joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd0e1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jbe 0xd0e204
mov eax, 1
mov ebx, ecx
add ebx, eax
dec ebx
mov bl, byte [ebx]
mov edi, edx
add edi, eax
dec edi
xor byte [edi], bl
inc eax
dec esi
jne 0xd0e1f2
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0xd0e594
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0xd0e5b9
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x14]
mov eax, edi
call fcn.00d0e554
mov ax, word [esi + ebp*2 + 0x16]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x18]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1a]
lea eax, [edi + 6]
call fcn.00d0e554
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1c]
lea eax, [edi + 4]
call fcn.00d0e554
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x1e]
lea eax, [edi + 2]
call fcn.00d0e554
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0xd0e5d5
mov dx, word [esi + 0x74]
mov eax, edi
call fcn.00d0e554
mov ax, word [esi + 0x76]
add word [edi + 4], ax
mov ax, word [esi + 0x78]
add word [edi + 2], ax
mov dx, word [esi + 0x7a]
lea eax, [edi + 6]
call fcn.00d0e554
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xd0e724
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0xd0e749
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x7c]
mov eax, edi
call fcn.00d0e554
mov ax, word [esi + ebp*2 + 0x7e]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x80]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x82]
lea eax, [edi + 6]
call fcn.00d0e554
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x84]
lea eax, [edi + 4]
call fcn.00d0e554
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x86]
lea eax, [edi + 2]
call fcn.00d0e554
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0xd0e765
mov dx, word [esi + 0xdc]
mov eax, edi
call fcn.00d0e554
mov ax, word [esi + 0xde]
add word [edi + 4], ax
mov ax, word [esi + 0xe0]
add word [edi + 2], ax
mov dx, word [esi + 0xe2]
lea eax, [edi + 6]
call fcn.00d0e554
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xd1e85c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0xd1e90f
add edx, ebx
mov eax, edx
mov edi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x20]
add edx, ebx
mov dword [ebp - 4], edx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
cmp edx, 0xffff
jbe 0xd1e8f3
test edi, edi
jbe 0xd1e90f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00c67e44
test eax, eax
jne 0xd1e8e4
mov eax, dword [ebp - 8]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0xc]
mov esi, dword [eax]
test esi, esi
je 0xd1e90f
add ebx, esi
mov esi, ebx
jmp 0xd1e90f
add dword [ebp - 8], 2
add dword [ebp - 4], 4
dec edi
test edi, edi
ja 0xd1e8b9
jmp 0xd1e90f
mov edi, edx
sub edi, dword [eax + 0x10]
cmp edi, dword [eax + 0x14]
jae 0xd1e90f
mov eax, edi
shl eax, 2
add eax, dword [ebp - 0xc]
mov esi, dword [eax]
test esi, esi
je 0xd1e90f
add ebx, esi
mov esi, ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xd2f734
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0xd2f765
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2f74d
add dl, dl
jne 0xd2f770
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2f7c1
xor eax, eax
add dl, dl
jne 0xd2f77d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2f85e
add dl, dl
jne 0xd2f78c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2f797
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2f7a2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2f7ad
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd2f7b7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd2f75c
mov eax, 1
add dl, dl
jne 0xd2f7cf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2f7da
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2f7c6
sub eax, ebx
mov ebx, 1
jne 0xd2f80d
mov ecx, 1
add dl, dl
jne 0xd2f7f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd2f7fe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2f7ea
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2f75c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd2f824
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd2f82f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2f81b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2f75c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd2f87f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd2f75c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0xd2f9b8
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0xd2f9e9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2f9d1
add dl, dl
jne 0xd2f9f4
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2fa45
xor eax, eax
add dl, dl
jne 0xd2fa01
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2fae2
add dl, dl
jne 0xd2fa10
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2fa1b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2fa26
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2fa31
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd2fa3b
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd2f9e0
mov eax, 1
add dl, dl
jne 0xd2fa53
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2fa5e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2fa4a
sub eax, ebx
mov ebx, 1
jne 0xd2fa91
mov ecx, 1
add dl, dl
jne 0xd2fa77
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd2fa82
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2fa6e
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2f9e0
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd2faa8
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd2fab3
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2fa9f
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2f9e0
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd2fb03
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd2f9e0
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0xd2ff90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test edi, edi
jle 0xd30023
xor ebx, ebx
mov byte [ebp - 9], 0
lea eax, [ebp - 0x110]
mov ecx, 0x100
