joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10069350
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100bc918]
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
cmp eax, 0x26
je 0x100693b6
push ecx
mov ecx, 0x743ea1
cmp eax, ebx
je 0x100693a5
mov dl, bl
call fcn.100749d0
movzx esi, bx
mov ecx, 0xb72ed6
mov edx, esi
call fcn.10074a30
mov edx, esi
mov ecx, 0xb73146
call fcn.10074a30
mov edx, esi
mov ecx, 0xb733b6
call fcn.10074a30
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or dl, 0xff
call fcn.100749d0
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x743ea1
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov byte [esi], 0xff
cmp byte [ebp - 8], 0
je 0x1006940b
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10069420
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100bccf4]
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
cmp eax, 0x28
je 0x10069486
push ecx
mov ecx, 0x743eb2
cmp eax, ebx
je 0x10069475
mov dl, bl
call fcn.100749d0
movzx esi, bx
mov ecx, 0xb72ed8
mov edx, esi
call fcn.10074a30
mov edx, esi
mov ecx, 0xb73148
call fcn.10074a30
mov edx, esi
mov ecx, 0xb733b8
call fcn.10074a30
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or dl, 0xff
call fcn.100749d0
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x743eb2
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov byte [esi], 0xff
cmp byte [ebp - 8], 0
je 0x100694db
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006a130
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push dword [0x100bcb64]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
shr eax, 0xf
test al, 1
je 0x1006a175
push dword [0x100bcbe4]
call esi
shr eax, 0xf
test al, 1
je 0x1006a175
cmp byte [0xba82e3], 0
jne 0x1006a175
mov eax, dword [0x102f1b80]
call eax
test al, al
jne 0x1006a175
cmp byte [0x100bcb3a], al
jne 0x1006a175
mov al, 1
pop esi
ret
push dword [0x100bcb64]
call esi
shr eax, 0xf
test al, 1
je 0x1006a1eb
push dword [0x100bcbe4]
call esi
shr eax, 0xf
test al, 1
je 0x1006a1eb
mov eax, dword [0x102f1b80]
call eax
test al, al
je 0x1006a1c2
mov eax, 0x588b50
call eax
test al, al
jne 0x1006a1eb
push 1
push 0
push 1
push str.WLE:_You_can_not_use_the_menu_while_on_a_mission_or_a_phone_
mov eax, 0x588be0
call eax
add esp, 0x10
xor al, al
pop esi
ret
cmp byte [0x100bcb3a], 0
je 0x1006a1eb
mov eax, 0x588b50
call eax
test al, al
jne 0x1006a1eb
push 1
push 0
push 1
push str.WLE:_The_mod_menu_is_disabled_
mov eax, 0x588be0
call eax
add esp, 0x10
xor al, al
pop esi
ret

Function at 0x1006cbd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x1006cc16
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1006cc20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x1006cc67
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1006cc70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, dl
mov dword [ebp - 0x14], 0
push ebx
mov bl, cl
push esi
mov esi, dword [ebp + 8]
test dl, dl
jne 0x1006cc90
mov byte [ebp - 8], dl
jmp 0x1006ccaa
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov byte [esi], bl
cmp byte [ebp - 8], 0
je 0x1006ccc9
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10070110
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push 4
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp + 8]
test eax, eax
mov eax, dword [esi]
setne byte [ebp - 8]
mov dword [edi], eax
cmp byte [ebp - 8], 0
je 0x10070160
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10074750
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov ecx, 0x401000
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x100747a9
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x100747bb
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.10074c30
cmp eax, 0x16197be9
jne 0x100747d6
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.10074c30
cmp eax, 0x94bf
jne 0x100747f1
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.10074c30
cmp eax, 0x94bf
jne 0x1007480c
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.10074c30
cmp eax, 0x94bf
jne 0x10074827
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.10074c30
cmp eax, 0x3539f633
jne 0x10074842
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.10074c30
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x10074950
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, edx
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
mov dword [ebp - 0x14], 0
test edi, edi
jne 0x1007497c
mov byte [ebp - 8], 0
jmp 0x10074996
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
push edi
push 0x90
push esi
call fcn.10077080
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x100749c2
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100749d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov bl, dl
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov byte [esi], bl
cmp byte [ebp - 8], 0
je 0x10074a29
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10074a30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov di, dx
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov word [esi], di
cmp byte [ebp - 8], 0
je 0x10074a8b
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10074aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, edx
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov dword [esi], edi
cmp byte [ebp - 8], 0
je 0x10074af9
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10074b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
movss dword [ebp - 8], xmm1
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [ebp - 8]
test eax, eax
setne byte [ebp - 0xc]
movss dword [esi], xmm0
cmp byte [ebp - 0xc], 0
je 0x10074b62
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10074b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x10074bc5
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10074bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
movzx esi, word [esi]
test eax, eax
je 0x10074c25
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, si
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10074c30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x10074c84
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10074c90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov ecx, 0xb7cb50
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
movss xmm0, dword [esi]
movss dword [ebp - 8], xmm0
test eax, eax
je 0x10074cf5
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10074d00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov dword [ebp - 8], edx
call fcn.10074de0
push eax
lea ecx, [ebp - 4]
call fcn.1000fbc0
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov dword [ebp - 0x18], 0
test edi, edi
jne 0x10074d30
mov byte [ebp - 0xc], 0
jmp 0x10074d4a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
push edi
push dword [ebp - 8]
push esi
call fcn.10078c50
add esp, 0xc
cmp byte [ebp - 0xc], 0
je 0x10074d74
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10087082
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10086ef8

