joyce8/EMBER2024-capa huggingface dataset:
Function at 0x586536
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and byte [ebp - 8], 0
push ebx
push esi
push edi
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xe], 0x4d
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0xa], 0x78
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 9], 0x41
call fcn.00582f67
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [fcn.006f1004]
mov edi, eax
test edi, edi
je 0x5865dd
call fcn.00582fcc
push 5
xor edx, edx
pop ecx
div ecx
mov esi, edx
test esi, esi
jle 0x5865b4
mov ebx, esi
call fcn.00582fcc
xor edx, edx
mov ecx, 0x18cc
div ecx
mov dword [ebp - 4], edx
push dword [ebp - 4]
dec ebx
jne 0x58659d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test esi, esi
mov edi, eax
jle 0x5865cb
pop dword [ebp - 4]
dec esi
jne 0x5865c5
push 0xd
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00582f38
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5865e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 8], 0
push ebx
push esi
push edi
mov byte [ebp - 0x24], 0x49
mov byte [ebp - 0x23], 0x6e
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x7a
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x53
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x63
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x72
call fcn.005866d0
lea eax, [ebp - 0x24]
push eax
push dword [0x561eec]
call dword [fcn.006f1004]
mov esi, eax
test esi, esi
je 0x5866cb
call fcn.00582fcc
push 5
xor edx, edx
pop ecx
div ecx
mov edi, edx
test edi, edi
jle 0x5866a5
mov ebx, edi
call fcn.00582fcc
xor edx, edx
mov ecx, 0x18cc
div ecx
mov dword [ebp - 4], edx
push dword [ebp - 4]
dec ebx
jne 0x58668e
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test edi, edi
mov esi, eax
jle 0x5866b9
pop dword [ebp - 4]
dec edi
jne 0x5866b3
push 0x1d
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00582f38
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x586725
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 0xb], 0
push ebx
push esi
push edi
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x6c
call fcn.005866d0
lea eax, [ebp - 0x24]
push eax
push dword [0x561eec]
call dword [fcn.006f1004]
mov esi, eax
test esi, esi
je 0x586808
call fcn.00582fcc
push 5
xor edx, edx
pop ecx
div ecx
mov edi, edx
test edi, edi
jle 0x5867dc
mov ebx, edi
call fcn.00582fcc
xor edx, edx
mov ecx, 0x18cc
div ecx
mov dword [ebp - 4], edx
push dword [ebp - 4]
dec ebx
jne 0x5867c5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test edi, edi
mov esi, eax
jle 0x5867f6
pop dword [ebp - 4]
dec edi
jne 0x5867f0
push 0x1d
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00582f38
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x58680d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
cmp dword [0x561f04], edi
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x586889
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.005854b4
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x561f04], eax
jne 0x586889
mov eax, 0x7532
jmp 0x586940
cmp dword [0x561ef4], ebx
jne 0x5868e6
xor esi, esi
push dword [ebp + 0x10]
push 0x561f04
push dword [ebp + 8]
call fcn.005869dc
add esp, 0xc
cmp eax, ebx
je 0x5868c2
cmp eax, 0x6688
jne 0x5868ce
push 0x1f4
call fcn.00586945
inc esi
pop ecx
cmp esi, 3
jl 0x586893
cmp esi, 3
jne 0x5868e6
mov esi, 0x4f1a
jmp 0x5868d0
mov esi, eax
push dword [0x561f04]
call fcn.00585651
pop ecx
mov dword [0x561f04], edi
mov eax, esi
jmp 0x586940
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.00583094
lea eax, [ebp - 4]
push ebx
push eax
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push dword [0x561f04]
call fcn.00585579
add esp, 0x28
test eax, eax
je 0x586929
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00585928
pop ecx
pop ecx
jmp 0x586940
push dword [0x561f04]
call fcn.00585651
pop ecx
mov dword [0x561f04], edi
call fcn.00585704
pop edi
pop esi
pop ebx
leave
ret

Function at 0x586d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x561f04]
push ebx
xor ebx, ebx
cmp eax, 1
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x586dc6
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.005854b4
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x561f04], eax
jne 0x586dc6
mov eax, 0x7532
jmp 0x586e14
lea ecx, [ebp - 4]
push ebx
push ecx
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push eax
call fcn.00585579
add esp, 0x20
test eax, eax
je 0x586df9
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00585928
pop ecx
pop ecx
jmp 0x586e14
push dword [0x561f04]
call fcn.00585651
pop ecx
mov dword [0x561f04], 1
call fcn.00585704
pop ebx
leave
ret
Function at 0x587d42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0x14
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00582f38
and byte [ebp - 0x12], 0
add esp, 0xc
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x16], 0x46
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x19], 0x62
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x13], 0x65
call fcn.00582f67
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [fcn.006f1004]
mov edi, eax
test edi, edi
je 0x587ded
call fcn.00582fcc
push 5
xor edx, edx
pop ecx
div ecx
mov esi, edx
test esi, esi
jle 0x587dca
mov dword [ebp - 4], esi
call fcn.00582fcc
xor edx, edx
mov ecx, 0x18cc
div ecx
mov dword [ebp - 8], edx
push dword [ebp - 8]
dec dword [ebp - 4]
jne 0x587db1
push dword [ebp + 8]
call edi
test esi, esi
mov edi, eax
jle 0x587ddb
pop dword [ebp - 8]
dec esi
jne 0x587dd5
push 0x14
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00582f38
add esp, 0xc
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x587df1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0x14
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00582f38
and byte [ebp - 0x11], 0
add esp, 0xc
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x16], 0x41
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x19], 0x62
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x13], 0x6f
call fcn.00582f67
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [fcn.006f1004]
mov edi, eax
test edi, edi
je 0x587ea3
call fcn.00582fcc
push 5
xor edx, edx
pop ecx
div ecx
mov esi, edx
test esi, esi
jle 0x587e7d
mov dword [ebp - 4], esi
call fcn.00582fcc
xor edx, edx
mov ecx, 0x18cc
div ecx
mov dword [ebp - 8], edx
push dword [ebp - 8]
dec dword [ebp - 4]
jne 0x587e64
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test esi, esi
mov edi, eax
jle 0x587e91
pop dword [ebp - 8]
dec esi
jne 0x587e8b
push 0x14
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00582f38
add esp, 0xc
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x587ea7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 8], 0
push ebx
push esi
push edi
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x16], 0x44
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x10], 0x49
mov byte [ebp - 0x1d], 0x44
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0xc], 0x4c
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x17], 0x79
mov byte [ebp - 9], 0x74
call fcn.00587f95
test eax, eax
je 0x587f3e
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [fcn.006f1004]
mov edi, eax
test edi, edi
jne 0x587f42
xor eax, eax
jmp 0x587f90
call fcn.00582fcc
push 5
xor edx, edx
pop ecx
div ecx
mov esi, edx
test esi, esi
jle 0x587f6d
mov ebx, esi
call fcn.00582fcc
xor edx, edx
mov ecx, 0x18cc
div ecx
mov dword [ebp - 4], edx
push dword [ebp - 4]
dec ebx
jne 0x587f56
push dword [ebp + 8]
call edi
test esi, esi
mov edi, eax
jle 0x587f7e
pop dword [ebp - 4]
dec esi
jne 0x587f78
push 0x1d
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00582f38
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x587f95
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00582f38
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x561ee4], 1
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 9], 0x6c
jne 0x587ff7
lea eax, [ebp - 0x14]
push eax
call dword [fcn.006f1024]
mov dword [0x561ee4], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00582f38
mov eax, dword [0x561ee4]
add esp, 0xc
leave
ret
Function at 0x58800e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 5], 0
push ebx
push esi
push edi
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0x63
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 7], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0x13], 0x76
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x19], 0x45
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 9], 0x61
call fcn.00587f95
test eax, eax
je 0x5880a1
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [fcn.006f1004]
mov edi, eax
test edi, edi
jne 0x5880a5
xor eax, eax
jmp 0x5880ff
call fcn.00582fcc
push 5
xor edx, edx
pop ecx
div ecx
mov esi, edx
test esi, esi
jle 0x5880d0
mov ebx, esi
call fcn.00582fcc
xor edx, edx
mov ecx, 0x18cc
div ecx
mov dword [ebp - 4], edx
push dword [ebp - 4]
dec ebx
jne 0x5880b9
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test esi, esi
mov edi, eax
jle 0x5880ed
pop dword [ebp - 4]
dec esi
jne 0x5880e7
push 0x1c
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00582f38
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x588104
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 8], 0
push ebx
push esi
push edi
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x15], 0x47
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 9], 0x41
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0xb], 0x76
call fcn.00587f95
test eax, eax
je 0x58817b
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [fcn.006f1004]
mov edi, eax
test edi, edi
jne 0x58817f
xor eax, eax
jmp 0x5881d6
call fcn.00582fcc
push 5
xor edx, edx
pop ecx
div ecx
mov esi, edx
test esi, esi
jle 0x5881aa
mov ebx, esi
call fcn.00582fcc
xor edx, edx
mov ecx, 0x18cc
div ecx
mov dword [ebp - 4], edx
push dword [ebp - 4]
dec ebx
jne 0x588193
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test esi, esi
mov edi, eax
jle 0x5881c4
pop dword [ebp - 4]
dec esi
jne 0x5881be
push 0x15
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00582f38
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x58827e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and byte [ebp - 8], 0
push ebx
push esi
push edi
mov byte [ebp - 0x28], 0x53
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0x25], 0x75
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0x24], 0x70
mov byte [ebp - 0x18], 0x49
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0x23], 0x44
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x21], 0x47
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 9], 0x41
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x1f], 0x74
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x1e], 0x44
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x11], 0x63
call fcn.00587f95
test eax, eax
je 0x588325
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [fcn.006f1004]
mov edi, eax
test edi, edi
jne 0x588329
xor eax, eax
jmp 0x588386
call fcn.00582fcc
push 5
xor edx, edx
pop ecx
div ecx
mov esi, edx
test esi, esi
jle 0x588354
mov ebx, esi
call fcn.00582fcc
xor edx, edx
mov ecx, 0x18cc
div ecx
mov dword [ebp - 4], edx
push dword [ebp - 4]
dec ebx
jne 0x58833d
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test esi, esi
mov edi, eax
jle 0x588374
pop dword [ebp - 4]
dec esi
jne 0x58836e
push 0x21
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.00582f38
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x59396f
Capabilities:
Encode data using xor

Disassembly:
pop esp
loope 0x593960
not dword [edx + 0x26]
or ch, byte [ebp + 0x5adb44b0]
sbb eax, 0x779d4599
imul edx, ebp, 0x55
aad 0x55
cmpsd dword [esi], dword es:[edi]
or edx, dword [edx + 0x3f10b6e3]
insd dword es:[edi], dx
aad 0x48
mov ah, 0xac
xchg ebp, eax
mov byte [edx - 0x4b], bl
loop 0x5939a2
call 0xf234e2a4
std
and dword [esi], esi
mov al, 0x34
inc edx
mov eax, 0xd7f63749
xor ecx, dword [edx + edi*8]
in al, 0x81
ja 0x59394e
xchg esi, eax
cld
xchg edx, eax
sahf
mov esp, 0x17c55395
cmp bl, al
scasb al, byte es:[edi]
daa
lodsb al, byte [esi]
cmp byte [ebp + 0x5bddb045], al
pop es
inc esp
and al, 0x89
sub eax, dword [edx - 0x69]
mov dword [ebx], ebp
inc edx
xchg edi, eax
mov bh, byte [ebx]
pushfd
jo 0x593a21
add ecx, dword [esi - 0x5e]
aas
inc esi
mov ebx, 0xaa023d49
and eax, 0xbf1cec8e
mov gs, esp
sbb al, 0xbf
push 0xc021dc9b
xor dword [edx], ebx
cmp dl, byte [esi + 0x4c24c9d3]
jle 0x593979
mov esp, 0x46020974
mov eax, 0x6cf66772
insb byte es:[edi], dx
mov ah, dh
cwde
pop ebx
add al, 0xfc
dec eax
sub al, 0xe7
adc al, 0x78
js 0x5939b6
and eax, 0x7683509b
mov edx, 0xb1d17272
sti
outsb dx, byte [esi]
inc esp
sub ecx, dword [ebp - 0x28]
pushfd
mov al, 0xaa
or al, 0x11
xor al, 0x46
inc esi
in al, dx
ret 0xf9d2
sub eax, 0x8b6fa275
retf 0x7efa
cli
jle 0x593a51
dec ebp
sbb al, 0x10
add cl, 0xbc
lds ecx, [ecx]
jne 0x593a1b
fstp xword [eax]
jne 0x593a66
call 0x26e6aab5
mov bl, 0xf8
jecxz 0x5939d2
adc al, 0x4e
cmp dword [ebx], ebx
lodsd eax, dword [esi]
jne 0x593a1b
inc ecx
jge 0x593aa3
adc eax, dword [eax - 0x5d]
scasb al, byte es:[edi]
adc al, 0xe3
mov bl, 0x96
test byte [ebp - 0x30], ah
invalid
ja 0x5939f7
cmc
xlatb
jmp [esi + ebp*4 + 0x6ea7870a]
push es
jle 0x593ad2
fsub qword [ebx - 0x78b488ea]
xlatb
mov ch, 0xf3
inc edx
mov dword [ecx - 0x78], ebx
invalid
out dx, eax
test al, 0xe2
in al, dx
adc esi, edi
insd dword es:[edi], dx
sbb ebx, dword [esp + edi*2 + 5]
push edi
sbb byte [edi + 0x7e], bl
out dx, eax
pop edi
jle 0x593a95
lcall 0x27d3, 0xc6107744
mov ebp, 0x275168dd
push edi
mov al, byte [0xe3977e8d]
stosb byte es:[edi], al
xchg esp, eax
jns 0x593ad0
cld
cmp al, 0x41
in eax, dx
xchg esp, eax
scasb al, byte es:[edi]
test dword [edx - 0x70], ecx
cwde
lahf
cmp eax, 0xea4de49c
and eax, 0x4c69c744
dec esp
rol dword [0xfe8513c0], 1
add eax, 0xfe8513c0
dec esp
mov al, byte [0x961d4cdc]
mov ds, word [esi + 0x50e1183]
jl 0x593ac6
and ebp, 0xffffffb5
xor al, 0xd6
pushal
xor byte [ecx - 0x53cbdba4], 0x80
jnp 0x593b6b
dec ebx
or al, 0x3b
stosd dword es:[edi], eax
cmc
and dword [edx - 0x6b], edi
pop ds
stosb byte es:[edi], al
xchg ebx, eax
lodsd eax, dword [esi]
jmp 0x90318da8
test al, 0xb3
in eax, dx
lcall 0xb40b, 0x7695c48
insd dword es:[edi], dx
invalid
Function at 0x1087f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1087f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1087f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087f06a
add dl, dl
jne 0x1087f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087f0dc
xor eax, eax
add dl, dl
jne 0x1087f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087f17d
add dl, dl
jne 0x1087f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1087f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1087f075
mov eax, 1
add dl, dl
jne 0x1087f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1087f0e1
sub eax, ebx
mov ebx, 1
jne 0x1087f128
mov ecx, 1
add dl, dl
jne 0x1087f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1087f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1087f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1087f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1087f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1087f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1087f136
cmp eax, 0x7d00
jae 0x1087f16d
cmp eax, 0x500
jb 0x1087f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1087f075
cmp eax, 0x7f
ja 0x1087f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1087f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1087f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1087f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401919
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401954
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401950
lea ebx, [ebx]
cmp esi, edx
jae 0x401954
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x401940
cmp esi, edx
jb 0x40195b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret