
cmp esi, eax
jae 0x33484f
mov ecx, esi
call fcn.0033de14
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x33e003
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push dword [esp + 0x24]
mov edi, edx
push edi
push ecx
call fcn.00326dc3
mov eax, dword [edi + 0x3c]
add esp, 0xc
mov dword [esp + 0x18], 0x5c14d
add eax, edi
mov dword [esp + 0x1c], 0x45f3e
mov dword [esp + 0x14], 0x2793c9
or dword [esp + 0x14], 0x3c5f2686
xor dword [esp + 0x14], 0x3c7fb7ce
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx*8 + 0x78]
test edx, edx
je 0x33e16c
cmp dword [eax + ecx*8 + 0x7c], 0
je 0x33e16c
lea esi, [edx + edi]
jmp 0x33e161
mov dword [esp + 0x14], 0x9aa8c2
lea ecx, [eax + edi]
shr dword [esp + 0x14], 1
or dword [esp + 0x14], 0x2a8bfbba
add dword [esp + 0x14], 0xa414
xor dword [esp + 0x14], 0x2ad51638
mov dword [esp + 0x10], 0x21fb33
add dword [esp + 0x10], 0xffffc7af
add dword [esp + 0x10], 0x80e1
add dword [esp + 0x10], 0xffff3e22
xor dword [esp + 0x10], 0x22e10a
push dword [esp + 0x10]
mov edx, dword [esp + 0x18]
call fcn.0033f844
mov edx, eax
mov dword [esp + 0x1c], edx
pop ecx
test edx, edx
je 0x33e177
mov ebx, dword [esi]
mov ebp, dword [esi + 0x10]
add ebx, edi
add ebp, edi
jmp 0x33e158
jns 0x33e0e7
movzx ecx, ax
jmp 0x33e0ec
lea ecx, [edi + 2]
add ecx, eax
mov dword [esp + 0x14], 0x99e24d
add dword [esp + 0x14], 0xffffc65d
add dword [esp + 0x14], 0xffffea4b
imul eax, dword [esp + 0x14], 0x5b
push edx
mov dword [esp + 0x18], eax
xor dword [esp + 0x18], 0x3699dfee
mov dword [esp + 0x14], 0xcec4a2
imul eax, dword [esp + 0x14], 0x2e
mov dword [esp + 0x14], eax
imul eax, dword [esp + 0x14], 0x67
mov dword [esp + 0x14], eax
xor dword [esp + 0x14], 0xf2d7fd6b
push dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
call fcn.00328499
pop ecx
pop ecx
test eax, eax
je 0x33e177
mov edx, dword [esp + 0x18]
add ebx, 4
mov dword [ebp], eax
add ebp, 4
mov eax, dword [ebx]
test eax, eax
jne 0x33e0e0
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x33e06a
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
xor eax, eax
jmp 0x33e16f
Function at 0x33eda4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x341b98]
mov dword [ebp - 8], 0xf78fb
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x33ee07
push esi
push edi
mov esi, dword [ecx + 0x34]
xor edx, edx
mov dword [ebp - 8], 0xd6dc4c
mov eax, dword [ebp - 8]
push 0x46
pop edi
div edi
mov edx, ecx
mov dword [ebp - 8], eax
xor dword [ebp - 8], 0xeba43
mov dword [ebp - 4], 0xdb3571
xor dword [ebp - 4], 0x1323c6ed
xor dword [ebp - 4], 0x13f02dea
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00340621
pop ecx
mov ecx, esi
test esi, esi
jne 0x33edbe
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x11863e28
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5333f50
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x100029c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100029e9
push 0
push 0
push 0
push 0x10002680
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100029e9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100062e3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10006322
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10006322
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10006322
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10006322
cmp dword [ecx + 0x74], 0xe
jbe 0x10006322
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10009050
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100090ed
push ebx
push esi
call fcn.10009019
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10008fad
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000909a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100090ec
push edi
push eax
call fcn.100079d0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100090ba
call fcn.10007b77
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100090eb
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10008fad
add esp, 0x20
test eax, eax
jne 0x100090d9
push edi
call fcn.10007b77
jmp 0x100090e1
push ebx
call fcn.10007b77
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000935a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100109f0
push 0x100109e8
push str.FlsAlloc
push 0x1f
call fcn.10009276
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000938e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f118]
call esi
jmp 0x10009394
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100093d8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010a00
push 0x100109f8
push str.FlsGetValue
push 0x21
call fcn.10009276
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000940f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f118]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10009417
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010a08
push 0x10010a00
push str.FlsSetValue
push 0x22
call fcn.10009276
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009451
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f118]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000e8a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e8cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e8cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10003722
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1000375d
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10003744
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10003755
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1000375f
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1000373a
xor eax, eax
pop edi
pop esi
ret
Function at 0x10003e20
Capabilities:
Inspect section memory permissions

