joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10140940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x14], edx
push edi
mov eax, dword [esi + 0x298]
test eax, eax
je 0x101409a3
cmp eax, 1
jne 0x10140975
mov edx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
jmp fcn.10141fa0
dec eax
mov dword [esi + 0x298], eax
cmp eax, 1
jne 0x101409a3
mov edx, dword [esp + 0x114]
call fcn.10141fa0
mov edx, str.no_space_in_chunk_cache
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
jmp fcn.10131320
mov eax, dword [esi + 0x74]
test al, 1
je 0x10140b48
test al, 4
je 0x101409b8
or eax, 8
mov dword [esi + 0x74], eax
mov ebx, dword [esp + 0x114]
mov edx, ebx
push 2
call fcn.1013da30
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x101409f3
mov edx, ebx
mov ecx, esi
call fcn.10141fa0
test dword [esi + 0x78], 0x100000
mov ecx, esi
je 0x10140b52
push str.out_of_memory
jmp 0x10140b1a
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x10140b3c
push ebx
push ebp
push esi
call eax
add esp, 0xc
mov edx, ebp
mov ecx, esi
push ebx
call fcn.10130ba0
add esp, 4
xor edx, edx
mov ecx, esi
call fcn.10141fa0
test eax, eax
jne 0x10140afe
xor edi, edi
test ebx, ebx
je 0x10140b09
nop
cmp byte [edi + ebp], 0
je 0x10140a3b
inc edi
cmp edi, ebx
jb 0x10140a30
cmp edi, 0x4f
ja 0x10140b09
cmp edi, 1
jb 0x10140b09
lea eax, [edi + 3]
cmp eax, ebx
jbe 0x10140a5e
mov edx, str.truncated
jmp 0x10140b0e
cmp byte [edi + ebp + 1], 0
je 0x10140a6f
mov edx, str.unknown_compression_type
jmp 0x10140b0e
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xffffffff
push eax
lea eax, [edi + 2]
mov edx, ebx
push eax
mov ecx, esi
call fcn.1013d5b0
add esp, 0xc
cmp eax, 1
jne 0x10140af4
mov ecx, dword [esi + 0x2b8]
mov edx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edx
lea eax, [edx + edi]
mov dword [esp + 0x20], 0
mov edx, dword [esp + 0x1c]
mov byte [eax + ecx + 2], 0
lea eax, [ecx + 2]
add eax, edi
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], eax
mov ecx, esi
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 0
push eax
mov dword [esp + 0x3c], 0
call fcn.101324d0
add esp, 8
test eax, eax
je 0x10140afe
mov edx, str.insufficient_memory
jmp 0x10140b0e
mov edx, dword [esi + 0x9c]
test edx, edx
jne 0x10140b0e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
mov edx, str.bad_keyword
test dword [esi + 0x78], 0x100000
mov ecx, esi
je 0x10140b4d
push edx
lea edx, [esp + 0x3c]
call fcn.101313c0
add esp, 4
lea edx, [esp + 0x38]
mov ecx, esi
call fcn.10131830
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
mov edx, str.Call_to_NULL_read_function
mov ecx, esi
call fcn.101318d0
mov edx, str.missing_IHDR
call fcn.10131390
mov edx, str.out_of_memory
call fcn.10131390
int3
Function at 0x10149a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
sub edx, 1
je 0x10149bca
sub edx, 3
je 0x10149aa0
sub edx, 6
jne 0x10149bde
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
test ebx, ebx
je 0x10149bde
nop
mov ecx, dword [edi + 0x60]
mov eax, 0x40
and ecx, 0x3f
mov esi, ebx
sub eax, ecx
cmp eax, ebx
cmovbe esi, eax
lea eax, [ecx + edi]
push esi
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [esp + 0x18]
add esp, 0xc
add edx, esi
sub ebx, esi
add dword [edi + 0x60], esi
mov ecx, dword [edi + 0x60]
adc dword [edi + 0x64], 0
and ecx, 0x3f
or ecx, 0
mov eax, dword [edi + 0x64]
mov dword [esp + 0xc], edx
mov dword [esp + 0x1c], eax
jne 0x10149a95
lea ecx, [edi + 0x40]
mov edx, edi
call fcn.101528c0
mov edx, dword [esp + 0xc]
test ebx, ebx
jne 0x10149a40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x40]
mov esi, dword [edi + 0x44]
not eax
mov ebx, dword [ebp + 8]
not esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
cmp ecx, 4
jbe 0x10149b86
test bl, 3
je 0x10149afc
mov edi, ecx
movzx ecx, byte [ebx]
dec edi
movzx edx, al
inc ebx
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x1018ed20]
xor esi, dword [edx*8 + 0x1018ed24]
test bl, 3
jne 0x10149ac8
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ebx
mov edx, ecx
and ecx, 3
and edx, 0xfffffffc
mov dword [esp + 0xc], ecx
add edx, ebx
mov dword [esp + 0x18], edx
cmp ebx, edx
jae 0x10149b86
mov edi, edx
mov ebx, dword [ebx]
xor ebx, eax
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*8 + 0x1018f520]
mov edx, dword [edx*8 + 0x1018f524]
xor eax, dword [ecx*8 + 0x1018fd20]
xor edx, dword [ecx*8 + 0x1018fd24]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*8 + 0x1018ed20]
xor edx, dword [ecx*8 + 0x1018ed24]
movzx ecx, bl
mov ebx, dword [esp + 0x10]
add ebx, 4
mov dword [esp + 0x10], ebx
xor eax, dword [ecx*8 + 0x10190520]
xor edx, dword [ecx*8 + 0x10190524]
xor eax, esi
xor edx, 0
mov esi, edx
cmp ebx, edi
jb 0x10149b14
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x10149bb9
mov edi, dword [esp + 0xc]
nop
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x1018ed20]
xor esi, dword [edx*8 + 0x1018ed24]
sub edi, 1
jne 0x10149b90
mov edi, dword [esp + 0x14]
not eax
not esi
mov dword [edi + 0x44], esi
mov dword [edi + 0x40], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0x40]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.10153b70
add esp, 4
mov dword [edi + 0x40], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10153b70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, edx
mov ebx, ecx
not eax
cmp esi, 8
jbe 0x10153c47
test bl, 7
je 0x10153ba9
nop word [eax + eax]
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1018cd20]
test bl, 7
jne 0x10153b90
push edi
mov edi, esi
and esi, 7
and edi, 0xfffffff8
add edi, ebx
cmp ebx, edi
jae 0x10153c46
nop dword [eax]
xor eax, dword [ebx]
add ebx, 4
mov dword [esp + 0x10], ebx
add dword [esp + 0x10], 4
mov ebx, dword [ebx]
mov ecx, ebx
shr ecx, 0x10
movzx edx, cl
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x1018d120]
xor edx, dword [ecx*4 + 0x1018d520]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
xor edx, dword [ecx*4 + 0x1018e120]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x1018e520]
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x1018cd20]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x1018dd20]
movzx ecx, bl
mov ebx, dword [esp + 0x10]
xor edx, dword [ecx*4 + 0x1018d920]
xor edx, dword [eax*4 + 0x1018e920]
mov eax, edx
cmp ebx, edi
jb 0x10153bc0
pop edi
test esi, esi
je 0x10153c6a
nop dword [eax + eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1018cd20]
sub esi, 1
jne 0x10153c50
pop esi
not eax
pop ebx
ret
Function at 0x10155120
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x18], edx
push ebx
mov ebx, ecx
push edi
mov dword [ebx], 0x4000400
test edx, edx
je 0x10155161
lea eax, [ebx + 0x104]
mov ecx, edx
nop dword [eax]
movaps xmm0, xmmword [0x101a5140]
lea eax, [eax + 0x10]
movups xmmword [eax - 0x110], xmm0
movaps xmm0, xmmword [0x101a5140]
movups xmmword [eax - 0x10], xmm0
sub ecx, 1
jne 0x10155140
cmp byte [esp + 0x28], 0
lea edi, [ebx + 0x204]
mov ecx, 0x80
mov eax, 0x4000400
rep stosd dword es:[edi], eax
jne 0x1015531c
push ebp
xor ebp, ebp
mov dword [esp + 0x10], ebp
test edx, edx
je 0x1015531b
lea eax, [ebx + 0x404]
mov dword [esp + 0x2c], eax
lea eax, [ebx + 0x4808]
mov dword [esp + 0x14], eax
push esi
mov edi, dword [ebx + 0x4804]
xor esi, esi
mov dword [eax], edi
movzx ecx, word [ebx]
mov eax, ecx
mov dword [esp + 0x10], edi
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x10192d20]
movzx edx, byte [ecx + 0x10192d20]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x1c], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x10192d20]
add eax, edx
mov dword [esp + 0x20], eax
movzx eax, byte [ecx + 0x10192d20]
add eax, edx
mov dword [esp + 0x24], eax
test edi, edi
je 0x101552f8
cmp esi, 8
jae 0x10155254
xor edi, edi
lea edx, [esi + 8]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp*8]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x10192d20]
add edi, eax
cmp edx, 1
jne 0x10155211
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x10155207
jmp 0x101552f8
cmp esi, 0x10
jae 0x101552a3
xor edi, edi
mov edx, esi
nop dword [eax]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp*8]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x10192d20]
add edi, eax
cmp edx, 1
jne 0x10155260
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x10155254
jmp 0x101552f8
mov ebp, dword [esp + 0x10]
nop word [eax + eax]
xor edi, edi
lea eax, [esi + 0xf0]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x10192d20]
add edi, ecx
cmp eax, 1
jne 0x101552b8
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, ebp
jb 0x101552b0
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ebp
add dword [esp + 0x30], 0x440
add eax, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], eax
cmp ebp, dword [esp + 0x28]
jb 0x101551a2
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x1c
ret
Function at 0x10159ab0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor edx, edx
mov dword [esp + 0x10], edx
lea esi, [edi + 0x105a4]
lea ebp, [edi + 0x101a0]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebp
mov eax, dword [edi + 0x10da0]
xor ebx, ebx
test eax, eax
je 0x10159b38
nop
mov ebp, dword [esp + 0x10]
lea eax, [ebx + 0x40]
xor esi, esi
nop dword [eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
lea ecx, [eax + ebp]
and edx, 0x7f
movzx ecx, word [edi + ecx*2 + 0x6e0c]
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x10192d20]
add esi, ecx
cmp eax, 1
jne 0x10159af0
mov ebp, dword [esp + 0x14]
mov dword [ebp + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x10da0]
cmp ebx, eax
jb 0x10159ae0
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov ecx, 0xe
cmp eax, ecx
jbe 0x10159b58
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [ebp + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x10da0]
jb 0x10159b41
mov eax, dword [ebp]
add edx, 0x40
mov dword [esi - 4], eax
mov eax, dword [ebp + 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
add ebp, 0x100
mov dword [esi + 8], eax
add esi, 0x200
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
cmp edx, 0x100
jb 0x10159ad3
mov esi, 4
lea eax, [edi + 0x107b0]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
nop dword [eax]
movzx ebx, byte [esi + 0x10190d20]
mov eax, esi
mov ebp, ebx
mov edx, ebx
shr ebp, 1
and edx, 1
dec ebp
or edx, 2
mov ecx, ebp
shl edx, cl
mov ecx, 1
sub eax, edx
mov dword [esp + 0x1c], edx
xor esi, esi
mov dword [esp + 0x18], ecx
nop dword [eax + eax]
mov edx, eax
sub ecx, ebx
add ecx, dword [esp + 0x1c]
and edx, 1
shr eax, 1
mov dword [esp + 0x20], eax
mov eax, edx
neg eax
movzx ecx, word [edi + ecx*2 + 0x700a]
shr eax, 4
shr ecx, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x10192d20]
mov ecx, dword [esp + 0x18]
add esi, eax
mov eax, dword [esp + 0x20]
lea ecx, [edx + ecx*2]
mov dword [esp + 0x18], ecx
sub ebp, 1
jne 0x10159be0
mov edx, dword [esp + 0x10]
mov eax, dword [edi + ebx*4 + 0x101a0]
add eax, esi
mov dword [edx - 0x200], eax
mov eax, dword [edi + ebx*4 + 0x102a0]
add eax, esi
mov dword [edx], eax
mov eax, dword [edi + ebx*4 + 0x103a0]
add eax, esi
mov dword [edx + 0x200], eax
mov eax, dword [edi + ebx*4 + 0x104a0]
add eax, esi
mov esi, dword [esp + 0x14]
inc esi
mov dword [edx + 0x400], eax
add edx, 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
cmp esi, 0x80
jb 0x10159bb0
mov dword [edi + 0x10da4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10159e80
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 8
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 0xaa8]
push edi
mov edi, dword [ebx + 0xaa4]
and eax, edx
sub ecx, edi
shr esi, cl
mov ecx, edi
shl eax, cl
add esi, eax
imul ebp, esi, 0x600
add ebp, ebx
xor ebx, ebx
cmp byte [esp + 0x18], bl
jne 0x10159ed1
push dword [esp + 0x20]
lea edx, [ebx + 8]
lea ecx, [ebp + 0xaac]
call fcn.1015a070
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x20]
mov esi, 0x100
mov edi, dword [esp + 0x1c]
add ecx, esi
add edi, edi
mov edx, esi
and edx, edi
mov eax, ecx
shr eax, 8
add edx, esi
add eax, edx
movzx edx, word [ebp + eax*2 + 0xaac]
mov eax, ecx
shr eax, 7
add ecx, ecx
and eax, 1
shr edx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor edx, eax
movzx eax, byte [edx + 0x10192d20]
mov edx, edi
xor edx, ecx
add ebx, eax
not edx
and esi, edx
cmp ecx, 0x10000
jb 0x10159ee0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x1015a070
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
mov eax, 1
mov ecx, edx
mov edx, dword [esp + 8]
push esi
push edi
shl eax, cl
xor edi, edi
add edx, eax
mov esi, edx
shr edx, 1
and esi, 1
neg esi
shr esi, 4
movzx ecx, word [ebx + edx*2]
and esi, 0x7f
shr ecx, 4
xor ecx, esi
movzx ecx, byte [ecx + 0x10192d20]
add edi, ecx
cmp edx, 1
jne 0x1015a086
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x101629e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10170717
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
lock inc dword [0x10761c4c]
mov dword [edi + 4], edi
mov dword [edi + 8], 0
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x34]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [edi + 0x24], eax
mov ax, word [ebp + 0x28]
push ebx
push dword [ebp + 0x30]
mov word [edi + 0x28], ax
mov eax, dword [ebp + 0x34]
push dword [ebp + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp + 0x3c]
mov dword [edi], 0x101a4980
mov dword [edi + 0xc], 0x101a4964
mov dword [edi + 0x30], eax
call fcn.10162c30
lea esi, [edi + 0x48]
mov dword [esi], 0
movsd xmm0, qword [ebp + 0x18]
mov byte [ebp - 4], 2
mulsd xmm0, qword [0x101a4df0]
mov dword [edi + 0x4c], 0x80004004
call fcn.1016c5bb
mov dword [edi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [edi + 0x1c], edx
lea edx, [ebp - 0x10]
push edx
push dword [edi + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x10162b92
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [esi], 0
jne 0x10162b5d
mov esi, dword [0x10761c48]
test esi, esi
jne 0x10162af1
push str.OleAut32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [0x10761c48], esi
test esi, esi
jne 0x10162af1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
or esi, 0x80070000
mov dword [ebx], esi
jmp 0x10162b94
push str.LoadRegTypeLib
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10162adc
lea ecx, [ebp + 0x14]
push ecx
push 0
push 0
push 1
push 0x101747dc
call eax
test eax, eax
jns 0x10162b37
push str.LoadTypeLib
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10162adc
lea ecx, [ebp + 0x14]
push ecx
push str.control.tlb
call eax
mov esi, eax
test esi, esi
js 0x10162b56
mov eax, dword [ebp + 0x14]
lea edx, [edi + 0x48]
push edx
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
jns 0x10162b5a
mov dword [ebx], esi
jmp 0x10162b94
lea esi, [edi + 0x48]
mov esi, dword [esi]
push esi
mov eax, dword [esi]
call dword [eax + 4]
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp word [ebp + 0x28], 4
jne 0x10162b85
lea eax, [edi + 0x44]
mov dword [edi + 0x40], 1
mov dword [eax], 0xfffffffd
mov dword [edi + 0x38], eax
mov ecx, dword [ebp + 8]
push edi
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jns 0x10162b94
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x38
Function at 0x10168550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x1016871d
cmp dword [esi + 0x20], 0
je 0x1016871d
cmp dword [esi + 0x24], 0
je 0x1016871d
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x1016871d
cmp dword [ecx], esi
jne 0x1016871d
mov eax, dword [ecx + 4]
cmp eax, 0x2a
je 0x101685b3
cmp eax, 0x39
je 0x101685b3
cmp eax, 0x45
je 0x101685b3
cmp eax, 0x49
je 0x101685b3
cmp eax, 0x5b
je 0x101685b3
cmp eax, 0x67
je 0x101685b3
cmp eax, 0x71
je 0x101685b3
cmp eax, 0x29a
jne 0x1016871d
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 8]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], eax
test edx, edx
jns 0x101685e8
neg edx
mov dword [ecx + 0x18], edx
cmp edx, 2
jne 0x101685f8
mov dword [ecx + 4], 0x39
xor eax, eax
jmp 0x10168611
push edi
mov edi, 0x2a
test edx, edx
mov eax, 0x71
cmovne eax, edi
mov dword [ecx + 4], eax
mov eax, 1
pop edi
mov dword [esi + 0x30], eax
lea eax, [ecx + 0x94]
mov dword [ecx + 0xb18], eax
lea eax, [ecx + 0x988]
mov dword [ecx + 0xb24], eax
lea eax, [ecx + 0xa7c]
mov dword [ecx + 0xb30], eax
xor eax, eax
mov dword [ecx + 0x28], 0
mov dword [ecx + 0xb20], 0x101956f8
mov dword [ecx + 0xb2c], 0x10195be8
mov dword [ecx + 0xb38], 0x10195bd4
mov word [ecx + 0x16b8], ax
mov dword [ecx + 0x16bc], eax
call fcn.1016bc60
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x1019365a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x10193658]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x1019365c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x1019365e]
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x405980
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
call dword [sym.imp.MSVCRT.dll_rand]
test al, 3
jne 0x405a00
mov eax, dword [esp + 8]
push 0x40870c
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x405a00
push ebx
push esi
push edi
mov ecx, 0x40d
mov esi, 0x408820
mov edi, 0x42e058
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x54321cba
mov bl, byte [eax + 0x42e058]
mov edx, ecx
sar edx, 0x17
xor bl, dl
add ecx, 0x1234567f
mov byte [eax + 0x42e058], bl
inc eax
cmp eax, 0x1034
jb 0x4059bf
push ebp
push 0x1034
push 1
push 0x42e058
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408e84
nop
nop
mov ecx, 0x30b6865
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x581f1499
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4012a37d
Capabilities:
Encode data using xor

Disassembly:
call 0x4012a2f6
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x4012a326
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x4012a342
xor edx, 0
jmp 0x4012a34d
xor edx, edx
jmp 0x4012a364
jmp 0x4012a370
xor eax, eax
push 0x8427d7c0
call 0x4012a37d
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x4012a3b9
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x4012a392
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x4012a3d0
add eax, 0
jno 0x4012a3d5
add esi, 0
ret 0x10

Function at 0x4012b13e
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x4012b160
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x4012b302
cmp edi, dword [ebp + 0x10]
jb 0x4012b302
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.4012ac2a
inc edi
jmp 0x4012b1e9
jmp 0x4012b1f6
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.4012ac2a
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.4012ac2a
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x4012b24a
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x4012b22e
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.4012b278
add dword [eax], 0x39
jle 0x4012b254
sub al, 0xf5
mov ch, al
call fcn.4012b28d
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10