joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030900
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
lea ecx, [esp]
push esi
push eax
push ecx
call fcn.100308c0
push 0
push 0x80
push 3
push 0
push 3
lea edx, [esp + 0x18]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x1003096f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x10030956
cmp eax, 3
ja 0x10030956
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10030964
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x10030980
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
mov al, 0x5c
push esi
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 7], al
push 0
mov al, 0x6e
push 0x80
push 3
mov byte [esp + 0x15], al
mov byte [esp + 0x17], al
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x24], 0x53
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], 0x55
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x10030a20
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x10030a07
cmp eax, 3
ja 0x10030a07
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov esi, dword [esi]
cmp esi, 0xffffffff
je 0x10030a15
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x100370c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebx, 4
sub esi, ecx
lea eax, [edi + ecx]
lea edx, [esp + ebp + 0x10]
add edi, ebx
mov cl, byte [esi + eax]
mov byte [edx], cl
mov byte [eax], cl
add edx, 4
inc eax
dec ebx
jne 0x100370e3
inc ebp
cmp ebp, 4
jl 0x100370cb
cmp edi, 0xb0
jge 0x1003719a
mov ebp, 0x1005e4c8
xor eax, eax
lea ecx, [esp + 0x10]
inc eax
mov edx, eax
and edx, reloc.DRVUTILS.dll_Ordinal_3
jns 0x1003711e
dec edx
or edx, 0xfffffffc
inc edx
xor ebx, ebx
add ecx, 4
mov bl, byte [esp + edx*4 + 0x13]
mov dl, byte [ebx + str.cw]
mov bl, byte [ecx - 4]
xor bl, dl
cmp eax, 4
mov byte [ecx - 4], bl
jl 0x1003710e
mov al, byte [ebp]
mov cl, byte [esp + 0x10]
xor cl, al
add ebp, 4
mov byte [esp + 0x10], cl
mov esi, 1
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov dl, byte [eax - 1]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
add eax, 4
dec ecx
jne 0x10037158
inc esi
cmp esi, 4
jl 0x1003714f
xor esi, esi
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov ebx, dword [esp + 0x24]
mov dl, byte [eax]
add eax, 4
mov byte [edi + ebx], dl
inc edi
dec ecx
jne 0x10037178
inc esi
cmp esi, 4
jl 0x1003716f
cmp edi, 0xb0
jl 0x10037108
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100371b0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebp
push esi
call fcn.10037240
add esp, 8
lea edi, [ebp + 0x10]
mov ebx, 9
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + str.cw]
mov byte [eax + esi - 1], dl
jl 0x100371d0
push 0
push esi
call fcn.10037270
push esi
call fcn.100372c0
push edi
push esi
call fcn.10037240
add esp, 0x14
add edi, 0x10
dec ebx
jne 0x100371ce
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + str.cw]
mov byte [eax + esi - 1], dl
jl 0x10037205
push 0
push esi
call fcn.10037270
add ebp, 0xa0
push ebp
push esi
call fcn.10037240
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10037240
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push ebx
push esi
sub ecx, eax
mov esi, 0x10
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x10037251
pop esi
pop ebx
ret

Function at 0x100373e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
lea eax, [ebp + 0xa0]
push eax
push esi
call fcn.10037240
add esp, 8
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x1005e3c8]
mov byte [eax + esi - 1], dl
jl 0x100373fe
push 0x10
push esi
call fcn.10037270
add esp, 8
lea edi, [ebp + 0x90]
mov ebx, 9
push edi
push esi
call fcn.10037240
push esi
call fcn.10037470
add esp, 0xc
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x1005e3c8]
mov byte [eax + esi - 1], dl
jl 0x1003743b
push 0x10
push esi
call fcn.10037270
add esp, 8
sub edi, 0x10
dec ebx
jne 0x10037429
push ebp
push esi
call fcn.10037240
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10037470
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
xor edi, edi
lea eax, [esp + edi + 0x14]
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
sub eax, ecx
mov esi, 1
mov dword [esp + 0x10], eax
lea edx, [esi - 2]
and edx, 3
add edx, edi
mov al, byte [edx + ebp]
push eax
push 9
call fcn.10037390
lea ecx, [esi + 1]
mov bl, al
and ecx, 3
add ecx, edi
mov dl, byte [ecx + ebp]
push edx
push 0xd
call fcn.10037390
xor bl, al
mov eax, esi
and eax, 3
add eax, edi
mov cl, byte [eax + ebp]
push ecx
push 0xb
call fcn.10037390
mov edx, dword [esp + 0x28]
xor bl, al
mov eax, dword [esp + 0x40]
mov cl, byte [edx + eax]
push ecx
push 0xe
call fcn.10037390
add esp, 0x20
xor bl, al
mov eax, dword [esp + 0x28]
inc esi
mov byte [eax], bl
lea edx, [esi - 1]
inc eax
cmp edx, 4
mov dword [esp + 0x28], eax
jl 0x10037496
add edi, 4
cmp edi, 0x10
jl 0x1003747d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebp], eax
mov eax, dword [esp + 0x20]
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
pop edi
mov dword [ebp + 0xc], eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x10044ce0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x10044d03
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.100449d0
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.10044a20
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.10044ac0
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.10025280
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x100707b0
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x10044db3
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.10044cb0
test ax, ax
je 0x10044d7d
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x10044d9f
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x10044d9f
lea ecx, [esp + 0xa]
push esi
push ecx
call fcn.10025390
test al, al
jne 0x10044db3
jmp 0x10044dae
lea edx, [esp + 8]
push esi
push edx
call fcn.100252f0
test al, al
jne 0x10044db3
mov word [esi], 0
mov ax, word [esi]
test ax, ax
je 0x10044dce
cmp ax, 0xffff
je 0x10044dce
pop esi
mov eax, 1
pop ebx
add esp, 0x40
ret 8
pop esi
xor eax, eax
pop ebx
add esp, 0x40
ret 8
Function at 0x10044de0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x10044e03
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.100449d0
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.10044a20
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.10044ac0
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.10025280
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x100707b0
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x10044eae
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.10044cb0
test ax, ax
je 0x10044eae
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x10044eae
cmp byte [esp + eax + 0xa], 0x3a
jne 0x10044eae
lea edx, [esp + eax + 0xb]
push esi
push edx
call fcn.100252f0
test al, al
je 0x10044ea9
mov ax, word [esi]
cmp ax, 1
jl 0x10044ea9
cmp ax, 7
jle 0x10044eae
mov word [esi], 0
xor eax, eax
cmp word [esi], ax
pop esi
pop ebx
setne al
add esp, 0x40
ret 8

Function at 0x10044ec0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push 0x10
push eax
call fcn.100449d0
lea ecx, [esp + 0x24]
push 0x10
push ecx
call fcn.10044a20
lea edx, [esp + 0x14]
push 0x10
push edx
call fcn.10044b80
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.10044b40
lea ecx, [esp + 4]
lea edx, [esp + 0x34]
push ecx
push 0x10
push edx
lea eax, [esp + 0x20]
push 0x100707b0
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x10044f30
lea edx, [esp + 0x34]
lea eax, [esp + 0x44]
push edx
push eax
call fcn.10025130
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x50
ret 8

Function at 0x10044f40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp]
push 0x10
push eax
call fcn.100449d0
lea ecx, [esp + 0x20]
push 0x10
push ecx
call fcn.10044a20
lea edx, [esp + 0x10]
push 0x10
push edx
call fcn.10044b00
lea eax, [esp]
lea ecx, [esp + 0x10]
push eax
push 0
lea edx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor edx, edx
mov ecx, dword [esp + 0x34]
test eax, eax
setne dl
mov word [ecx], ax
mov al, dl
add esp, 0x30
ret 4
Function at 0x10044fa0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
lea eax, [esp]
push esi
mov esi, dword [esp + 0x78]
push 0x10
push 0
push eax
mov word [esi], 0
call fcn.100252a0
lea ecx, [esp + 0x14]
push 0x10
push ecx
call fcn.100449d0
lea edx, [esp + 0x34]
push 0x10
push edx
call fcn.10044a20
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.10044a70
lea ecx, [esp + 0x44]
push 0x10
push ecx
call fcn.10044bd0
lea edx, [esp + 0x54]
push 0x10
push edx
call fcn.10044c60
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.10044c20
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
push 0x10
push edx
lea eax, [esp + 0x30]
push 0x100707b0
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1004508e
lea edx, [esp + 0x44]
lea eax, [esp + 4]
push edx