Disassembly:
add al, 0x80
or al, 8
or byte [edx], al
cmp dword [ebp + 0x10], ebx
je 0x10003e2f
add ecx, eax
or byte [ecx], 4

Function at 0x10003e23
Capabilities:
Inspect section memory permissions

Disassembly:
add al, 0x80
or al, 8
or byte [edx], al
cmp dword [ebp + 0x10], ebx
je 0x10003e2f
add ecx, eax
or byte [ecx], 4
Function at 0x4052b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x456664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], edi
mov ecx, 0x208
lea eax, [ebp - 0x20c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4052e2
lea ecx, [ebp - 0x20c]
push 0x44e588
push ecx
call fcn.004313fb
lea edx, [ebp - 0x20c]
push edx
call fcn.004314bb
lea eax, [ebp - 0x20c]
push eax
call fcn.004314bb
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004314bb
lea edx, [ebp - 0x20c]
push edx
call fcn.004314bb
add esp, 0x18
lea eax, [edi + 1]
push eax
push 0x40
call dword [0x446010]
lea ecx, [ebp - 0x20c]
push ecx
mov ebx, eax
call fcn.004314bb
lea edx, [ebp - 0x20c]
push edx
call fcn.004314bb
lea eax, [ebp - 0x20c]
push eax
call fcn.004314bb
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004314bb
lea edx, [ebp - 0x20c]
push edx
mov byte [edi + ebx], 0
call fcn.004314bb
lea eax, [ebp - 0x20c]
push eax
call fcn.004314bb
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004314bb
lea edx, [ebp - 0x20c]
push edx
call fcn.004314bb
add esp, 0x20
xor esi, esi
test edi, edi
je 0x40541a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004314bb
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004314bb
mov edx, dword [ebp - 0x210]
push edx
lea edi, [esi + ebx]
call fcn.00431430
mov ecx, eax
xor edx, edx
mov eax, esi
div ecx
mov eax, dword [ebp - 0x210]
mov cl, byte [edx + eax]
mov edx, dword [ebp - 0x214]
xor cl, byte [edx + edi]
lea eax, [ebp - 0x20c]
push eax
mov byte [edi], cl
call fcn.004314bb
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004314bb
inc esi
add esp, 0x14
cmp esi, dword [ebp - 0x218]
jb 0x4053b3
lea edx, [ebp - 0x20c]
push edx
call fcn.004314bb
lea eax, [ebp - 0x20c]
push eax
call fcn.004314bb
push 0x208
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.00431330
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0042fa56
mov esp, ebp
pop ebp
ret 8
Function at 0x405460
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x4054f8
mov eax, dword [ebx]
push 0x40
push eax
push esi
call fcn.0042fa70
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x405529
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x405529
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x4054f8
mov ecx, dword [ebx]
push edi
push pe_nt_image_headers32
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
call fcn.0042fa70
add esp, 0xc
cmp dword [edi], 0x4550
jne 0x405522
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x405522
movzx eax, word [esi + 0x46]
test ax, ax
je 0x405522
lea edi, [eax + eax*4]
add edi, edi
add edi, edi
add edi, edi
push edi
mov dword [esi + 0x140], edi
call fcn.00431510
add esp, 4
mov dword [esi + 0x138], eax
test eax, eax
jne 0x4054fe
mov eax, 3
pop edi
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
push ebx
lea ecx, [ecx + edx + 0x18]
push edi
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00405b20
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop edi
ret
mov eax, 2
pop edi
ret
mov eax, 2
ret
Function at 0x40cab0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x40cab7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40cb8d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450320]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450320]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450320]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450320]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450320]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450320]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450320]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450320]
add ecx, 8
sub edx, 8
dec esi
jne 0x40cad0
pop edi
test edx, edx
je 0x40cbaa
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x450320]
inc ecx
dec edx
jne 0x40cb91
not eax
pop esi
ret

Function at 0x40cbb0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x450320]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x450320]
mov dword [edx + 8], ecx
ret

Function at 0x40cc00
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x450320]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x450320]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret