joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fa15fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
movzx ebx, byte [edx]
movzx ebp, byte [edi + 1]
mov edi, 2
add ebx, 0x111
add ebp, 0x211
shl ebx, 4
shl ebp, 4
add ebx, eax
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov esi, dword [ebx + 8]
xor ecx, dword [eax + ebp]
mov ebx, dword [ebx + 0xc]
xor edx, dword [eax + ebp + 4]
xor esi, dword [eax + ebp + 8]
mov eax, dword [eax + ebp + 0xc]
xor eax, ebx
mov ebx, dword [esp + 0x18]
movzx ebp, byte [ebx + edi]
mov ebx, edi
shl ebx, 8
lea ebx, [ebp + ebx + 0x111]
mov ebp, dword [esp + 0x14]
shl ebx, 4
xor ecx, dword [ebp + ebx]
xor edx, dword [ebp + ebx + 4]
xor esi, dword [ebp + ebx + 8]
mov ebp, eax
mov eax, dword [esp + 0x14]
xor ebp, dword [eax + ebx + 0xc]
mov eax, dword [esp + 0x18]
lea ebx, [edi + 1]
shl ebx, 8
movzx eax, byte [eax + edi + 1]
lea ebx, [eax + ebx + 0x111]
mov eax, dword [esp + 0x14]
shl ebx, 4
xor ecx, dword [eax + ebx]
xor edx, dword [eax + ebx + 4]
xor esi, dword [eax + ebx + 8]
xor ebp, dword [eax + ebx + 0xc]
lea ebx, [edi + 2]
mov eax, dword [esp + 0x18]
shl ebx, 8
movzx eax, byte [eax + edi + 2]
lea ebx, [eax + ebx + 0x111]
mov eax, dword [esp + 0x14]
shl ebx, 4
xor ecx, dword [eax + ebx]
xor edx, dword [eax + ebx + 4]
xor esi, dword [eax + ebx + 8]
xor ebp, dword [eax + ebx + 0xc]
lea ebx, [edi + 3]
mov eax, dword [esp + 0x18]
shl ebx, 8
movzx eax, byte [eax + edi + 3]
lea ebx, [eax + ebx + 0x111]
mov eax, dword [esp + 0x14]
shl ebx, 4
xor edx, dword [eax + ebx + 4]
xor esi, dword [eax + ebx + 8]
xor ebp, dword [eax + ebx + 0xc]
xor ecx, dword [eax + ebx]
lea ebx, [edi + 4]
mov eax, dword [esp + 0x18]
shl ebx, 8
movzx eax, byte [eax + edi + 4]
lea ebx, [eax + ebx + 0x111]
mov eax, dword [esp + 0x14]
shl ebx, 4
xor ecx, dword [eax + ebx]
xor edx, dword [eax + ebx + 4]
xor esi, dword [eax + ebx + 8]
xor ebp, dword [eax + ebx + 0xc]
lea ebx, [edi + 5]
mov eax, dword [esp + 0x18]
shl ebx, 8
movzx eax, byte [eax + edi + 5]
lea ebx, [eax + ebx + 0x111]
mov eax, dword [esp + 0x14]
shl ebx, 4
xor ecx, dword [eax + ebx]
xor edx, dword [eax + ebx + 4]
xor esi, dword [eax + ebx + 8]
xor ebp, dword [eax + ebx + 0xc]
lea ebx, [edi + 6]
mov eax, dword [esp + 0x18]
shl ebx, 8
movzx eax, byte [eax + edi + 6]
add edi, 7
lea ebx, [eax + ebx + 0x111]
mov eax, dword [esp + 0x14]
shl ebx, 4
xor ebp, dword [eax + ebx + 0xc]
xor ecx, dword [eax + ebx]
xor edx, dword [eax + ebx + 4]
xor esi, dword [eax + ebx + 8]
cmp edi, 0x10
mov eax, ebp
jne 0x6fa15fec
mov ebp, dword [esp + 0x18]
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6fa17060
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6fa170a1
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp + 8], 0xe9
mov dword [esp + 4], str.src_hashes_md5.c
mov dword [esp], 0x6fab1131
call fcn.6fa1c350
lea esi, [esi]
Function at 0x6fa845b0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x3c
test ecx, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x18], eax
je 0x6fa84600
mov esi, dword [edx + 0x10]
cmp dword [esi + 4], 0xcd
je 0x6fa845e8
test byte [esi + 9], 0x10
jne 0x6fa845e8
mov ecx, dword [edx + 0x28]
test ecx, ecx
je 0x6fa84722
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret
mov esi, edx
mov ebp, dword [edx + 0x18]
mov ebx, dword [esi]
mov eax, dword [edx + 0x20]
and ebp, 0x7fff
test ebx, ebx
mov dword [esp + 0x1c], eax
je 0x6fa845e8
mov eax, dword [ebx + 4]
cmp eax, 0x5c
je 0x6fa8468a
ja 0x6fa84712
lea edx, [eax - 7]
cmp edx, 1
jbe 0x6fa845e8
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fa84210
test al, 4
jne 0x6fa845e8
mov edx, eax
and edx, 3
cmp edx, 3
je 0x6fa84735
mov edx, eax
and edx, 0x300
cmp edx, 0x300
je 0x6fa84760
and eax, 0x30000
mov edx, ebx
cmp eax, 0x30000
je 0x6fa84783
mov ebx, dword [edx]
mov esi, edx
test ebx, ebx
je 0x6fa845e8
mov eax, dword [ebx + 4]
cmp eax, 0x5c
jne 0x6fa84620
mov eax, dword [ebx + 0x10]
mov edx, ebx
and eax, 0x7fff
cmp eax, ebp
jne 0x6fa84676
cmp word [ebx + 8], 0
jne 0x6fa845e8
mov edx, dword [esp + 0x1c]
cmp dword [ebx + 0x18], edx
jne 0x6fa845e8
cmp ebx, esi
je 0x6fa847a5
mov eax, dword [ebx]
mov dword [esi], eax
test bl, 1
mov edi, ebx
mov edx, 0x30
jne 0x6fa847c5
test edi, 2
jne 0x6fa847b5
mov ecx, edx
xor eax, eax
shr ecx, 2
test dl, 2
rep stosd dword es:[edi], eax
je 0x6fa846ee
mov word [edi], 0
add edi, 2
and edx, 1
je 0x6fa846f6
mov byte [edi], 0
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x1c]
mov edx, dword [eax + 0x84]
mov dword [ebx], edx
mov edx, esi
mov dword [eax + 0x84], ebx
jmp 0x6fa84676
cmp eax, 0xcd
jne 0x6fa8462e
jmp 0x6fa845e8
cmp dword [esi + 0x28], edx
jne 0x6fa845e8
nop
lea esi, [esi]
jmp 0x6fa84602
mov edx, dword [ebx + 0x10]
and edx, 0x7fff
test al, 8
je 0x6fa84798
cmp edx, ebp
je 0x6fa845e8
mov edx, dword [ebx + 0x14]
and edx, 0x7fff
cmp edx, ebp
jne 0x6fa84650
jmp 0x6fa845e8
mov edx, dword [ebx + 0x18]
and edx, 0x7fff
cmp edx, ebp
je 0x6fa845e8
and eax, 0x30000
mov edx, ebx
cmp eax, 0x30000
jne 0x6fa84676
mov eax, dword [ebx + 0x20]
and eax, 0x7fff
cmp eax, ebp
jne 0x6fa84676
jmp 0x6fa845e8
cmp edx, ebp
jne 0x6fa84650
jmp 0x6fa845e8
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x1c]
mov edx, dword [ebx]
mov dword [eax], edx
jmp 0x6fa846bc
mov word [edi], 0
sub edx, 2
add edi, 2
jmp 0x6fa846d8
mov byte [ebx], 0
lea edi, [ebx + 1]
mov dl, 0x2f
jmp 0x6fa846cc
Function at 0x6fa9e8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov ebp, 0x10
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov eax, dword [ebx + 0x23c]
test eax, eax
jne 0x6fa9ea10
cmp dword [ebx + 0x240], 0xf
ja 0x6fa9ea10
mov eax, dword [ebx + 0x234]
mov dword [esp], eax
call fcn.6fa1c390
test eax, eax
mov ebp, eax
jne 0x6fa9ea10
mov eax, dword [ebx + 0x240]
mov edx, dword [esp + 0x48]
add edx, eax
cmp edx, 0xc
jbe 0x6fa9e8ff
or dword [ebx + 0x238], 1
xor edx, edx
test eax, eax
jne 0x6fa9e979
mov ecx, dword [esp + 0x48]
and ecx, 0xfffffff0
mov dword [esp + 0x18], ecx
je 0x6fa9ea1a
lea eax, [ebx + 0x1f4]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x44], esi
mov ebp, edx
mov edi, eax
nop
lea esi, [esi]
xor eax, eax
mov edx, dword [esi + eax]
xor dword [ebx + eax + 0x1f4], edx
add eax, 4
cmp eax, 0x10
jne 0x6fa9e932
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.6fa15fa0
add dword [ebx + 0x248], 0x80
adc dword [ebx + 0x24c], 0
add ebp, 0x10
add esi, 0x10
cmp ebp, dword [esp + 0x18]
jb 0x6fa9e930
mov esi, dword [esp + 0x44]
mov edx, ebp
mov ebp, dword [esp + 0x1c]
add esi, edx
mov eax, dword [esp + 0x48]
lea ecx, [ebx + 0x1f4]
lea edi, [ebx + 0x204]
mov dword [esp + 0x18], ecx
sub eax, edx
add eax, esi
cmp dword [esp + 0x48], edx
jbe 0x6fa9ea10
mov dword [esp + 0x1c], ebp
mov ebp, eax
jmp 0x6fa9e9a4
cmp ebp, esi
je 0x6fa9ea0c
mov ecx, dword [ebx + 0x240]
add esi, 1
lea edx, [ecx + 1]
mov dword [ebx + 0x240], edx
movzx eax, byte [esi - 1]
cmp edx, 0x10
mov byte [ebx + ecx + 0x224], al
jne 0x6fa9e9a0
mov edx, dword [esp + 0x18]
lea esi, [esi]
movzx eax, byte [edx + 0x30]
xor byte [edx], al
add edx, 1
cmp edi, edx
jne 0x6fa9e9d0
mov eax, dword [esp + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.6fa15fa0
add dword [ebx + 0x248], 0x80
mov dword [ebx + 0x240], 0
adc dword [ebx + 0x24c], 0
cmp ebp, esi
jne 0x6fa9e9a4
mov ebp, dword [esp + 0x1c]
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, eax
jmp 0x6fa9e979
Function at 0x6ffe2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.6ffe21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x6ffe207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6ffe206a
add dl, dl
jne 0x6ffe2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6ffe20dc
xor eax, eax
add dl, dl
jne 0x6ffe2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6ffe217d
add dl, dl
jne 0x6ffe20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6ffe20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6ffe20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6ffe20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x6ffe20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x6ffe2075
mov eax, 1
add dl, dl
jne 0x6ffe20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6ffe20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6ffe20e1
sub eax, ebx
mov ebx, 1
jne 0x6ffe2128
mov ecx, 1
add dl, dl
jne 0x6ffe210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6ffe2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6ffe2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6ffe2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6ffe213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6ffe214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6ffe2136
cmp eax, 0x7d00
jae 0x6ffe216d
cmp eax, 0x500
jb 0x6ffe2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6ffe2075
cmp eax, 0x7f
ja 0x6ffe2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6ffe2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x6ffe219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x6ffe2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x11000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ecx, ecx
mov al, 1
push edi
jmp 0x11010
movzx edx, al
mov byte [edx + 0xafee0], cl
mov dl, al
and dl, 0x80
neg dl
sbb dl, dl
mov bl, al
and dl, 0x1b
add bl, bl
mov byte [ecx + 0xadde0], al
xor dl, bl
inc ecx
xor al, dl
cmp ecx, 0x100
jb 0x11010
mov byte [0xafee1], 0
mov al, 1
xor ecx, ecx
jmp 0x11050
movzx edx, al
mov dword [ecx + 0xaffe0], edx
mov dl, al
and dl, 0x80
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
add ecx, 4
xor al, dl
cmp ecx, 0x28
jb 0x11050
xor edx, edx
test edx, edx
je 0x11089
movzx eax, byte [edx + 0xafee0]
mov ecx, 0xadedf
sub ecx, eax
mov bl, byte [ecx]
jmp 0x1108b
xor bl, bl
mov cl, bl
rol cl, 2
mov al, bl
rol al, 1
xor cl, al
mov al, cl
rol al, 2
xor al, cl
xor al, bl
xor al, 0x63
movzx ecx, al
mov byte [edx + 0xb2108], al
mov byte [ecx + 0xb0008], dl
inc edx
cmp edx, 0x100
jb 0x11073
mov bl, byte [0xafee2]
xor eax, eax
mov cl, byte [eax + 0xb2108]
movzx esi, cl
mov edx, esi
rol edx, 8
mov dword [eax*4 + 0xb0508], edx
mov edx, esi
rol edx, 0x10
mov dword [eax*4 + 0xb0908], edx
mov edx, esi
rol edx, 0x18
mov dword [eax*4 + 0xb0108], esi
mov dword [eax*4 + 0xb0d08], edx
test cl, cl
je 0x1112f
mov dl, byte [esi + 0xafee0]
lea ecx, [ebx + edx]
cmp cl, bl
sbb edi, edi
movzx ecx, cl
neg edi
movzx edi, byte [edi + ecx + 0xadde0]
movzx ecx, byte [0xafee3]
add dl, cl
cmp dl, cl
sbb ecx, ecx
movzx edx, dl
neg ecx
movzx ecx, byte [ecx + edx + 0xadde0]
jmp 0x11133
xor edi, edi
xor ecx, ecx
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, edi
mov edx, ecx
rol edx, 8
mov dword [eax*4 + 0xaf2e0], edx
mov edx, ecx
rol edx, 0x10
mov dword [eax*4 + 0xaeee0], ecx
rol ecx, 0x18
mov dword [eax*4 + 0xaf6e0], edx
mov dl, byte [eax + 0xb0008]
mov dword [eax*4 + 0xafae0], ecx
movzx ecx, dl
mov esi, ecx
rol esi, 8
mov dword [eax*4 + 0xae2e0], esi
mov esi, ecx
rol esi, 0x10
mov dword [eax*4 + 0xae6e0], esi
mov esi, ecx
rol esi, 0x18
mov dword [eax*4 + 0xadee0], ecx
mov dword [eax*4 + 0xaeae0], esi
test dl, dl
je 0x1122c
mov cl, byte [ecx + 0xafee0]
mov dl, cl
add dl, byte [0xafeee]
mov bl, byte [0xafee2]
cmp dl, byte [0xafeee]
movzx edx, dl
sbb esi, esi
neg esi
movzx edx, byte [esi + edx + 0xadde0]
mov dword [ebp - 4], edx
mov dl, cl
add dl, byte [0xafee9]
cmp dl, byte [0xafee9]
movzx edx, dl
sbb esi, esi
neg esi
movzx edi, byte [esi + edx + 0xadde0]
mov dl, cl
add dl, byte [0xafeed]
cmp dl, byte [0xafeed]
movzx edx, dl
sbb esi, esi
neg esi
movzx esi, byte [esi + edx + 0xadde0]
movzx edx, byte [0xafeeb]
add cl, dl
cmp cl, dl
sbb edx, edx
movzx ecx, cl
neg edx
movzx ecx, byte [edx + ecx + 0xadde0]
mov edx, dword [ebp - 4]
jmp 0x11234
xor edx, edx
xor edi, edi
xor esi, esi
xor ecx, ecx
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, edx
mov edx, ecx
rol edx, 8
mov dword [eax*4 + 0xb1508], edx
mov edx, ecx
rol edx, 0x10
mov dword [eax*4 + 0xb1108], ecx
rol ecx, 0x18
mov dword [eax*4 + 0xb1908], edx
mov dword [eax*4 + 0xb1d08], ecx
inc eax
cmp eax, 0x100
jb 0x110c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x14f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov edx, dword [ebp + 8]
push ebx
lea ebx, [ecx + eax]
mov byte [ebp - 1], 0
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
cmp eax, edx
jae 0x15079
push edi
lea edi, [eax + 0x28]
cmp edi, edx
jae 0x15078
cmp ecx, edx
jae 0x15078
cmp ebx, edx
jae 0x15078
mov edx, dword [eax + esi + 0x14]
mov edi, dword [eax + esi + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + esi + 0x20]
mov dword [ebp - 0x10], edi
cmp edx, eax
jb 0x15078
add edi, edi
add edi, edi
lea eax, [edi + edx]
cmp eax, ebx
jae 0x15078
cmp edi, ecx
jae 0x15078
mov eax, dword [ebp - 8]
mov edi, dword [eax + esi + 0x24]
cmp edi, eax
jb 0x15078
mov ecx, dword [ebp - 0x10]
lea ecx, [edi + ecx*2]
cmp ecx, ebx
jae 0x15078
mov ecx, dword [eax + esi + 0x1c]
cmp ecx, eax
jb 0x15078
mov eax, dword [ebp - 0x14]
lea eax, [ecx + eax*4]
cmp eax, ebx
jae 0x15078
lea eax, [edi + esi]
add edx, esi
add ecx, esi
xor edi, edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x10], edi
jbe 0x15078
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + edi*4]
cmp ecx, dword [ebp - 8]
jb 0x1505e
cmp ecx, dword [ebp - 0xc]
jae 0x1505e
mov edx, dword [ebp + 0xc]
add ecx, esi
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x15037
test bl, bl
je 0x15033
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x15037
add ecx, 2
add edx, 2
test bl, bl
jne 0x15017
xor ecx, ecx
jmp 0x1503c
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x1505e
movzx ecx, word [eax + edi*2]
cmp ecx, dword [ebp - 0x14]
jae 0x1505e
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx + ecx*4]
cmp ecx, dword [ebp + 8]
jae 0x1505e
cmp ecx, dword [ebp - 8]
jb 0x1506f
cmp ecx, dword [ebp - 0xc]
jae 0x1506f
inc edi
cmp edi, dword [ebp - 0x10]
jb 0x15002
mov al, byte [ebp - 1]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov byte [ebp - 1], 1
pop edi
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x15090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [eax + 0x3c]
push ebx
add ecx, eax
push esi
mov dword [ebp - 0x18], 0
cmp edx, 1
jne 0x150b1
mov ebx, dword [ecx + 0x78]
mov dword [ebp - 4], ebx
jmp 0x150d2
cmp edx, 2
jne 0x150ca
mov edx, dword [ecx + 0x88]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 0x8c]
mov ebx, dword [ebp - 4]
jmp 0x150d5
mov edx, dword [ecx + 0x78]
mov dword [ebp - 4], edx
mov ebx, edx
mov edx, dword [ecx + 0x7c]
mov esi, dword [ebp + 8]
lea ecx, [edx + ebx]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
cmp ebx, esi
jae 0x15206
push edi
lea edi, [ebx + 0x28]
cmp edi, esi
jae 0x15205
cmp edx, esi
jae 0x15205
cmp ecx, esi
jae 0x15205
mov esi, dword [ebx + eax + 0x14]
mov edx, dword [ebx + eax + 0x18]
mov dword [ebp - 0x14], esi
mov esi, dword [ebx + eax + 0x20]
mov dword [ebp - 0x10], edx
cmp esi, ebx
jb 0x15205
add edx, edx
add edx, edx
lea edi, [edx + esi]
cmp edi, ecx
jae 0x15205
cmp edx, dword [ebp - 8]
jae 0x15205
mov edi, dword [ebx + eax + 0x24]
cmp edi, ebx
jb 0x15205
mov edx, dword [ebp - 0x10]
lea edx, [edi + edx*2]
cmp edx, ecx
jae 0x15205
mov edx, dword [ebx + eax + 0x1c]
cmp edx, ebx
jb 0x15205
mov ebx, dword [ebp - 0x14]
add ebx, ebx
add ebx, ebx
lea ecx, [ebx + edx]
cmp ecx, dword [ebp - 0xc]
jae 0x15205
cmp ebx, dword [ebp - 8]
jae 0x15205
add edi, eax
mov dword [ebp - 0x1c], edi
add esi, eax
add edx, eax
xor edi, edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x10], edi
jbe 0x15205
nop
mov edx, dword [ebp - 8]
mov ecx, dword [edx + edi*4]
mov esi, dword [ebp - 4]
cmp ecx, esi
jb 0x151f0
cmp ecx, dword [ebp - 0xc]
jae 0x151f0
mov edx, dword [ebp + 0xc]
add ecx, eax
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x151c7
test bl, bl
je 0x151c3
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x151c7
add ecx, 2
add edx, 2
test bl, bl
jne 0x151a7
xor ecx, ecx
jmp 0x151cc
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x151f0
mov ecx, dword [ebp - 0x1c]
movzx ecx, word [ecx + edi*2]
cmp ecx, dword [ebp - 0x14]
jae 0x151f0
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + ecx*4]
cmp ecx, dword [ebp + 8]
jae 0x151f0
cmp ecx, esi
jb 0x15202
cmp ecx, dword [ebp - 0xc]
jae 0x15202
inc edi
cmp edi, dword [ebp - 0x10]
jb 0x15190
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x18], ecx
pop edi
mov eax, dword [ebp - 0x18]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x15220
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push edi
push 0x60
lea eax, [ebp - 0x78]
push 0
push eax
call sub.ntoskrnl.exe_memset
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
mov dword [ebp - 0x60], 0xc3d2e1f0
cmp byte [esi], al
je 0x15267
inc eax
cmp byte [eax + esi], 0
jne 0x15260
push esi
lea edi, [ebp - 0x78]
call fcn.00089c90
lea ecx, [ebp - 0x14]
push ecx
mov eax, edi
call fcn.00089d40
mov eax, dword [ebp - 0x14]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x15290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx + edi + 0x78]
mov ecx, dword [ecx + edi + 0x7c]
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
mov byte [ebp - 1], 0
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
cmp edx, esi
jae 0x153e1
lea ebx, [edx + 0x28]
cmp ebx, esi
jae 0x153e1
cmp ecx, esi
jae 0x153e1
cmp eax, esi
jae 0x153e1
mov esi, dword [edx + edi + 0x18]
mov eax, dword [edx + edi + 0x14]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], esi
jne 0x153e1
mov eax, dword [edx + edi + 0x20]
cmp eax, edx
jb 0x153e1
lea ebx, [eax + esi*4]
mov eax, dword [ebp - 8]
cmp ebx, eax
jae 0x153e1
lea ebx, [esi*4]
cmp ebx, ecx
jae 0x153e1
mov ebx, dword [edx + edi + 0x24]
cmp ebx, edx
jb 0x153e1
lea ecx, [ebx + esi*2]
cmp ecx, eax
jae 0x153e1
mov esi, dword [edx + edi + 0x1c]
cmp esi, edx
jb 0x153e1
mov ecx, dword [ebp - 0xc]
add ecx, ecx
add ecx, ecx
mov dword [ebp + 0x10], ecx
add ecx, esi
cmp ecx, eax
jae 0x153e1
mov eax, dword [ebp - 0x14]
cmp dword [ebp + 0x10], eax
jae 0x153e1
mov eax, dword [edx + edi + 0x20]
add eax, edi
mov dword [ebp - 0x14], eax
xor eax, eax
add ebx, edi
add esi, edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp + 0x10], eax
cmp dword [ebp - 0x10], eax
jbe 0x153dd
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov byte [ebx], 0
mov ecx, dword [ecx + eax*4]
mov dword [ebp + 0xc], ecx
cmp ecx, edx
jb 0x153d1
cmp ecx, dword [ebp - 8]
jae 0x153d1
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx + eax*2]
cmp ecx, dword [ebp - 0xc]
jae 0x153d1
mov esi, dword [ebp - 0x1c]
mov ecx, dword [esi + ecx*4]
mov dword [ebp - 0x20], ecx
cmp ecx, dword [ebp + 8]
jae 0x153d1
cmp ecx, edx
jb 0x153b4
cmp ecx, dword [ebp - 8]
jb 0x153d1
mov esi, dword [ebp + 0xc]
lea esi, [esi + edi]
call fcn.00015220
mov edx, dword [ebp - 0x24]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
mov byte [ebx], 1
inc eax
add ebx, 0xc
mov dword [ebp + 0x10], eax
cmp eax, dword [ebp - 0x10]
jb 0x1537c
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x153f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [edx + 0x3c]
add ecx, edx
movzx edx, word [ecx + 0x14]
push esi
xor eax, eax
lea esi, [edx + ecx + 0x18]
mov dword [ebp - 4], esi
cmp ebx, dword [ebp + 8]
jae 0x1544b
push edi
movzx edi, word [ecx + 6]
xor edx, edx
test edi, edi
je 0x1544a
lea ecx, [esi + 0xc]
lea ebx, [ebx]
mov esi, dword [ecx]
cmp ebx, esi
jb 0x1542f
mov eax, dword [ecx - 4]
add eax, esi
cmp ebx, eax
jb 0x15441
inc edx
add ecx, 0x28
cmp edx, edi
jb 0x15420
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [edx + edx*4]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx*8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x15460
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [edx + 0x3c]
add ecx, edx
movzx edx, word [ecx + 0x14]
lea edx, [edx + ecx + 0x18]
movzx ecx, word [ecx + 6]
push ebx
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x154dc
push esi
mov dword [ebp - 4], edx
push edi
jmp 0x15490
mov esi, dword [ebp + 0xc]
mov edi, edx
mov cl, byte [esi]
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x154a1
sub cl, 0x20
mov dl, cl
mov cl, byte [edi]
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x154af
sub cl, 0x20
cmp dl, cl
jg 0x154bd
jl 0x154bd
test dl, dl
je 0x154e3
inc esi
inc edi
jmp 0x15495
movsx eax, cl
movsx ecx, dl
sub ecx, eax
test ecx, ecx
je 0x154e3
mov edx, dword [ebp - 4]
inc ebx
add edx, 0x28
mov dword [ebp - 4], edx
cmp ebx, dword [ebp - 8]
jb 0x15490
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0xc]
lea ecx, [ebx + ebx*4]
mov ecx, dword [edx + ecx*8 + 0xc]
cmp ecx, dword [ebp + 8]
jae 0x154d8
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x15500
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [edx + 0x3c]
add ecx, edx
movzx edx, word [ecx + 0x14]
lea edx, [edx + ecx + 0x18]
movzx ecx, word [ecx + 6]
push ebx
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1557c
push esi
mov dword [ebp - 4], edx
push edi
jmp 0x15530
mov esi, dword [ebp + 0xc]
mov edi, edx
mov cl, byte [esi]
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x15541
sub cl, 0x20
mov dl, cl
mov cl, byte [edi]
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x1554f
sub cl, 0x20
cmp dl, cl
jg 0x1555d
jl 0x1555d
test dl, dl
je 0x15583
inc esi
inc edi
jmp 0x15535
movsx eax, cl
movsx ecx, dl
sub ecx, eax
test ecx, ecx
je 0x15583
mov edx, dword [ebp - 4]
inc ebx
add edx, 0x28
mov dword [ebp - 4], edx
cmp ebx, dword [ebp - 8]
jb 0x15530
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
lea ecx, [ebx + ebx*4]
lea ecx, [edx + ecx*8]
mov edx, dword [ecx + 8]
cmp edx, eax
jae 0x15578
mov ecx, dword [ecx + 0xc]
cmp ecx, eax
jae 0x15578
add ecx, edx
cmp ecx, eax
jae 0x15578
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 8