push eax
call fcn.10025130
test al, al
je 0x1004504f
xor eax, eax
mov word [esi], 2
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
lea ecx, [esp + 0x54]
lea edx, [esp + 4]
push ecx
push edx
call fcn.10025130
test al, al
je 0x10045076
xor eax, eax
lea eax, [esp + 0x64]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.10025130
test al, al
je 0x1004508e
mov word [esi], 1
xor eax, eax
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4

Function at 0x1004510e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005e650]
jne 0x10045118
repz ret
jmp fcn.10045afc
Function at 0x3d3200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x3d3240
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x3ddddc]
test eax, eax
jne 0x3d3264
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0x51a2922a
mov ecx, eax
call fcn.003d3d50
mov dword [0x3ddddc], eax
call eax
mov ebx, eax
mov eax, dword [0x3de1fc]
test eax, eax
jne 0x3d328c
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0xb1fe2c86
mov ecx, eax
call fcn.003d3d50
mov dword [0x3de1fc], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x3d3342
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x3d3332
cmp ebx, 8
jb 0x3d3317
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x3d32d6
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x3d3317
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x3d32f0
cmp edx, ebx
jae 0x3d3332
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x3d3320
mov edx, dword [esp + 0x18]
test edx, edx
je 0x3d3340
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3d33b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x3d33d9
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x3ddddc]
test eax, eax
jne 0x3d33fd
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0x51a2922a
mov ecx, eax
call fcn.003d3d50
mov dword [0x3ddddc], eax
call eax
mov edi, eax
mov eax, dword [0x3de1fc]
test eax, eax
jne 0x3d3425
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0xb1fe2c86
mov ecx, eax
call fcn.003d3d50
mov dword [0x3de1fc], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x3d34a5
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x3d349a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x3d3460
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x3d34b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x3d34da
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x3ddddc]
test eax, eax
jne 0x3d34fe
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0x51a2922a
mov ecx, eax
call fcn.003d3d50
mov dword [0x3ddddc], eax
call eax
mov edi, eax
mov eax, dword [0x3de1fc]
test eax, eax
jne 0x3d3526
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0xb1fe2c86
mov ecx, eax
call fcn.003d3d50
mov dword [0x3de1fc], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x3d3592
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x3d358a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x3d3560
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x3d3af0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp], 0x21c3
mov eax, 0xbacf914d
shl dword [esp], 0xd
add dword [esp], 0xffffee0d
xor dword [esp], 0xc6d3a95b
or dword [esp], 0xe006cb71
push ebx
push esi
mov esi, dword [esp + 8]
mov ebx, ecx
mul esi
mov eax, 0xaaaaaaab
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov dword [esp + 8], esi
add dword [esp + 8], 0x86d
xor dword [esp + 8], 0x2a29b567
xor dword [esp + 8], 0x2c0b8419
mov dword [esp + 0xc], 0x6024
mov ecx, dword [esp + 0xc]
mul ecx
shr edx, 5
mov dword [esp + 0xc], edx
xor dword [esp + 0xc], 0x206
mov dword [esp + 0xc], 0x7624
shl dword [esp + 0xc], 5
add dword [esp + 0xc], 0xcdd4
xor dword [esp + 0xc], 0xf9244
cmp byte [ebx], 0
je 0x3d3c06
push edi
lea esp, [esp]
mov edi, dword [esp + 0xc]
lea ebx, [ebx + 1]
mov dword [esp + 0x10], 0x6024
mov eax, 0xaaaaaaab
mov ecx, dword [esp + 0x10]
mul ecx
shr edx, 5
mov dword [esp + 0x10], edx
xor dword [esp + 0x10], 0x206
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], 0x7624
shl dword [esp + 0x10], 5
add dword [esp + 0x10], 0xcdd4
xor dword [esp + 0x10], 0xf9244
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
movsx eax, byte [ebx - 1]
mov dword [esp + 0xc], eax
add dword [esp + 0xc], esi
shl edx, cl
add dword [esp + 0xc], edx
sub dword [esp + 0xc], edi
cmp byte [ebx], 0
jne 0x3d3b90
pop edi
mov eax, dword [esp + 8]
pop esi
pop ebx
add esp, 8
ret
Function at 0x3d3d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x3d3dac
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.003d3af0
xor eax, 0x15977d8f
cmp eax, dword [esp + 0x10]
je 0x3d3db6
inc esi
cmp esi, dword [edi + 0x18]
jb 0x3d3d90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x3d3de4
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x3d3de4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x3d3f80
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x3d3fa6
cmp al, 0x2e
je 0x3d3fa3
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x3d3f93
jmp 0x3d3fa6
mov byte [edx], 0
mov eax, dword [0x3ddd94]
test eax, eax
jne 0x3d3fca
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0xe2afc2b8
mov ecx, eax
call fcn.003d3d50
mov dword [0x3ddd94], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x3d4011
mov eax, dword [0x3ddf8c]
test eax, eax
jne 0x3d3ffb
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0xcabcc663
mov ecx, eax
call fcn.003d3d50
mov dword [0x3ddf8c], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x3d4011
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.003d3af0
xor eax, 0x15977d8f
mov ecx, edi
mov edx, eax
call fcn.003d3d50
pop edi
pop esi
add esp, 0x104
ret
Function at 0x3d3df0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov dword [esp + 0x18], ecx
push edi
mov dword [esp + 0x18], ebx
mov ebp, dword [ebx]
cmp ebp, ebx
je 0x3d3f65
jmp 0x3d3e20
mov esi, dword [ebp + 0x30]
mov eax, 0xbacf914d
mov dword [esp + 0x10], 0x21c3
shl dword [esp + 0x10], 0xd
add dword [esp + 0x10], 0xffffee0d
xor dword [esp + 0x10], 0xc6d3a95b
or dword [esp + 0x10], 0xe006cb71
mov ecx, dword [esp + 0x10]
mul ecx
mov eax, 0xaaaaaaab
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [esp + 0x10], ecx
add dword [esp + 0x10], 0x86d
xor dword [esp + 0x10], 0x2a29b567
xor dword [esp + 0x10], 0x2c0b8419
mov dword [esp + 0x14], 0x6024
mov ecx, dword [esp + 0x14]
mul ecx
shr edx, 5
mov dword [esp + 0x14], edx
xor dword [esp + 0x14], 0x206
mov dword [esp + 0x14], 0x7624
shl dword [esp + 0x14], 5
add dword [esp + 0x14], 0xcdd4
xor dword [esp + 0x14], 0xf9244
cmp word [esi], 0
je 0x3d3f4b
mov ebx, dword [esp + 0x10]
mov eax, 0xaaaaaaab
mov dword [esp + 0x14], 0x6024
mov ecx, dword [esp + 0x14]
mul ecx
shr edx, 5
mov dword [esp + 0x14], edx
xor dword [esp + 0x14], 0x206
movzx ecx, byte [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], 0x7624
shl dword [esp + 0x14], 5
add dword [esp + 0x14], 0xcdd4
xor dword [esp + 0x14], 0xf9244
shl edx, cl
movzx ecx, byte [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx eax, word [esi]
shl edi, cl
cmp eax, 0x41
jb 0x3d3f2a
cmp eax, 0x5a
ja 0x3d3f2a
add eax, 0x20
mov dword [esp + 0x10], eax
add esi, 2
add dword [esp + 0x10], edx
add dword [esp + 0x10], edi
sub dword [esp + 0x10], ebx
cmp word [esi], 0
jne 0x3d3ec1
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor eax, 0xf5f9597
cmp eax, dword [esp + 0x1c]
je 0x3d3f6f
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x3d3e20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x3d4240
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x3d43de
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x3d43de
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x3d43de
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x3d43de
mov eax, dword [0x3ddda8]
test eax, eax
jne 0x3d42ab
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0x2c46dbc5
mov ecx, eax
call fcn.003d3d50
mov dword [0x3ddda8], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x3d43d5
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x3de03c]
test eax, eax
jne 0x3d430b
mov ecx, 0xdd71b583
call fcn.003d3df0
mov edx, 0x282aa2f8
mov ecx, eax
call fcn.003d3d50
mov dword [0x3de03c], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x3d438e
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x3de03c]
test eax, eax
jne 0x3d4376
mov ecx, 0xdd71b583
call fcn.003d3df0
mov edx, 0x282aa2f8
mov ecx, eax
call fcn.003d3d50
mov dword [0x3de03c], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x3d4335
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.003d4510
mov edx, edi
mov ecx, ebx
call fcn.003d4420
pop esi
test eax, eax
jne 0x3d43d5
mov eax, dword [0x3de024]
test eax, eax
jne 0x3d43c9
mov ecx, 0x802173e5
call fcn.003d3df0
mov edx, 0xef65a2d8
mov ecx, eax
call fcn.003d3d50
mov dword [0x3de024], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret