joyce8/EMBER2024-capa huggingface dataset:
Function at 0x123a6dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shld ebx, ebp, 0x18
bsr ebx, edx
mov ebx, eax
test bh, al
cmp byte [edi], 0x23
mov byte [esp], 0xb
mov dword [esp], 0x868c0e69
lea esp, [esp + 4]
jne 0x123f4a2
clc
aaa
test esp, ebp
movsx eax, bl
sub edx, edx
bsf ax, si
adc ax, dx
btc eax, esp
not ax
mov eax, edx
call fcn.0123acc9
sub eax, 0x89d508e0
dec edi
sal cl, 0x2a
ljmp 0x168f

Function at 0x123b520
Capabilities:
Encode data using xor

Disassembly:
clc
push 0x4e7baccd
mov edi, dword [edi + ecx*4]
jmp 0x1ef43fa
bsr ecx, esi
test edi, edi
mov byte [esp + 4], cl
lea esp, [esp + 0x1c]
je 0x1efbe40
pushfd
bt si, bx
add eax, edi
mov word [esp], ax
call int.01ef6bc2
sub ah, byte [edx - 3]
loopne 0x1ef440b
cmp dword [edi + 0x6149c5e6], 0x70
sub dword [esi + 0x6ea180d1], esp
pop ecx
jae 0x1ef444b
pop ss
cli
jecxz 0x1ef43e1
cmpsd dword [esi], dword es:[edi]
sub dword [edi + 0x73], ebx
invalid
test dword [ebp + 0x5ad7f3b4], 0xd1a2e7a9
mov ebp, 0xc76d98b
out dx, al
invalid

Function at 0x123d846
Capabilities:
Encode data using xor

Disassembly:
push dword [esp]
cmp edi, ebx
jmp 0x1245198

Function at 0x123e3fd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xbbdd6e8e
imul edx, edx, 0xa
pushal
bt bp, sp
jmp 0x1ef4176
push eax
lea esp, [esp + 4]
jmp fcn.0123b2ba
and al, al
bsf eax, esi
mov dword [esp + 4], ebp
add ax, 0x90a9
lea ebp, [esp + 4]
aas
bt esi, 0x13
sub esp, 0x14
btc ax, cx
btr ax, 5
push esi
sar ah, 2
movzx ax, dl
rcr eax, cl
add al, 0x66
push edi
movzx ax, dl
push ebx
not ax
rcl al, cl
sal eax, cl
aaa
push edx
dec ax
mov eax, dword [ebp + 8]
pushal
push eax
test eax, eax
pushfd
mov byte [esp + 0x14], bh
lea esp, [esp + 0x28]
je 0x1efbe40
test si, di
shl dl, 1
btr si, 2
mov esi, dword [eax + 0x3c]
lea edx, [ecx - 0x28a95b43]
clc
movsx edx, cl
rcr dh, 4
add esi, eax
ror dl, 2
movzx dx, dl
mov edx, dword [esi + 0x78]
stc
test dl, 0xbf
test edx, edx
call fcn.0123dc53
mov dword [esp], ebp
push ebp
jmp 0x1243ea1
lea esp, [esp + 0x30]
ja 0x1ef9c57
bt bp, 0xe
stc
jmp 0x123dda1
lea esp, [esp + 8]
jne 0x123f4a2
sal ax, cl
rol al, cl
btr ax, 5
cmc
sub edx, edx
bsr eax, esi
shld ax, ax, 9
mov eax, edx
sbb al, dh
ror al, cl
shl al, 1
rol al, 1
add edi, 1
sal al, cl
shl al, 1
seto al
mov al, byte [edi]
push esi
bt edi, ebx
test al, al
jmp 0x1ef9899
bswap edi
call fcn.0123f495
pushfd
mov word [esp], 0x5404
call fcn.012435f1
cmp dx, ax
add edx, eax
pushfd
pushfd
push dword [esp + 4]
pushfd
lea esp, [esp + 0x34]
jmp 0x123e055
jmp 0x1f01b64
jmp 0x1f00910
push 0x40302d11
push ecx
mov esp, esi
pushal
pushal
lea esp, [esp + 0x40]
jmp 0x1efbe40
lea esp, [esp + 4]
je 0x1ef2952
push ebx
cmc
pushal
sub al, 0x30
pushfd
cmp al, 9
mov byte [esp + 0x14], bl
pushfd
push esp
jmp 0x123e85d

