joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaa9960
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x118
mov eax, dword [esp + 0x120]
push ebx
mov ebx, dword [eax]
push ebp
mov ebp, dword [esp + 0x12c]
push esi
push edi
push 0x16
call fcn.00aa8070
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
mov byte [esp + 0x10], cl
je 0xaa99aa
lea esi, [esp + 0x10]
sub esi, eax
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
test cl, cl
mov byte [esi + eax], dl
jne 0xaa9996
mov byte [esp + edi + 0x10], 0
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xaa99c4
mov al, byte [esp + 0x24]
mov ebp, dword [ebx + 0x8c]
xor edi, edi
test al, al
lea esi, [esp + 0x24]
je 0xaa99ff
xor eax, eax
mov al, byte [esi]
push eax
call ebp
test eax, eax
je 0xaa99f2
add esi, 2
jmp 0xaa99fa
cmp byte [esi], 0x5c
jne 0xaa99f9
mov edi, esi
inc esi
cmp byte [esi], 0
jne 0xaa99e2
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9a06
sub eax, edx
lea ecx, [esp + eax + 0x23]
cmp edi, ecx
je 0xaa9a2e
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9a20
sub eax, edx
mov byte [esp + eax + 0x24], 0x5c
mov eax, dword [esp + 0x138]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9a37
lea edi, [esp + 0x24]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xaa9a45
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x24]
mov ebp, dword [ebx + 0x8c]
xor edi, edi
test al, al
lea esi, [esp + 0x24]
je 0xaa9a8d
nop
xor edx, edx
mov dl, byte [esi]
push edx
call ebp
test eax, eax
je 0xaa9a80
add esi, 2
jmp 0xaa9a88
cmp byte [esi], 0x5c
jne 0xaa9a87
mov edi, esi
inc esi
cmp byte [esi], 0
jne 0xaa9a70
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9a94
sub eax, edx
lea eax, [esp + eax + 0x23]
cmp edi, eax
je 0xaa9abe
lea eax, [esp + 0x24]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9ab0
sub eax, edx
mov byte [esp + eax + 0x24], 0x5c
lea eax, [esp + 0x10]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9ac4
lea edi, [esp + 0x24]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xaa9ad2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x10000000
push 2
push 0
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0xc0000000
lea ecx, [esp + 0x3c]
push ecx
call dword [ebx + 0x10]
cmp eax, 0xffffffff
mov edx, dword [esp + 0x12c]
mov dword [edx + 0x2c], eax
jne 0xaa9b38
lea eax, [esp + 0x24]
push eax
call dword [ebx + 0x78]
mov ecx, dword [esp + 0x134]
push eax
push ecx
call fcn.00aa90d0
add esp, 0xc
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x118
ret
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0x118
ret
Function at 0xaaabe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov ebx, dword [ebp]
push esi
push edi
push 0x33
xor esi, esi
call fcn.00aa8070
mov dl, byte [eax]
mov byte [esp + 0x14], dl
mov dl, byte [eax]
add esp, 4
xor ecx, ecx
test dl, dl
je 0xaaac23
lea edi, [esp + 0x10]
sub edi, eax
mov edi, edi
mov dl, byte [eax + 1]
inc ecx
inc eax
dec dl
xor dl, byte [edi + eax - 1]
mov byte [edi + eax], dl
cmp byte [eax], 0
jne 0xaaac10
lea eax, [esp + 0x10]
push eax
push 0
push 0
mov byte [esp + ecx + 0x1c], 0
call dword [ebx + 0x50]
mov edi, eax
test edi, edi
jne 0xaaac52
call dword [ebx + 0x78]
push eax
push ebp
call fcn.00aa9590
add esp, 8
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x14
ret
push 0xffffffffffffffff
push edi
call dword [ebx + 0x74]
test eax, eax
je 0xaaac81
cmp eax, 0xffffffff
jne 0xaaacca
call dword [ebx + 0x78]
push eax
push ebp
call fcn.00aa9590
add esp, 8
push edi
call dword [ebx + 0x60]
push edi
call dword [ebx + 0x1c]
pop edi
mov ax, si
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
mov edx, dword [esp + 0x3c]
mov eax, ebp
call fcn.00aaaad0
add esp, 0x14
mov esi, eax
cmp si, 1
jne 0xaaacca
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push ebp
push edx
call fcn.00aa9b50
add esp, 0x10
mov esi, eax
push edi
call dword [ebx + 0x60]
push edi
call dword [ebx + 0x1c]
pop edi
mov ax, si
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x423060
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
or ebp, 0xffffffff
jmp 0x423082
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x423089
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x423078
mov eax, 1
add ebx, ebx
jne 0x42309b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x423090
jne 0x4230ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423090
xor ecx, ecx
sub eax, 3
jb 0x4230c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x423132
mov ebp, eax
add ebx, ebx
jne 0x4230cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4230d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4230fc
inc ecx
add ebx, ebx
jne 0x4230e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4230dd
jne 0x4230f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4230dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42311c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42310d
jmp 0x42307e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42311c
add edi, ecx
jmp 0x42307e
pop esi
mov edi, esi
mov ecx, 0x810
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42313a
cmp byte [edi], 0xd
jne 0x42313a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42313f
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x4231b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x24b94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x24c48]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42316c
mov ecx, edi
jns 0x42319b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x24c4c]
or eax, eax
je 0x4231b1
mov dword [ebx], eax
add ebx, 4
jmp 0x423189
call dword [esi + 0x24c50]
popal
jmp section.UPX0
Function at 0x10c2c300
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058967
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10087664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [edi], 0x100684e4
mov dword [edi + 0x10], 0x100684ec
mov dword [edi + 0x70], 0x1005b7b4
lea esi, [edi + 0x18]
push esi
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x10], 1
call fcn.10c2d030
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], 0x100684e0
mov ecx, esi
call fcn.10c2d6a0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], 0x1005b83c
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x10b7f6c8]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10c2d2b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100580d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10087664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x10c2d3d1
cmp byte [edi + 0x49], bl
je 0x10c2d3d1
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x10c2d3c5
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10c2d325
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x10c2d33d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x10c2d366
dec eax
je 0x10c2d36a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x10c2d3c0
jmp 0x10c2d3cc
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x10c2d37a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x10c2d3a3
cmp ebx, 0x10
jae 0x10c2d389
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.10c53ef6
add esp, 0x10
cmp esi, eax
jne 0x10c2d3bd
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x10c2d3c9
test esi, esi
jne 0x10c2d331
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10c2cf40
jmp 0x10c2d32b
lea ecx, [ebp - 0x2c]
call fcn.10c1bb70
xor al, al
jmp 0x10c2d3d3
lea ecx, [ebp - 0x2c]
call fcn.10c1bb70
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10c5164b
mov esp, ebp
pop ebp
ret
Function at 0x10c2d6a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057c7b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10087664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x1005b7fc
call fcn.10c51063
push 4
mov dword [ebp - 4], 0
call fcn.10c51966
mov edi, eax
add esp, 4
test edi, edi
je 0x10c2d720
call fcn.10c50f3b
mov dword [edi], eax
call fcn.10c50cfa
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.10c51024
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10c2d716
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.10c5104c
jmp 0x10c2d722
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10c39b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x10087664]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
push 0x206
xor esi, esi
lea eax, [esp + 0x16]
push esi
push eax
call fcn.10c58170
call 0x117acf52
jnp 0x10c39ae9
les ecx, [ecx*4 - 0x44efdbb4]
xor dword [eax], eax
xor eax, dword [eax]
push ecx
mov dword [esp + 0x14], 0x4c0041
mov dword [esp + 0x18], 0x320049
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x44002e
mov dword [esp + 0x24], 0x4c004c
mov dword [esp + 0x28], esi
call edi
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x41005c
mov dword [esp + 0x24], 0x49004c
mov dword [esp + 0x28], 0x310032
mov dword [esp + 0x2c], 0x2e0033
mov dword [esp + 0x30], 0x6c0064
mov dword [esp + 0x34], 0x6c
mov dword [esp + 0x38], esi
call edi
push 0x10069504
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call edi
push 0x10069520
call edi
push 1
push esi
push 0x1006953c
call 0x117ddbfc
sub ecx, dword [ebx + 0x74de3bd8]
xor ebp, dword [eax + 0x5c]
xchg ebp, eax
push es
adc byte [ebx - 0x18], dl
minps xmm7, xmmword [edx - 0x3f7ae400]
je 0x10c39c63
push ebx
push edx
call 0x117e966d
push 0x1006953c
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.10c5164b
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10c5164b
mov esp, ebp
pop ebp
ret
Function at 0x10c41970
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100783b0
push 0x10042080
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10087664]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [0x1005b168]
mov dword [ebp - 4], 0
mov edx, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], dx
jne 0x10c41a12
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10c41a12
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x10c41a12
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x10c41a12
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10c461d0
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, eax
mov eax, 0x1505
test esi, esi
jne 0x10c461e0
xor eax, eax
pop esi
ret
mov cl, byte [esi]
test cl, cl
je 0x10c4620d
movzx edi, di
lea esp, [esp]
movzx edx, ax
mov eax, edx
shl eax, 5
add eax, edx
movzx ecx, cl
add eax, ecx
cdq
idiv edi
mov cl, byte [esi + 1]
inc esi
movzx eax, dx
test cl, cl
jne 0x10c461f0
pop esi
ret

Function at 0x10c489d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push ebx
mov bl, byte [ebp - 2]
not ecx
push esi
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 8]
not eax
push edi
mov esi, eax
mov dword [ebp - 8], 0
mov ecx, esi
xor eax, eax
shr ecx, 0x18
lea esp, [esp]
movzx edi, byte [eax*4 + 0x10b7f2cb]
cmp edi, ecx
je 0x10c48a16
inc eax
cmp eax, 0xff
jle 0x10c48a00
jmp 0x10c48a18
mov edx, eax
xor esi, dword [edx*4 + 0x10b7f2c8]
xor eax, eax
shl esi, 8
mov ecx, esi
shr ecx, 0x18
lea esp, [esp]
movzx edi, byte [eax*4 + 0x10b7f2cb]
cmp edi, ecx
je 0x10c48a46
inc eax
cmp eax, 0xff
jle 0x10c48a30
jmp 0x10c48a49
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10b7f2c8]
cmp edi, 3
ja 0x10c48a9d
jmp dword [edi*4 + 0x10030ed4]
inc edi
mov dword [ebp - 8], edi
cmp edi, 4
jl 0x10c489f2
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 3]
shl eax, 8
movzx edx, bl
add eax, edx
movzx edx, byte [ebp - 4]
shl eax, 8
add eax, ecx
shl eax, 8
pop edi
add eax, edx
xor eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10ca2658
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10ca273d
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x10ca273d
mov esi, dword [ebp + 8]
mov edi, eax
movzx ecx, word [edi]
mov al, byte [esi]
test cx, cx
jne 0x10ca270c
test al, al
jne 0x10ca2710
mov edi, dword [ebx + 8]
mov dword [ebp - 4], edi
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
lea eax, [eax + edi + 0x78]
je 0x10ca273d
mov eax, dword [eax]
mov ecx, dword [eax + edi + 0x18]
add eax, edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x10ca273d
mov eax, dword [eax + 0x20]
add eax, edi
xor ebx, ebx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x10ca273d
lea esp, [esp]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ebp + 0xc]
add ecx, edi
mov esi, ecx
sub esi, eax
lea esp, [esp]
mov dl, byte [esi + eax]
mov cl, byte [eax]
test dl, dl
jne 0x10ca2748
test cl, cl
jne 0x10ca274c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + ebx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test al, al
je 0x10ca2730
movsx edx, al
cmp ecx, edx
je 0x10ca2727
cmp al, 0x5a
jg 0x10ca2720
add edx, 0x20
jmp 0x10ca2723
add edx, 0xffffffe0
cmp ecx, edx
jne 0x10ca2730
add edi, 2
inc esi
jmp 0x10ca268b
mov ebx, dword [ebx]
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10ca267b
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, cl
je 0x10ca2753
cmp dl, cl
jne 0x10ca2753
inc eax
jmp 0x10ca26e8
inc ebx
cmp ebx, dword [ebp + 8]
jae 0x10ca273d
mov eax, dword [ebp - 8]
jmp 0x10ca26d8
Function at 0x41730c
Capabilities:
Encode data using xor

Disassembly:
popfd
arpl word [ecx], bx
adc byte [ebx - 0x57], bl
mul dword [esi]
mov dh, 0x25
shl byte [eax - 0x592905f0], 0xd3
mov ebx, 0xce519d8d
and eax, 0x1060a4c0
cli
salc
cmpsb byte [esi], byte es:[edi]
sar dword [ebx - 0x31ae6273], cl
cld
adc edx, dword [ebx]
lea ecx, [edi - 0x17510e24]
test dword [eax], edx
or eax, 0x337059cb
xor ecx, eax
pushal
push ecx
xor cl, byte [ebx + 0x3618b69]
sahf
and al, 0x6c
inc eax
dec ecx
imul esi, ecx, 0x6b
dec ebp
cli
jne 0x417315
add dword [edx], esp
xchg esi, eax
or al, 0x6c
mov dh, 0x24
mov cl, 0x73
test dword [eax], 0xa1089af3
mov cs, ebp

Function at 0x44d79c
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44d7e8
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44d7cd
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44d7dd
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44d7f8
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44d837
test ebx, ebx
je 0x44d80c
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44d801
cmp ecx, 0xfff1
jb 0x44d81a
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44d922
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44d85c
Function at 0x4e27dc
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e2828
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e280d
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e281d
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e2838
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e2877
test ebx, ebx
je 0x4e284c
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e2841
cmp ecx, 0xfff1
jb 0x4e285a
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e2962
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e289c
Function at 0x427e1e
Capabilities:
Encode data using xor

Disassembly:
cli
lodsd eax, dword [esi]
rol dword [ecx], 1
add eax, 0xb6b596c1
sub dl, ch
xor dl, al
and eax, dword [edx + ecx]
xor al, 0x4a
and al, 0xa
mov bl, 0x5c
inc esp
lahf
lodsb al, byte [esi]
add dword [eax + eax*4 + 0x52], eax
add dword [ebp - 0x35], edi
invalid
dec ecx
jp 0x427e2e
das
pop esp
jno 0x427e89
outsb dx, byte [esi]
jecxz 0x427dc4
cmpsb byte [esi], byte es:[edi]
or dword [ebx + ecx*2], ecx
sbb esp, dword [ebp + 0xd]
add eax, 0x9e698479
or eax, 0x69847905
sahf
jge 0x427e1f
nop
hlt
push edi
sbb esi, dword [esi + 0x2e649b52]
mov ebp, 0xdb0782bb
fbld tbyte [edx]
movsd dword es:[edi], dword [esi]
push edx
mov ecx, 0x100ff96a
jmp 0x427eec
aad 0x39
jl 0x427e6a
out 0xd9, eax
salc
inc esi
test ebx, eax
rol dword [esp + ebp*2], 1
int 0x41
lodsd eax, dword [esi]
mov al, 0xbc
dec edi
adc eax, 0xb70a4d7
sbb ebp, dword [eax - 0x24730be7]
rol byte [ebx - 0x1d], 0x78
xchg esp, eax
scasd eax, dword es:[edi]
sti
fadd dword [ebx + eax*2 + 0x16]
xchg esi, eax
lea ebp, [eax]
dec esi
das
loope 0x427ef1
push ebx
dec edx
dec ecx
sub ebx, dword [edi + eax]
mov ecx, 0x22da8899
mov eax, eax
cwde
mov al, byte [0x612fcb3b]
sbb edi, dword [eax - 0x8972fcf]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
daa
aaa
std
call 0x6821c4e8
add byte [0xcafeeaa3], ch
cdq
mov eax, 0x6d30bcd3
lodsb al, byte [esi]
mov eax, dword [0x7671801]
sbb byte [edi + 7], ah
push cs
sub cl, bh
dec esi
dec ebp
fmul qword [edi - 0x3f4b200b]
sbb dh, byte [ebx - 0x77]
dec edi
and byte [ecx - 0x6194aa7], 0x7d
dec eax
adc ebp, edx
pop esi
ljmp 0xa288
iretd