joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x519868
sub esp, 0x70
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx + 4]
lea edi, [esp + 0x40]
xor eax, eax
call fcn.0045e494
lea ecx, [0x5a6f20]
mov dword [esp], ecx
mov dword [esp + 4], edx
lea edx, [esp + 0x40]
mov dword [esp + 8], edx
call fcn.0040d680
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x5196c5
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.0040d8f0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x40]
test ebx, ebx
je 0x51980b
mov dword [esp + 0x28], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x24], eax
mov eax, dword [ebx]
mov dword [esp + 0x38], eax
mov ecx, dword [ebx + 4]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x74]
mov ebx, dword [edx + 4]
lea ebp, [0x5a6f20]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
call fcn.0040f520
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
lea eax, [0x5cfd35]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
call fcn.004c4200
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
lea edx, [0x5cfd15]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call fcn.00448720
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ebx, [edx + 1]
mov ebp, dword [esp + 0x28]
cmp ebp, ebx
jb 0x5197c4
mov esi, dword [esp + 0x34]
mov dword [esp + 0x34], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebp
lea ebx, [esi + edx*8 + 4]
mov dword [ebx], ecx
mov ecx, dword [0x71e9f0]
lea edx, [esi + edx*8]
test ecx, ecx
jne 0x5197b8
mov dword [edx], eax
jmp 0x5196ad
mov edi, edx
call fcn.0045e220
jmp 0x5196ad
mov dword [esp + 0x30], ecx
mov dword [esp + 0x3c], eax
lea eax, [0x5a5ba0]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
call fcn.00445360
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
lea ebx, [eax + 1]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
jmp 0x519792
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
lea eax, [0x5cfd16]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
call fcn.004c4200
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00448990
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], edx
add esp, 0x70
ret
call fcn.0045ccc0
jmp fcn.00519660
Function at 0x51c550
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51c5da
lea edi, [esp + 8]
xor eax, eax
call fcn.0045e48d
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
and edx, 0x3ffffff
mov dword [esp + 0x1c], edx
mov edx, dword [ecx + 3]
shr edx, 2
and edx, 0x3ffff03
mov dword [esp + 0x20], edx
mov edx, dword [ecx + 6]
shr edx, 4
and edx, 0x3ffc0ff
mov dword [esp + 0x24], edx
mov edx, dword [ecx + 9]
shr edx, 6
and edx, 0x3f03fff
mov dword [esp + 0x28], edx
mov edx, dword [ecx + 0xc]
shr edx, 8
and edx, 0xfffff
mov dword [esp + 0x2c], edx
mov edx, dword [ecx + 0x10]
mov dword [esp + 0x30], edx
mov edx, dword [ecx + 0x14]
mov dword [esp + 0x34], edx
mov edx, dword [ecx + 0x18]
mov dword [esp + 0x38], edx
mov ecx, dword [ecx + 0x1c]
mov dword [esp + 0x3c], ecx
ret
call fcn.0045ccc0
jmp fcn.0051c550
Function at 0x51f230
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51f44d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x51f2e7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x51f360
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x51f2c8
cmp ecx, 0xf
jne 0x51f3d9
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x51f2c8
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x51f2c8
call fcn.0045ccc0
jmp fcn.0051f230
Function at 0x523ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x5240ea
sub esp, 0x84
mov byte [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
lea eax, [esp + 0x74]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
call fcn.004d9750
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
mov byte [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov byte [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x88]
mov ebx, dword [esp + 0x94]
xor ebp, ebp
lea esi, [esp + 0x44]
lea edi, [esp + 0x54]
lea ebp, [esp + 0x64]
mov dword [esp + 0x3c], ebp
xor ebp, ebp
jmp 0x524095
mov ebp, dword [esp + 0x2c]
inc ebp
shl ebx, 1
mov dword [esp + 0x2c], ebp
mov esi, edx
mov edi, ecx
mov dword [esp + 0x3c], eax
mov eax, ebx
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x88]
mov ebx, dword [esp + 0x94]
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
cmp ebx, 8
jge 0x524085
mov byte [esp + 0x2b], al
mov dword [esp], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.005236a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
movzx ebx, byte [esp + 0x2b]
test bl, 0x80
je 0x523fc9
mov ebx, dword [esp + 0x88]
mov dword [esp], ebx
mov ebp, dword [esp + 0x8c]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x90]
mov dword [esp + 8], esi
mov edi, dword [esp + 0x40]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
call fcn.00522090
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x2b]
jmp 0x523fc9
inc ebp
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
cmp ecx, ebp
jle 0x5240b5
mov dword [esp + 0x30], ebp
movzx eax, byte [ebx + ebp]
mov byte [esp + 0x34], al
xor eax, eax
mov dword [esp + 0x2c], eax
movzx eax, byte [esp + 0x34]
jmp 0x523ff7
mov dword [esp], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.00521e00
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ecx
add esp, 0x84
ret
call fcn.0045ccc0
jmp fcn.00523ee0
Function at 0x52d2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52d511
sub esp, 0x28
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x52d4e0
cmp ecx, 1
jne 0x52d48a
xor eax, eax
xor edx, edx
test eax, eax
jne 0x52d46e
cmp ecx, 8
jg 0x52d432
mov dword [esp + 0x24], edx
mov ebx, dword [esp + 0x2c]
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x52d343
lea edi, [ebp + 1]
mov edx, dword [esp + 0x20]
shl edx, 8
movzx ebp, byte [ebx + ebp]
or ebp, edx
mov edx, dword [esp + 0x24]
mov edx, ebp
mov ebp, edi
mov edi, esi
mov esi, edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x20], esi
cmp ecx, ebp
jle 0x52d35c
shl edi, 8
shr esi, 0x18
or esi, edi
cmp ecx, ebp
ja 0x52d323
jmp 0x52d509
mov dword [esp + 0x10], eax
shl ecx, 3
lea ebx, [ecx - 0x20]
mov byte [esp + 0xf], bl
cmp bl, 0x20
sbb ebp, ebp
mov dword [esp + 0x1c], ebp
neg ebx
mov byte [esp + 0xe], bl
cmp bl, 0x20
sbb edx, edx
mov dword [esp + 0x18], edx
lea eax, [ecx - 0x40]
neg eax
mov byte [esp + 0xd], al
cmp al, 0x20
sbb edx, edx
cmp bl, 0x20
sbb ebx, ebx
shr al, 5
movzx eax, al
cmp eax, 1
sbb eax, eax
mov dword [esp + 0x14], eax
movzx ecx, byte [esp + 0xf]
shr esi, cl
and esi, ebp
movzx ecx, byte [esp + 0xd]
shl edi, cl
and edi, edx
or esi, edi
mov edi, ecx
movzx ecx, byte [esp + 0xe]
mov ebp, dword [esp + 0x20]
shl ebp, cl
mov eax, dword [esp + 0x18]
and ebp, eax
or esi, ebp
mov eax, ecx
mov ecx, edi
mov ebp, dword [esp + 0x20]
shl ebp, cl
and ebp, edx
not ebx
or ebx, eax
shr ebp, cl
mov ecx, ebx
mov eax, esi
sar esi, cl
mov ebx, dword [esp + 0x14]
xor ebx, 0xffffffff
and ebx, esi
movzx ecx, byte [esp + 0xf]
mov esi, eax
shl eax, cl
mov ecx, esi
mov esi, dword [esp + 0x1c]
and eax, esi
and ebp, edx
or ebp, eax
or ebx, ebp
mov dword [esp + 0x38], ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb eax, eax
not eax
or edi, eax
mov eax, ecx
mov ecx, edi
sar eax, cl
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], eax
add esp, 0x28
ret
lea eax, [0x5d310a]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00409170
mov eax, dword [esp + 8]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
lea ecx, [0x610c20]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
add esp, 0x28
ret
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
add esp, 0x28
ret
mov edx, dword [esp + 0x2c]
movzx ebx, byte [edx]
test bl, bl
jne 0x52d4a0
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x52d4b7
cmp bl, 0xff
jne 0x52d4ae
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x52d4b7
xor eax, eax
xor edx, edx
jmp 0x52d302
lea eax, [0x5d78d2]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00409170
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x30]
lea eax, [0x610c20]
jmp 0x52d302
lea eax, [0x5d1eaa]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00409170
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x30]
lea eax, [0x610c20]
jmp 0x52d302
mov eax, ebp
call fcn.0045e2a0
nop
call fcn.0045ccc0
jmp fcn.0052d2d0
Function at 0x544100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5442c2
sub esp, 0x3c
lea eax, [0x5a2720]
mov dword [esp], eax
call fcn.0040b910
mov eax, dword [esp + 4]
mov dword [esp + 0x38], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x54419d
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov ebx, dword [esp + 0x30]
cmp esi, edx
jge 0x54417a
cmp eax, ebp
jle 0x54417a
jbe 0x5442b8
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x544137
jmp 0x5442af
mov edx, dword [esp + 0x38]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
je 0x544270
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x44]
cmp ecx, ebp
jge 0x5442ab
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x50]
mov dword [esp], edx
mov ebx, dword [esp + 0x54]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x58]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x5c]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x50]
mov dword [esp], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x50]
mov dword [esp], edx
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x4c]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x50]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x54415e
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x544195
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x544195
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x544195
add esp, 0x3c
ret
mov eax, esi
mov ecx, edx
call fcn.0045e2a0
mov ecx, eax
mov eax, ebp
call fcn.0045e2a0
nop
call fcn.0045ccc0
jmp fcn.00544100
Function at 0x568d80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x568f43
sub esp, 0x4c
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x68]
mov ebx, dword [esp + 0x64]
mov ebp, dword [esp + 0x5c]
xor eax, eax
jmp 0x568e37
lea ebx, [ebp + 1]
mov ebp, dword [esp + 0x64]
mov ebp, dword [esp + 0x5c]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x64]
mov ebp, dword [esp + 0x20]
cmp ebp, edx
jge 0x568e30
lea esi, [ebx + ebp*8]
mov ebx, dword [esi]
cmp dword [esi + 4], ecx
jne 0x568db0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
call fcn.004028f0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x568e0c
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x68]
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x58]
jmp 0x568db0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x4c
ret
inc eax
mov ebp, dword [esp + 0x5c]
mov ecx, edi
cmp ebp, eax
jle 0x568e64
mov dword [esp + 0x24], eax
lea esi, [ecx + eax*8]
mov edi, ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x1c], ecx
mov esi, dword [esi]
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
jmp 0x568dc7
lea edi, [esp + 0x34]
xor eax, eax
call fcn.0045e49a
mov ecx, dword [esp + 0x50]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
call fcn.00409170
mov ecx, dword [esp + 8]
lea edx, [0x5a5ba0]
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 8], ecx
call fcn.004091f0
mov ecx, dword [esp + 0xc]
lea edx, [0x59f260]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 8], ecx
call fcn.004091f0
mov ecx, dword [esp + 0xc]
lea edx, [0x59f260]
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
lea ecx, [0x5de014]
mov dword [esp], ecx
mov dword [esp + 4], 0x47
lea ecx, [esp + 0x34]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.004b95e0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x4c
ret
call fcn.0045ccc0
jmp fcn.00568d80
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x40de38
nop
mov ecx, 0x26a502c4
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x3dd84128
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1001592
Capabilities:
Terminate process

Disassembly:
sub esp, 0xa0
mov eax, dword [0x100301c]
and dword [esp], 0
push ebx
mov dword [esp + 0xa0], eax
call fcn.010014ef
cmp dword [0x12d3180], 0
jne 0x1001603
mov bl, byte [0x1003060]
test bl, bl
jne 0x10015ce
push 0x10011c4
call dword [sym.imp.msvcrt.dll_printf]
jmp 0x100162d
mov eax, 0x1003060
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015d6
sub eax, edx
cmp eax, 2
jne 0x1001603
cmp bl, 0x2d
je 0x10015ee
cmp bl, 0x2f
jne 0x1001603
cmp byte [0x1003061], 0x3f
jne 0x1001603
push 0x10011a0
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
call fcn.01001d1b
mov eax, dword [0x12d3180]
test eax, eax
je 0x100163d
push eax
call fcn.01001f2c
test eax, eax
jne 0x1001636
push dword [0x12d3180]
push 0x1001170
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x1001752
xor eax, eax
jmp 0x1001752
push ebp
push esi
push edi
push 0x400
mov esi, 0x1003180
push esi
call fcn.01001d06
mov ebx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
call fcn.010021b2
test ebx, ebx
jbe 0x10016e5
mov edi, 0x1003190
mov dword [esp + 0x14], ebx
lea ebp, [edi + 0x10]
push ebp
push 0x80
lea eax, [esp + 0x34]
push eax
call fcn.010014b4
lea eax, [esp + 0x2c]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x100169a
mov byte [eax], 0
push 0
mov esi, 0x1003060
push esi
lea eax, [esp + 0x34]
push eax
call fcn.01001e1c
test eax, eax
jne 0x10016ce
push eax
push esi
push ebp
call fcn.01001e1c
test eax, eax
jne 0x10016ce
push eax
push esi
add ebp, 0x80
push ebp
call fcn.01001e1c
test eax, eax
je 0x10016d4
mov dword [edi], 1
add edi, 0xb40
dec dword [esp + 0x14]
jne 0x1001671
mov esi, 0x1003180
test ebx, ebx
mov ebp, 0x100113c
jbe 0x1001720
lea edi, [esi + 0x20]
cmp dword [edi - 0x10], 0
je 0x1001717
push dword [esi]
call fcn.01001f2c
test eax, eax
jne 0x1001717
push edi
push dword [esi]
push ebp
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
mov dword [esp + 0x10], 1
add esi, 0xb40
dec ebx
jne 0x10016ee
push 0
push 0x1003060
mov esi, str.System
push esi
call fcn.01001e1c
test eax, eax
je 0x100174b
call fcn.01001f7d
test eax, eax
jne 0x100174b
push esi
push eax
push ebp
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9c]
add esp, 0xa0
jmp fcn.010017eb
Function at 0x10017eb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100301c]
jne 0x10017f4
ret
jmp 0x10017f9
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x100301c]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x12d3184]
test eax, eax
je 0x100181d
call eax
cmp dword [0x12d3188], 0
je 0x1001864
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x12d3188]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.010017eb
add ebp, 0x2a8
leave
ret

Function at 0x1001889
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001210
call fcn.01001a30
cmp word [0x1000000], 0x5a4d
jne 0x10018c8
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x10018c8
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x10018e1
cmp ecx, 0x20b
je 0x10018ce
and dword [ebp - 0x1c], 0
jmp 0x10018f8
cmp dword [eax + 0x1000084], 0xe
jbe 0x10018c8
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x10018f2
cmp dword [eax + 0x1000074], 0xe
jbe 0x10018c8
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x12d318c], 0xffffffff
or dword [0x12d3190], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100304c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1003048]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x12d3194], eax
call fcn.01001a2c
cmp dword [0x1003020], 0
jne 0x1001955
push fcn.01001a2c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01001a1a
push 0x1003010
push 0x100300c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1003044]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1003040]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1003008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01001592
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x10019cd
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1001a02
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01001a6b
ret