Function at 0x123f495
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec edi
lea edi, [eax + 0x7352939c]
mov edi, edx
lea esp, [esp + 4]
Function at 0x124497e
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xe8
sbb edx, edx
mov al, 0xed
neg bh
test bx, 0x3e5f
mov ebx, eax
clc
stc
cmp byte [edi], 0x23
push 0xf7334749
pushfd
call fcn.01efbf18
neg dword [eax + ebp*8 + 0xcb75ef]
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebp + 0xf042464], cl
lea esp, [esp + 4]
invalid
test edi, edi
jp 0x124490a
add byte [eax - 0x1e], ch
dec eax
jp 0x1244992
pushal
clc
stc
or ecx, ecx
call fcn.01245d7a
cwde
mov dl, 0x47
xchg esi, eax
out 0x4e, eax
sal byte [eax], 0x69
test al, 0x35
pop ecx
jg 0x1244922
xor eax, 0x848c7f59
mov esi, 0x85df33d
test byte [esi + 0x85df33d], bh
dec ecx
xlatb
mov al, 0x61
daa
invalid

Function at 0x1efad12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
inc al
bt di, sp
ror al, 2
pushfd
dec al
cmc
pushfd
not al
cmp esp, ecx
cmc
mov byte [ecx], al
stc
cmp esp, 0xc6b6910e
add ecx, 1
cmc
test ah, ah
mov byte [esp + 4], al
lea esp, [esp + 0x3c]
jne 0x123f4a9
jmp 0x1f00932
call fcn.0123aad6
mov eax, dword [0x283da0ae]
cmp dword [edi - 0x5ff33e5], 0xffffffd1
jb 0x1f009a3
sub ah, bh
neg byte [eax]
sub edx, dword [esi - 0x4c]
mov byte [0x9d068aa0], al
lds esp, [eax]
arpl sp, bx
test byte [esi - 0x611d603a], 0x74
sahf
sub al, 0xd1
mov ebx, 0xa52a7f17
sar bh, cl
inc eax
mov word [esi - 0x23], gs
fidiv word [eax - 0x6d439ad8]
pop esp
jbe 0x1f009a8
sbb al, 0x9a
jno 0x1f0095d
adc dl, dh
rol bh, 0xfd
push ds
jmp 0xf093746f
push edx
xor byte [edx - 0x1e], ah
jnp 0x1f009dc
xor esi, eax
mov dh, 0x40
stosd dword es:[edi], eax
wait
fcom dword [ebx - 0x4aa4dd7c]
aas
sbb eax, 0x7de428fa
pop esi
shl dword [ebp - 0x21], 1
sbb ecx, ebp
mov edi, 0x5cbbad7c
punpckhdq mm5, mm7
or eax, 0xa3c564e9
invalid
clc
xchg al, ah
cld
pop eax
ljmp 0x1686
or al, 0x41
call 0x75762cd7
nop
pop ecx
mov cl, 0xbb
stosd dword es:[edi], eax
sub eax, 0x39bd91f3
insd dword es:[edi], dx
cmc
cmp dword [ebp - 0xb], ebp
dec edi
stosd dword es:[edi], eax
mov esp, dword [0xee54ea2f]
mov byte [eax + 0x28e52afa], al
cmp dl, 0x2a
in eax, 0x28
into
jp 0x1f00a1a
adc eax, 0x9b953399
dec esp
add byte [ecx - 0x61ab125d], bh
jns 0x1f009ce
jo 0x1f009ed
invalid
popal
sbb ebx, dword [ecx - 0x30eb949]
cld
adc al, 0xa5
aad 0xd9
adc al, 0x92
jno 0x1f009ff
fcom dword [esi + 0x4c17aae]
or ch, ah
jmp 0x1f00a69
dec edx
mov eax, 0x1c1b6f19
sub byte [ecx - 0x2ba74f6], ah
dec ebx
out 0xc6, al
movsb byte es:[edi], byte [esi]
in al, dx
xchg dword [ebx + ebp*8], ebp
aaa
out dx, al
sal byte [ecx - 0x5c67a665], cl
outsb dx, byte [esi]
pop esp
jne 0x1f00a14
loop 0x1f009f9
cmpsd dword [esi], dword es:[edi]
inc eax
dec ecx
lodsd eax, dword [esi]
stc
xor bl, bh
jmp 0x1f00a46
Function at 0x1efea6f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg dword [esp + 0xc], eax
pushfd
not ah
movsx ax, bl
movsx eax, dl
mov dword [esp + 0xc], 0
push dword [esp]
bswap ax
lahf
lea eax, sym.imp.KERNEL32.dll_LocalAlloc
pushal
call fcn.01edf447
add cl, byte [ebp + 0x54]
inc edi
inc edi
cmp dword [edi + 0x14517cf8], 0x3a
mov ah, 0x9c
je 0x1efeb06
pop ebx
or byte [esi - 0x55dd161c], 0xaa
in eax, 0x5e
xor byte [eax - 0x3b73415d], ch
leave
push edi
jbe 0x1efead2
stosd dword es:[edi], eax
xor dword [ecx - 0x2948f9e0], edi
dec ebx
ret
sti
salc
ret
out dx, eax
and dl, byte [esi]
pushal
jecxz 0x1efeb11
push ecx
invalid
fcomp qword [ebx + 0xe49e354]
inc esi
jnp 0x1efeb2f
pop ebx
push 0x3b
cmp eax, 0xdd4d71b5
mov cl, 0xfd
ljmp 0xba97
popfd
and eax, 0xec92552e
stosb byte es:[edi], al
pop edi
push 0xffffffffffffffa6
int 0x76
dec eax
das
sbb ah, byte [0x4cabe22c]
out 0xa3, eax
stosb byte es:[edi], al
mov dword [edx + eax - 0x6b71c56e], eax
inc ebp
xchg dword [esi + 0x5c], esp
cmp al, 9
add byte [eax - 0x5497dcc1], 0x41
pop edi
arpl word [ebp + 0xf042464], cx
test dword [ebx], edi
or dword [edi + edi*8], esi
push esi
mov byte [esp], 5
pushfd
push dword [esp + 4]
lea esp, [esp + 0xc]
jmp fcn.0123b2ad

Function at 0x1effa33
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x912c4d96
invalid
push edi
lea esp, [esp + 0xc]
jne 0x123f4a2
sar eax, cl
btc ax, 0xb
ror ah, cl
sub edx, edx
neg ah
sbb ah, ch
mov eax, edx
shr al, cl
sbb al, 0x77
dec al
add edi, 1
inc al
adc al, bh
neg al
ror al, 6
mov al, byte [edi]
stc
test dl, ch
test al, al
push 0x41a4fda4
call fcn.01243c96
imul ecx, dword fs:[ebx - 0x6e], 0xc6bf836f
ja 0x1efc1f5
mov ecx, 0x97ec2552
mov bl, 0xf7
pop eax
dec ebp
jle 0x1efc2d4
loope 0x1efc1fc
mov edx, 0x8bc58f01
sub esp, edx
mov bh, 0x1b
invalid
in al, dx
loopne 0x1efc33c
in eax, dx
retf
aam 0xfd
inc edx
dec edx
invalid
cmp eax, edi
cmp byte [edi], 0x23
jmp 0x1efc215
Function at 0x1f01d32
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ror dword [edx], cl
cmp bh, ch
mov bh, 0x12
mov ebx, eax
push 0x929422a
pushal
cmc
cmc
cmp byte [edi], 0x23
push 0xfb304074
mov word [esp + 8], 0xf88a
lea esp, [esp + 0x28]
jne 0x123f4a2
jne 0x123b345
inc esi
imul ebp, dword [ebp + 0x4e], 0x57656d61
add byte [ecx - 0x73], al
and al, 8
inc ecx
lea esp, [esp + 8]
pushal
push dword [esp + 0xc]
call fcn.0123bd6a
loopne 0x123b283
or al, byte [eax]
add al, ah
mov ss, word [ecx + 0x488a3c4f]
xchg ecx, eax
dec edi
cmp al, 0x8a
dec eax
xor ebx, eax
pop esi
int 0x64
sub dword [ebx + 0x33], 0xffffff99
pushfd
pop edi
ja 0x123b2f0
add byte [esi - 0x6cdefffb], 0x6a
mov bl, 4
jne 0x123b36b
cdq
dec ebp
jl 0x123b319
jg fcn.0123b2ad
xor al, 0xaa
push 0xffffffffffffffb9
aam 0x7e
cmp dh, byte [ecx]
enter 0x5577, 0x5a
push esp
in al, dx
imul esp, dword [eax - 0x6dd88d48], 0x8ea7d1d8
mov byte [edx], dh
mov dword [0x4b288cff], eax
ror dword [edx - 0x59], 1
pop eax
call dword [esi - 0x78]
mov esi, 0x6c4f1ed3
mov eax, dword [0xa4682eb8]
nop
mov eax, 0x90a4682e
test byte [eax + 0x7e], cl
or eax, 0xd0e6cc3a
ja 0x123b2d7
dec ecx
and dword [ecx + edx*2 + 0x43], ebx
out 0x8c, eax
inc esi
pop esi
aad 0xc4
adc ecx, dword [eax + 0x1cff0297]
fsubr st(7), st(0)
out 0xe9, eax
les ecx, [ebp - 0x70]
nop
adc ebp, dword [ecx]
lahf
xchg edi, eax
popal
mov bl, 0x39
pop ebp
mov cs, edx
imul edi, dword [ebx + 0x25], 0xffffffa7
cdq
cli
int 0x67
dec edx
jb 0x123b3ef
dec esp
cmp bh, byte [edx - 1]
pushfd
or edx, dword [edx + 0x16]
xchg edx, eax
dec eax
inc esp
cmp edx, dword [eax]
ja 0x123b35b
xor cl, bl
inc esi
mov eax, 0xd58416ad
sub al, 0xce
mov byte [edx + 0x15], bh
or eax, 0x308e8276
xchg esp, edx
sbb byte [eax], dh
dec ebp
fistp dword ds:[eax - 0x1c33fc82]
cmpsb byte [esi], byte es:[edi]
jl 0x123b42f
mov ss, word [eax + 0x551852d8]
hlt
hlt
add al, 0xd3
jmp 0xe93bfec1
pushal
mov al, byte [ecx]
push dword [esp + 8]
call fcn.01245264
not ch
bswap cx
mov ecx, edi
jmp 0x123e3f1
pushfd
jmp 0x219ebbc
push 0x3990238c
jmp 0x123b2e4

Function at 0x1f01f43
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0xb
movzx eax, cl
lea eax, [0x12433e8]
pushal
push 0x1ebbc321
mov word [esp], 0x1c2
mov dword [esp + 0x24], 0x1f01b81
jmp 0x1ef3248
Function at 0x7949ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
test ecx, ecx
jne 0x7949c5
mov esi, dword [0x870144]
jmp 0x7949c7
mov esi, ecx
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
push 1
mov dl, 1
mov eax, dword [0x743d50]
call fcn.00744cb4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x794ac8
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov ecx, 0xa0
mov edx, dword [ebp - 4]
call fcn.007942ec
push esi
mov eax, dword [ebx]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.007947d8
mov dword [ebx + 0x24], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00745778
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x743d50]
call fcn.00408c7c
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x10]
call fcn.007483f4
mov edx, eax
mov eax, dword [ebx + 0x20]
mov ecx, esi
call fcn.00748354
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 8]
call fcn.0074648c
test al, al
je 0x794a3d
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 0x14]
call fcn.0074651c
test al, al
je 0x794a3d
mov edx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp - 0xc]
call fcn.00747b94
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov byte [ebx + 0xc], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x794acf
mov eax, dword [ebp - 8]
call fcn.00408cac
mov eax, dword [ebp - 0xc]
call fcn.00408cac
mov eax, dword [ebp - 0x10]
call fcn.00408cac
mov eax, dword [ebp - 0x14]
call fcn.00408cac
ret
Function at 0x7b2128
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ad14
mov eax, dword [ebp - 8]
call fcn.0040ad14
xor eax, eax
push ebp
push 0x7b2289
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b680
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
mov eax, esi
call fcn.00407100
mov ebx, eax
push ebx
push esi
mov eax, dword [ebp - 0x18]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x7b2248
mov dword [ebp - 0x24], ebx
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x24]
call fcn.007b1f60
lea ecx, [ebp - 0x60]
movzx eax, word [ebp - 0x28]
mov edx, 4
call fcn.00426294
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x64]
movzx eax, word [ebp - 0x26]
mov edx, 4
call fcn.00426294
mov edx, dword [ebp - 0x64]
pop eax
call fcn.0040bdb8
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 0x10]
mov ecx, 0
call fcn.0040b770
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x7b22a4
push dword [ebp - 0x10]
push 0x7b22c4
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.0040b538
mov eax, dword [ebp - 0x68]
call fcn.0040b680
push eax
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x7b223e
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov ecx, 0
call fcn.0040b378
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.0040b0a4
jmp 0x7b2250
mov eax, dword [ebp - 0x14]
call fcn.0040ac44
jmp 0x7b2250
mov eax, dword [ebp - 0x14]
call fcn.0040ac44
mov edx, esi
mov eax, ebx
call fcn.0040711c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b2290
lea eax, [ebp - 0x68]
call fcn.0040ac44
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.0040ac80
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040acb0
ret

Function at 0x7b6cb4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x7b6d4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 0x18c]
mov eax, ebx
call fcn.006694e4
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.00425f34
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x7b6d68
call fcn.0040be10
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.0040bcb0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0069c8dc
mov eax, ebx
call fcn.006694d0
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x190]
mov ecx, dword [eax]
call dword [ecx + 0x88]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b6d55
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040ac80
lea eax, [ebp - 8]
call fcn.0040ac68
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x52927fbc
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x432a2255
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x405fd5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42275c], 0
jne 0x406010
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fe9
mov dword [ecx*4 + 0x422758], eax
inc ecx
cmp ecx, 0x100
jl 0x405fe4
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40603d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x422758]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40601e
not eax
pop ebp
ret 0xc

Function at 0x401032
Capabilities:
Encode data using xor

Disassembly:
pushal
cld
xor eax, eax
mov edi, esi
lodsb al, byte [esi]
mov edx, ecx
mov cl, ah
xor al, 0xc3
rol al, cl
sub al, 0x54
stosb byte es:[edi], al
inc ah
mov ecx, edx
loop 0x401038
popal
clc
ret
Function at 0x4c06fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
pushfd
call dword [0x10011c8]
push eax
call fcn.004c2d34
push eax
lea edx, [0xfefa5a6]
lea ecx, [0x19904a1a]
sub esp, 0x10
mov dword [esp], edx
push ecx
sub dword [esp + 4], 0xeef3e64
pop ebx
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
jmp fcn.004c0766

Function at 0x4c2b2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x20]
push ebx
movzx ebx, word [eax]
push esi
mov esi, dword [ebp + 0x10]
inc esi
and esi, 0xfffffffe
push edi
mov dword [ebp + 0x10], esi
jmp 0x4c2b64
push dword [ebp + 0x14]
movzx edi, ax
push edi
call fcn.004c2d2e
push eax
push edi
push dword [ebp + 8]
call fcn.004c2d1f
push eax
call fcn.004c2d10
inc esi
and esi, 0xfffffffe
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
jne 0x4c2b44
inc esi
and esi, 0xfffffffe
movzx ecx, word [esi]
inc esi
inc esi
xor ecx, ebx
cmp byte [ebp + 0x28], 0
jne 0x4c2ba0
cmp byte [ebp + 0x24], 0
jne 0x4c2ba0
cmp cx, ax
je 0x4c2bd5
inc esi
and esi, 0xfffffffe
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
jne 0x4c2b8d
jmp 0x4c2bd5
xor edi, edi
jmp 0x4c2bcf
mov eax, dword [ebp + 0x20]
movzx eax, word [eax + edi*2]
mov edx, dword [ebp + 0x18]
and eax, 0xfffffff0
add eax, edx
push eax
movzx eax, cx
add eax, dword [ebp + 8]
inc edi
push eax
and edi, 3
call fcn.004c2d01
inc esi
and esi, 0xfffffffe
movzx ecx, word [esi]
inc esi
inc esi
xor ecx, ebx
cmp cx, 0xffff
jne 0x4c2ba4
mov ecx, dword [ebp + 0x1c]
push dword [ebp + 0x20]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [esi + 7]
and eax, 0xfffffff8
mov edx, dword [eax]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
push ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.004c2cab
cmp byte [ebp + 0x24], 0
jne 0x4c2c12
cmp dword [ebp + 0x14], 0
jne 0x4c2c1c
cmp byte [ebp + 0x28], 0
je 0x4c2c9e
mov esi, dword [ebp + 0x10]
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
je 0x4c2c61
mov ecx, dword [ebp + 0x14]
neg ecx
mov dword [ebp + 0x24], ecx
push dword [ebp + 0x24]
movzx edi, ax
push edi
call fcn.004c2d2e
push eax
push edi
push dword [ebp + 8]
call fcn.004c2d1f
push eax
call fcn.004c2d10
inc esi
and esi, 0xfffffffe
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
jne 0x4c2c34
cmp byte [ebp + 0x28], 0
je 0x4c2c9e
xor edi, edi
jmp 0x4c2c8d
mov eax, dword [ebp + 0x20]
movzx eax, word [eax + edi*2]
mov edx, dword [ebp + 0x18]
and eax, 0xfffffff0
add eax, edx
neg eax
push eax
movzx eax, cx
add eax, dword [ebp + 8]
inc edi
push eax
and edi, 3
call fcn.004c2d01
inc esi
and esi, 0xfffffffe
movzx ecx, word [esi]
inc esi
xor ecx, ebx
inc esi
cmp cx, 0xffff
jne 0x4c2c6b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x24
Function at 0x4ea32d
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x53
rep lodsd eax, dword [esi]
imul eax, dword [ecx - 0x31], 0x513fe101
push edx
wait
push ds
sbb al, 0x11
mov byte [0x513f90d], al
das
jo 0x4ea2da
loop 0x4ea398
xchg esi, eax
xor bl, al
jg 0x4ea409
pop ebp
push esi
sub byte [eax + 0x1a], bh
invalid
fistp word [ebp + edx + 0x40649155]
inc ebx
salc
insb byte es:[edi], dx
mov ah, 0xb
fmul st(4), st(0)
xlatb
iretd

Function at 0x4ef15b
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
jp 0x4ef17e
xchg ebp, eax
mov es, word [edi + 0x15]
inc esp
add ebx, 0xffffffb8
adc ecx, dword [ebx]
invalid
xor dword [eax + 0x36], esp
adc esi, ecx
les ecx, [ebx - 0x280fe5bb]
pop ecx
xor eax, 0x6311bf27
retf
idiv byte [edx - 0x29]
mov ebp, 0x502ddeca
xor al, 0x84
push 0xffffffffffffff89
jns 0x4ef1e2
insb byte es:[edi], dx
stc
xchg esp, eax
jle 0x4ef16c
in al, dx
salc
cwde
push 0xcca7b4a2
cwde
clc
imul edi, esi, 0xc6c870bd
add ah, byte [ecx - 0x2b774f19]
fist word [ecx]
sbb al, byte [ebx + ebp + 0x5c45a408]
xor dword [ebx], esp
sbb eax, 0xead817b7
arpl word [edi - 0x64], dx
push esi
pop ss
xor byte [ecx], ch
cmp eax, 0xf2c60dbf
cmc
in eax, dx
xor edi, edi
out 0xa2, eax
mov byte [0x969aafbf], al
mov ebx, 0x979e872c
int3
jae 0x4ef199
cmp dl, ah
dec edx
xchg edi, eax
inc ebx
ror dword [ecx + ebx - 0x7778fa24], 1
inc ebx
xlatb
aaa
stosb byte es:[edi], al
mov esi, 0x9ad8c9bb
sub byte [esi - 0x2d], bl
inc esi
xlatb
dec ebp
lcall 0x6b40, 0xd008983e
inc ebp
invalid

Function at 0x4f2538
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x7423594b], eax
lodsb al, byte [esi]
and bh, dl
aaa
out dx, eax
das
in eax, 0x3d
cmp eax, 0xc6c3f6f4
xor eax, 0xa64b237d
mov byte [edx], ch
daa
dec ebp
pop edi
xor dh, byte es:[eax + edx*2]
pop edx
out 0xac, eax
arpl word [esi], sp
mov al, byte [0x5fa3137d]
xchg edx, eax
mov bl, dl
xor al, bh
fisttp word [eax + 0x4ebcc968]
dec di
mov ah, 0x66
fcomp dword [eax + ebp*8 - 0x32]
pop ecx
ja 0x4f2552
retf
Function at 0x4fd0e3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push ebx
call fcn.004fce2f
push 2
pop esi
cmp eax, esi
jne 0x4fd1d3
push edi
mov edi, dword [ebp + 8]
test byte [edi + 0x10], 8
jne 0x4fd1d2
push dword [ebp + 0x10]
push ebx
push edi
call fcn.004fd04c
cmp eax, esi
jne 0x4fd12b
mov dword [ebp - 4], 1
jmp 0x4fd1d2
cmp dword [0x10bd70c], 0
je 0x4fd1d2
cmp dword [ebx + 0x20], 0
jne 0x4fd1d2
mov eax, dword [edi + 0x60]
jmp 0x4fd18b
cmp ebx, eax
je 0x4fd189
cmp dword [eax + 0x20], esi
jne 0x4fd189
cmp dword [eax + 0x14], esi
jne 0x4fd16a
cmp dword [ebx + 0x14], esi
jne 0x4fd16a
mov ecx, dword [eax + 0x38]
cmp ecx, dword [ebx + 0x38]
jne 0x4fd16a
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [ebx + 0x3c]
je 0x4fd191
cmp dword [ebx + 0x18], esi
jne 0x4fd189
cmp dword [eax + 0x18], esi
jne 0x4fd189
push 4
pop ecx
lea edi, [eax + 0x40]
lea esi, [ebx + 0x40]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
mov edi, dword [ebp + 8]
push 2
pop esi
je 0x4fd19a
mov eax, dword [eax]
test eax, eax
jne 0x4fd147
jmp 0x4fd1a7
mov dword [ebx + 0x20], 1
jmp 0x4fd1a7
mov dword [ebx + 0x20], 2
mov eax, dword [eax + 0x50]
mov dword [ebx + 0x50], eax
cmp dword [ebx + 0x20], 0
jne 0x4fd1d2
test byte [edi + 0x13], 2
jne 0x4fd1cb
push dword [ebp + 0x18]
lea eax, [ebx + 0x78]
push dword [ebp + 0x14]
push eax
call fcn.004eb2e6
test eax, eax
je 0x4fd1cb
mov dword [ebp - 4], esi
jmp 0x4fd1d2
mov dword [ebx + 0x20], 1
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0x14