Function at 0x100899c0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10089942
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40d26b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40d27a
pop dword [ebp - 0x44]
mov eax, 0xd4226074
sub eax, 0xd3e18dfa
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xae34f121
add dword [ebp - 0x54], 0xa01d542a
mov dword [ebp - 0x50], 0x2b20d082
sub dword [ebp - 0x50], 0xf8ed843d
mov dword [ebp - 0x4c], 0x374ead11
add dword [ebp - 0x4c], 0x14fd971d
mov dword [ebp - 0x48], 0x3e08e0ae
add dword [ebp - 0x48], 0xc1f71f52
lea eax, [ebp - 0x54]
push eax
mov eax, 0x77d7ef68
add eax, 0x886a410c
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x6d2f6fed
add dword [ebp - 0x54], 0x742f969
mov dword [ebp - 0x50], 0xce02eae4
sub dword [ebp - 0x50], 0x8c96896f
mov dword [ebp - 0x4c], 0xffc59b64
add dword [ebp - 0x4c], 0x63a9d108
mov dword [ebp - 0x48], 0x3083a146
sub dword [ebp - 0x48], 0x3083a146
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x35a649b3
sub eax, 0x3564188f
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3ed90
push 0
call eax
mov ecx, 0x4c8e
xor edx, edx
add edx, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x44]
mov esi, 0xc346df12
sub dword [ebp - 0x40], edi
mov edi, dword [ebx]
add dword [ebp - 0x20], edi
add edi, esi
xor dword [ebp - 0x3c], 0xef2a1cf7
mov dword [edx], edi
mov dword [ebp - 4], 0x110e14c3
add edx, 0x3d3aa107
sub edx, 0x3d3aa103
add ebx, 0x171a22e1
add ebx, 0xe8e5dd23
loop 0x40d38c
add eax, 0x1250b
mov ebx, eax
add eax, 5
mov ecx, 0xd63e10bb
add ecx, 0x2a01ef45
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4011bb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
lea ecx, [ecx + eax + 0x78]
cmp dword [ecx + 4], 0
push ebx
push edi
jne 0x4011d6
xor eax, eax
jmp 0x401246
push esi
mov esi, dword [ecx]
add esi, eax
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x401243
cmp dword [esi + 0x14], 0
je 0x401243
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x24]
or dword [ebp - 8], 0xffffffff
add edi, eax
add ebx, eax
test ecx, ecx
je 0x401243
mov dword [ebp - 4], ecx
jmp 0x401202
mov eax, dword [ebp + 8]
mov ecx, dword [edi]
add ecx, eax
push ecx
push dword [ebp + 0xc]
call section..text
pop ecx
pop ecx
test eax, eax
jne 0x40121b
movzx eax, word [ebx]
mov dword [ebp - 8], eax
add edi, 4
add ebx, 2
dec dword [ebp - 4]
jne 0x4011ff
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x401243
cmp eax, dword [esi + 0x14]
jg 0x401243
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
add eax, ecx
jmp 0x401245
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 8

Function at 0x4036ee
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
je 0x40372d
push edi
mov edi, dword [esp + 0x14]
sub edi, 0x1b306e0
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov eax, edx
shr eax, 0xc
xor al, byte [edi + esi + 0x1b306e0]
inc esi
mov byte [esi + 0x1b306df], al
cmp esi, ebx
jb 0x403709
pop edi
pop esi
mov byte [ebx + 0x1b306e0], 0
mov eax, 0x1b306e0
pop ebx
ret
Function at 0xb7d1c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x566000]
push edi
jmp 0xb7d1da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xb7d1e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb7d1d0
mov eax, 1
add ebx, ebx
jne 0xb7d1f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xb7d204
jne 0xb7d223
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb7d223
dec eax
add ebx, ebx
jne 0xb7d210
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xb7d1e8
add ebx, ebx
jne 0xb7d21f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xb7d275
xor ecx, ecx
sub eax, 3
jb 0xb7d23b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xb7d2aa
sar eax, 1
mov ebp, eax
jmp 0xb7d246
add ebx, ebx
jne 0xb7d246
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb7d214
inc ecx
add ebx, ebx
jne 0xb7d254
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb7d214
add ebx, ebx
jne 0xb7d261
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xb7d256
jne 0xb7d272
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xb7d256
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xb7d294
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xb7d286
jmp 0xb7d1d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xb7d294
add edi, ecx
jmp 0xb7d1d6
pop esi
mov edi, esi
mov ecx, 0x31cd19
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xb7d2cf
cmp byte [edi], 0x9f
jne 0xb7d2b4
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xb7d2b2
lea edi, [esi + 0x778000]
mov eax, dword [edi]
or eax, eax
je 0xb7d320
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x78bc88]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x78be54]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xb7d2d5
mov ecx, edi
jns 0xb7d304
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x78be58]
or eax, eax
je 0xb7d31a
mov dword [ebx], eax
add ebx, 4
jmp 0xb7d2f2
call dword [esi + 0x78be68]
mov ebp, dword [esi + 0x78be5c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xb7d354
sub esp, 0xffffff80
jmp 0x712ad7