mov edx, dword [ebp + 8]
call fcn.00c651c0
dec edi
test edi, edi
jl 0xd30023
inc edi
mov dword [ebp - 0x10], edi
xor edx, edx
inc ebx
mov esi, ebx
and esi, 0xff
mov al, byte [ebp + esi - 0x110]
add byte [ebp - 9], al
xor ecx, ecx
mov cl, byte [ebp - 9]
mov cl, byte [ebp + ecx - 0x110]
mov byte [ebp + esi - 0x110], cl
xor ecx, ecx
mov cl, byte [ebp - 9]
mov byte [ebp + ecx - 0x110], al
add al, byte [ebp + esi - 0x110]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
and eax, 0xff
xor cl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + edx], cl
inc edx
dec dword [ebp - 0x10]
jne 0xd2ffcc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xd309c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0xd309d7
add esp, 0xfffffff0
call fcn.00c60ef0
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00c60b5c
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0xd309fd
cmp dword [esi + 0x58], 0x40
jb 0xd30be3
jmp 0xd30a03
jl 0xd30be3
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.00c651c8
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.00d302c8
cmp word [ebx + 0xc], 0x5a4d
jne 0xd30be3
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0xd30be3
cmp ecx, 0x10000
jge 0xd30be3
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0xd30a5e
cmp eax, dword [esi + 0x58]
ja 0xd30be3
jmp 0xd30a64
jg 0xd30be3
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.00c651c8
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.00d302c8
cmp dword [ebx + 0x4c], 0x4550
jne 0xd30be3
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.00c651c8
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.00d302c8
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0xd30b1b
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0xd30adf
cmp eax, dword [esi + 0x58]
ja 0xd30b6c
jmp 0xd30ae5
jg 0xd30b6c
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.00c651c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.00d302c8
mov byte [ebx + 4], 1
jmp 0xd30b6c
cmp ax, 0x14c
jne 0xd30b6c
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0xd30b3c
cmp eax, dword [esi + 0x58]
ja 0xd30b6c
jmp 0xd30b3e
jg 0xd30b6c
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.00c651c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.00d302c8
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0xd30be3
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0xd30b9d
cmp eax, dword [esi + 0x58]
ja 0xd30be3
jmp 0xd30b9f
jg 0xd30be3
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0xaab550]
call fcn.00c6319c
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.00d302c8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0xd30bfa
call fcn.00c60f48
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0xd318e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xaad19f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0xd31991
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0xd3197a
test esi, esi
jbe 0xd31991
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.00c67e44
test eax, eax
jne 0xd3196c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0xd31991
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0xd31949
jmp 0xd31991
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0xd31991
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xaad1a6
ret
Function at 0xd323c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0xaadd6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00c62180
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0xd323fb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0xd32414
lea eax, [ebp - 0x10]
mov edx, dword [0xb0dc48]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00c621e0
jmp 0xd32427
lea eax, [ebp - 0x10]
mov edx, dword [0xb0dc48]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00c621e0
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0xd32433
adc edx, 0
mov edx, dword [edx*4 + 0xafb8ac]
call fcn.00c623ec
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00c623d0
push eax
call fcn.00c6434c
mov esi, eax
cmp esi, 0xffffffff
je 0xd32541
mov eax, 0x40
call fcn.00c5ff14
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00c6475c
test eax, eax
je 0xd32534
mov eax, edi
cmp word [eax], 0x5a4d
jne 0xd32534
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00c647cc
mov eax, edi
call fcn.00c5ff34
mov eax, 0x18
call fcn.00c5ff14
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00c6475c
test eax, eax
je 0xd32534
mov eax, edi
cmp dword [eax], 0x4550
jne 0xd32534
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0xd32534
cmp dx, 0x150
ja 0xd32534
mov eax, edi
call fcn.00c5ff34
mov eax, 0xe0
call fcn.00c5ff14
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00c6475c
test eax, eax
je 0xd32534
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0xd32534
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00c621bc
mov eax, edi
call fcn.00c5ff34
push esi
call fcn.00c64304
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00c624f8
jne 0xd32559
inc ebx
cmp ebx, 0x19
jne 0xd323ed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xaadd76
lea eax, [ebp - 0x10]
call fcn.00c62180
ret
Function at 0xd3287c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
xor ebx, ebx
push 0
push 0
push 0
push edi
call fcn.00c647cc
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call fcn.00c6475c
test eax, eax
je 0xd32919
cmp word [esi], 0x5a4d
jne 0xd32919
push 0
push 0
mov eax, dword [esi + 0x3c]
push eax
push edi
call fcn.00c647cc
push 0
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00c6475c
test eax, eax
je 0xd32919
cmp dword [ebp - 0x1c], 0x4550
jne 0xd32919
lea edx, [ebp - 0x18]
mov ecx, 0x14
mov eax, dword [ebp + 0xc]
call fcn.00c651c0
mov ax, word [ebp - 0x18]
cmp ax, 0x14c
jb 0xd32919
cmp ax, 0x150
ja 0xd32919
push 0
lea eax, [ebp - 4]
push eax
push 0xe0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.00c6475c
test eax, eax
je 0xd32919
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x12ae51c
Capabilities:
Parse pe header

Disassembly:
bswap ecx
pop eax
pop eax
pop ecx
jne fcn.01cc30f9
mov edx, 0x374501
mov eax, dword [esi + edx*2 - 0x6e8a02]
mov ecx, 0xe23d0e15
call fcn.013a881a
mov ecx, dword [edi]
mov edx, 0x6a277f2a
movsx eax, dx
mov dl, byte [edi + eax*8 - 0x3f94c]
rol ax, 0xd
setb al
lea edi, [eax + edi - 0x4efb]
xor ax, ax
mov byte ss:[ecx + eax], dl
jp 0x1a67a49
movsx edx, al
lea esi, [esi + eax - 4]
inc al
cbw
sar edx, 0x27
mov eax, dword [esi + eax*2 - 2]
lea edx, [edx + edx - 0x385ceb50]
adc edx, edx
or dl, dl
xor eax, ebx
push edx
push edx
ror eax, 2
bswap eax
xor eax, 0xffae4bb0
movzx ecx, dx
neg word [esp + ecx - 0x2960]
dec cx
dec eax
jmp 0x1c936fe

Function at 0x12ae569
Capabilities:
Parse pe header

Disassembly:
and cx, ax
mov dword [esp + edx*8 - 0x78c4907c], edx
pop edx
mov word [edi], cx
shr byte [esp + 3], 0xa1
sbb ebp, 3
mov edx, 0x3c11b486
add dword [esp + edx*2 - 0x7823690c], edx
movsx eax, byte [esp + edx*2 - 0x7823690c]
mov edx, dword [ebp + edx - 0x3c11b486]
xor edx, ebx
lea ecx, [eax*2 + 0x25a0f421]
shr dword [esp + ecx - 0x25a0f34d], 0xdb
jns 0x19bbf6e
bswap edx
add cl, ch
sal dword [esp + ecx - 0x25a0f340], 0xd2
inc edx
ror edx, 2
inc edx
xadd eax, ecx
xor ebx, edx
dec cl
add esi, edx
add word [esp + eax*2 - 0x4b41e5aa], ax
ror dword [esp + eax - 0x25a0f2d6], 0x91
mov dword [esp + eax*2 - 0x4b41e5ac], esi
ret

Function at 0x12c2038
Capabilities:
Encode data using xor

Disassembly:
sub ebp, 4
mov dword [esp], 0x819ce70f
pop edx
mov eax, dword [ebp]
xor eax, ebx
mov ecx, 0x10ade11f
bswap eax
bts dx, cx
dec ecx
bts edx, 0xb3
xor eax, 0xe9309f1b
bswap eax
call fcn.01a32e7f
Function at 0x12c46ad
Capabilities:
Encode data using xor

Disassembly:
xor eax, ebx
shl edx, 0xd1
mov dword [esp], edx
movzx ecx, byte [esp]
adc eax, ecx
not eax
rol word [esp + ecx*2 + 2], 0xe6
btc edx, 0x94
xor eax, 0xe18def22
xadd dword [esp + ecx*2], ecx
add ecx, 0x299d533e
btc cx, 0x30
neg eax
sub ecx, ecx
shl dl, 0xa7
rol dword [esp + ecx*2], 0x85
xor ebx, eax
bts dx, dx
jae 0x1a6cd0e
sbb al, byte [esi - 0x4edbff86]
and al, 0xb1
scasd eax, dword es:[edi]
mov dl, byte [edx + 0xa]
rcr dword [0x6c7d0797], cl
jecxz 0x12c4723
dec esp
pop ss
and al, byte [esi + eax*4 + 0x72ba911a]
mov edi, 0xcc6f0a07
xchg ecx, eax
sbb ch, ah
iretd
loope 0x12c46f0
retf
bound eax, qword [eax]
mov byte [edx - 0x5e141893], bh
add eax, 0x435ab235
mov al, 0x65
clc
test dword [esi + ecx*2 - 0x4573f32d], ebp
sar byte [ebx - 0x6a], 1
mov dl, cl
pop ss
add byte [eax + 0x47], 0xa7
popfd
xor ebx, dword [ecx]
mov byte [eax + 0x3d], cl
arpl dx, cx
xor edi, dword [ebp + 0xc]
stosd dword es:[edi], eax
dec esp
pop edx
push 0xfffffffffffffff3
mul dword [ecx]
xor edi, ebp
xor eax, 0xca7cbac1
or eax, 0x45b21171
in al, 0x9c
mov dword [0xd1ba4c13], eax
sbb edi, dword [ebx + 0x71]
aas
sbb al, 0x1c
pop ecx
mov esi, 0x3c33be9c
mov edi, dword [esi - 0x1f489fb0]
and byte [esi - 0x3a], bh
fisubr word [eax - 1]
inc ecx
pop esp
push ecx
dec ecx
inc ecx
push 0xffffffffffffffdf
cmc
inc ecx
les edx, [eax]
fcmovnb st(0), st(3)
rcr esp, 0x6b
cdq
add ecx, 0xffffffbd
mov dword [edx], edi
stc
in al, dx
jle 0x12c4724
ljmp 0x81b0:0xa1828197
adc esi, eax
mov eax, dword [ebp + ecx*2]
ror cl, 0x61
adc cx, word ss:[eax + ecx]
add ebp, 2
not edx
ror edx, 0x1f
neg dl
mov word [ebp + edx - 0x5d3bff04], cx
mov dword [esp + edx - 0x5d3bff04], esi
ret

Function at 0x12dcb15
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [eax + ecx*8 - 0x26c03c00], dl
lea edx, [ecx + ecx*2 - 0x4d7f163]
shl ecx, 0x3e
mov eax, dword [esi + ecx*4]
jne 0x1ce7543
btc cx, dx
mov dword [esp + ecx - 0x2000], 0xc19d3e1e
lea esi, [esi + ecx - 0x1ffc]
shr cl, 0x86
xor eax, ebx
neg cl
shr cx, 0xa7
bswap eax
dec dword [esp + ecx*2 - 0x80]
lea eax, [eax + ecx*4 + 0x2584f2b9]
bts edx, edx
inc word [esp + ecx*2 - 0x7f]
bswap eax
xadd cl, dh
or cx, 0x8080
inc eax
or dl, byte [esp + ecx - 0x80e2]
xor ebx, eax
jmp 0x1aec07c
call fcn.01a5d310
mov edx, 0x53b57d8b
mov ecx, edx
mov edx, dword [esi + ecx - 0x53b57d8b]
shr ecx, cl
xor cl, 0x88
mov cx, word [ecx + edx - 0xa7627]
mov edx, 0xc4b0790a
adc esi, 2
lea eax, [edx + edx*8 - 0x65628243]
mov word [esi], cx
push edx
rol dl, 0x47
lea edx, [edx - 0x1f25fc4]
sbb ebp, 3
mov ecx, dword [ebp]
xor ecx, ebx
jmp 0x1b42477

Function at 0x12e4f46
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x45398f9d
xor eax, esi
inc ecx
xor eax, 0xfc9b801b
push 0x6833228f
dec edx
push 0x23b563b5
call fcn.012e1d5d
mov eax, 0x2fa0dbac
lea edx, [eax + 0x3c974a9a]
mov eax, dword [edi + eax*2 - 0x5f41b758]
imul edx, edx
adc edi, 3
shl edx, 0x30
push edx
or dx, 0x30bd
xor eax, ebx
not eax
bswap eax
call fcn.0131fd1a