joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43afd8
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x44d964]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x43b014
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x43b02c
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x43b025
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00402cc4
xor edx, edx
mov eax, 0x44db64
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x43b096
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x43b04a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x43b2d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x43b2ed
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x43b2e6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x43b2ff
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x43b2f8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0043aec8
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x43b319
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.0043afd8
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x43b39e
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x43b3bb
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0043af58
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x43b3e4
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43b3fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x43b415
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x43b40e
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x43b429
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043adc0
test bl, bl
jne 0x43b4fc
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x536c6c
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43b460
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43b474
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043b2d4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x43b4a6
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x43b455
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43b4c9
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x43b4da
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43b4ee
jmp 0x43b5b7
cmp bl, 1
jne 0x43b5b7
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x536cc6
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43b51c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43b530
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043b2d4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x43b562
sub ebx, 6
inc dword [ebp - 8]
jne 0x43b511
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x43b589
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x43b59a
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x43b5ae
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043ae44
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x43d45c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43d4d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x43d4c0
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404328
inc dword [ebp - 8]
dec esi
jne 0x43d499
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d4dd
lea eax, [ebp - 0xc]
call fcn.00404060
ret

Function at 0x444e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x444e81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x444e6b
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404328
inc dword [ebp - 0xc]
dec esi
jne 0x444e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444e88
lea eax, [ebp - 0x10]
call fcn.00404060
ret

Function at 0x5641fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 4]
pushal
mov byte [esp + 4], 0xb9
pushfd
lea esi, [esi + 1]
mov byte [esp + 4], 0x26
jmp 0x5be146
rdtsc
cwde
mov ecx, dword [ebp + 0x18]
bswap dx
movsx edx, dl
mov edx, dword [ebp + 0x14]
not ax
movsx ax, bl
pushal
movsx eax, bl
mov eax, dword [ebp + 0x10]
call fcn.005ae90f
mov dword [esp], edi
jmp 0x5be8ee
jmp 0x5d0406
push ecx
mov dword [esp + 0x2c], esi
push 0xd2c4a6ee
call fcn.00570cdc
clc
bt bx, 0xa
cmc
cmp dword [ebp + 8], 0
jmp 0x5af623
cmp eax, dword [esi]
push 0x868963e
lea esp, [esp + 4]
jne 0x565672
shl eax, 1
call fcn.005a67b3
pushfd
pushal
lea esp, [esp + 0x24]
jne 0x5d5b04
pushfd
mov dword [esp], 0
pushal
call fcn.005acfc6
setle al
lahf
shl ah, cl
pushfd
mov eax, dword [ebp + 8]
cmc
push eax
cmp ch, ah
mov dword [esp + 4], ebx
stc
jmp 0x5a3d63

Function at 0x569960
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x43
mov byte [esp + 4], al
lea esp, [esp + 0x28]
call fcn.00542390
pushal
cmp dh, 0xdc
btc bx, di
mov ebx, dword [ebp - 8]
cmp cl, cl
jmp 0x58bc1f
mov word [esp + 4], 0x56fe
bt si, 7
test eax, eax
pushal
lea esp, [esp + 0x40]
je 0x5bdea5
call fcn.005867b3

Function at 0x56c5d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb99b1411
lea esp, [esp + 8]
je 0x5bdea5
cmp bh, ah
test ebx, 0xffff0000
pushfd
call fcn.005428b0
push ebx
call fcn.0056667d
Function at 0x5707b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp + 0x18]
bswap ecx
push 0xbacb5221
setbe ch
mov dx, dx
movzx ecx, word [edi + ebx*8 + 4]
pushfd
call fcn.00582328
test eax, eax
lea esp, [esp + 0x24]
js 0x57e1c8
pushal
lea esp, [esp + 0x20]
jns 0x5bff18
shld edx, esi, cl
btr bx, 0xe
neg dx
and eax, 0x7fffffff
shl bx, 4
inc edx
pushfd
add eax, dword [esi + 0x2c]
lea edx, [ecx*4 + 0x3022f083]
pop edx
xchg dx, bx
mov ebx, eax
movzx edx, dl
lea edx, [eax + 2]
pushal
lea esp, [esp + 0x20]
jmp 0x5e31c1
jmp 0x5a0374
push edi
mov word [esp], sp
pushal
lea esp, [esp + 0x24]
jns 0x5bff18
clc
and eax, 0x7fffffff
shrd ebx, esp, cl
movzx ebx, al
add eax, dword [esi + 0x2c]
jmp 0x541e4e
xchg edx, eax
pushfd
not eax
jmp 0x543611

Function at 0x575811
Capabilities:
Encode data using xor

Disassembly:
pushal
bswap di
pushal
pop edi
mov edi, 0x428cf3
jmp 0x5a7b82
jmp 0x56b975
pushfd
xchg dword [esp + 0x24], edi
bswap edi
bswap di
mov edi, 0x428cf3
push 0x1dc8667c
lea esp, [esp + 0x28]
jb 0x597bf7
push 0x6d35e517
mov edi, dword [edi + 0x16f227]
push dword [esp]
push ebx
call fcn.0057a48f
cwde
mov eax, dword [0x557ba0]
not ch
bswap cx
bts cx, 0xb
cmc
rol eax, 0x11
shl ecx, cl
sal ch, 4
dec cx
not eax
shrd cx, ax, 0xa
btc cx, 8
push 0x9b358d39
rcl ch, 3
mov ecx, eax
push 0xa4bd2e9f
pushfd
shr eax, 8
pushal
stc
cmc
jmp fcn.005ba582
push edi
xchg dword [esp + 0x14], edi
pushal
mov byte [esp + 8], bh
push dword [esp + 0x10]
push dword [esp + 0x38]
ret 0x3c
lea esp, [esp + 4]
jp 0x57f345
xchg dword [esp], edi
pushfd
jmp 0x58e60c
xchg dword [esp + 0x2c], edi
pushfd
mov word [esp], 0xdb6f
push dword [esp + 0x30]
ret 0x34
pushfd
mov word [esp], 0x3557
pushal
xchg dword [esp + 0x24], edi
jmp 0x56a8b2
mov edi, dword [edi + 0x16f227]
push esi
mov word [esp + 4], 0xa104
mov byte [esp], 0x9a
lea edi, [edi - 0x8ee0afc]
jmp 0x5758ef
push 0xe3818a3a
mov dword [esp + 4], edi
lea edi, [ebx + 0x34ead2a5]
mov word [esp], 0x64d6
lea esp, [esp + 4]
je 0x540be8
pushfd
mov edi, 0x428cf3
mov byte [esp], bh
mov byte [esp], dh
mov byte [esp], cl
pushfd
mov edi, dword [edi + 0x16f227]
push dword [esp + 4]
jmp 0x5b2a94
push 0x806d8218
pushfd
pushal
jmp 0x58790e
mov byte [esp + 4], bh
mov edi, dword [edi + 0x16f227]
pushfd
lea edi, [edi - 0x8ee0afc]
call fcn.0057b7ea
lcall 0xc9a, 0x3abcdfc7
stosd dword es:[edi], eax
add al, ah
in al, 0xee
std
aam 0xd3
fmulp st(1)
mul byte [ebp + 0xe564a14]
xor dword [ecx - 9], 0xffffffa8
adc dword [eax + 0x1120580c], ecx
xor eax, 0xc8ab4fe0
dec ebp
mov esp, 0x17c9eeb4
jo 0x5a7b9f
push edx
popal
movsd dword es:[edi], dword [esi]
popal
cmp ebx, ecx
rcr ch, cl
or dword [ebx + 0x6e343c5f], edx
fisttp qword [ecx]
xchg ebx, eax
pop edi
cmp al, 0x34
outsb dx, byte [esi]
std
jg 0x5a7bcd
mov eax, 0xbf316e56
sbb dword [ebx], 0x715f7b03
retf 0xc3d7
lea edi, [edi - 0x8ee0afc]
push dword [esp + 8]
jmp 0x56e224
Function at 0x583c17
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
stc
push ebx
xchg dword [esp + 0x20], ebp
pushal
and bp, 0x8166
lea ebp, [esp + 0x40]
push 0xd2c11a65
cmc
clc
sub esp, 0xffffffc4
jno 0x5be155
push esp
stc
cmp dword [ebp + 8], 0
pushal
lea esp, [esp + 0x24]
jne 0x5d5b04
pushfd
push ecx
mov dword [esp + 4], 0
push 0xc09393bb
lea esp, [esp + 8]
call fcn.005a3276
push ebp
jmp 0x5d5afa

Function at 0x588164
Capabilities:
Encode data using xor

Disassembly:
push ebx
lea esp, [esp + 8]
je 0x58087f
lahf
test dh, al
mov eax, dword [ebp + 0xc]
push 0x16cc7171
clc
clc
test eax, 0xffff0000
mov dword [esp], eax
mov byte [esp], 0x6e
lea esp, [esp + 4]
jne 0x5ca44d
movsx bx, cl
call fcn.00560506
push ebx
in eax, dx
test byte [eax + 0x56], cl
imul ebx, dword [edi - 0x7bf07249], 0x6f38655f
xor eax, 0x596d4077
dec edi
pop edi
push ecx
insb byte es:[edi], dx
aas
test byte [0xe1c5efb3], ah
leave
fld st(5)
loope 0x5808aa
mov ecx, 0xc34a49c
invalid
test ebx, ebx
mov dword [esp], 0x9113bdae
jmp 0x58086e
movzx cx, cl
movsx cx, al
movsx ecx, bl
sete ch
push eax
sete ch
movzx ecx, al
pushal
mov dword [esp + 0x1c], edi
pushal
movsx cx, al
pushfd
setle ch
mov ecx, esi
call fcn.00578544

Function at 0x58a23c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
mov dword [esp], ebx
call fcn.005b8fa9
pushfd
lea esp, [esp + 0xc]
je 0x5b8fbf
jmp 0x583a52

Function at 0x58b294
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [esp]
lea esp, [esp + 0x2c]
je 0x565672
lahf
pushal
push eax
mov ah, byte [esp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x541ab8
bt sp, 8
add esp, 8
cmp bl, ah
cmp bl, dh
pushfd
pushal
test edi, edi
jmp 0x567fac

Function at 0x58fa1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi + 0x4bc42682]
mov word [esp + 8], 0xac4a
xchg dword [esp + 0x3c], edi
push 0x8a3cb879
push dword [esp + 0x40]
ret 0x44
lea esp, [esp + 8]
jne 0x565672
daa
mov edi, dword [esi + 0x2c]
pushal
inc ah
rcr ah, cl
rcl al, cl
mov dword [ebp - 4], 0
not ah
mov al, byte [esp]
jmp 0x5d050f
mov edi, edi
shl ax, 1
dec ah
cmp dword [ebp - 4], 0
push dword [esp + 0x10]
cwde
mov eax, dword [ebp + 0xc]
call fcn.005a1e3a
push 0x888f00d4
push dword [esp + 8]
mov edi, dword [edi + 0x14d2f6]
push ecx
mov dword [esp], ecx
jmp 0x570f9a

Function at 0x59feb7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], edi
lea esp, [esp + 8]
je 0x565672
movzx ax, dl
inc ax
mov eax, dword [ebp - 4]
call fcn.005af6be
Function at 0x5a1e3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0x5e24a8
not ah
push ecx
xchg bh, al
mov eax, dword [ebp + 0x10]
pop ebx
movzx ebx, dl
lea ebx, [ebp - 8]
pushal
jmp 0x58caf0
pushal
lea esp, [esp + 0x40]
call fcn.00542390
rcl bx, 1
movsx bx, dl
shl bl, cl
xor bh, 0x36
mov ebx, dword [ebp - 8]
test bh, 0x3c
test ax, 0xe25f
cmc
test eax, eax
call fcn.0056c5d0
push dword [esp + 4]
mov byte [esp + 0xc], dl
mov dword [ebp - 8], 0
push dword [esp + 8]
jmp 0x57a296
push ecx
lea esp, [esp + 8]
je 0x5bdea5
cmp dh, 0x78
push ecx
call fcn.005a4014
not bl
setnp bl
setg bl
pushfd
lea ebx, [ebp - 8]
mov byte [esp], 0x7b
push esi
lea esp, [esp + 8]
call fcn.00542390
sbb ebx, 0xe0b2891c
mov ebx, dword [ebp - 8]
push 0x3a6868c9
test bl, 0x18
cmp cx, 0x7835
test eax, eax
jmp 0x5d8c71

Function at 0x5b3056
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0x565672
bts ax, bp
shld eax, ebp, 0x10
aad 0x14
mov edi, dword [esi + 0x2c]
sbb ah, 0xfc
aaa
rcl ah, cl
mov dword [ebp - 4], 0
pushfd
sal ax, 7
shl ah, 3
mov edi, edi
not eax
lea eax, [edi*4 - 0x75cd1189]
btr ax, 0xd
cmp dword [ebp - 4], 0
setle al
mov eax, dword [ebp + 0xc]
push dword [esp]
mov dword [ebp - 8], 0
mov dword [esp + 4], edx
pushal
lea esp, [esp + 0x28]
je 0x5e24a8
pushfd
mov eax, dword [ebp + 0x10]
mov word [esp], 0x78f2
jmp 0x5cb741
call fcn.00569960
in al, dx
pop edx
dec ecx
inc ebx
jbe 0x5c4768
out dx, eax
sbb ah, byte [eax - 0x7a]
ljmp 0xdbdb
pushal
lea ebx, [ebp - 8]
jmp 0x5c475e

Function at 0x5b839a
Capabilities:
Encode data using xor

Disassembly:
pushfd
nop
push dword [esp]
mov dword [esp + 8], eax
bswap eax
cwde
movzx eax, dl
mov eax, 0x41d98f
push dword [esp]
mov byte [esp + 8], 0x6d
push dword [esp + 4]
call fcn.00543a0c
pop edi
cld
mov ah, 0x15
mov ah, byte [ebx]
jle 0x5b83f9
outsb dx, byte [esi]
xor byte [esi + 0x3c], bh
push 0x1f496842
cdq
or al, ch
loopne 0x5b83c7
stc
int3
sbb eax, dword [edi + 0x64f2da36]
sbb dh, ah
push esp
invalid

Function at 0x5b8fa9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lea esp, [esp + 8]
call fcn.00547751
test al, ch
push 0x78a913ac
push ecx
pushfd
add esp, 0x10

Function at 0x5bf53c
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt di, 3
test ebx, 0xffff0000
mov byte [esp + 8], ah
push dword [esp + 0xc]
push dword [esp + 0xc]
lea esp, [esp + 0x2c]
je 0x5b8fbf
pushal
mov dword [esp + 0x1c], ebx
mov byte [esp + 4], dl
lea esp, [esp + 0x1c]
call fcn.00547751
clc
call fcn.0058b294
pushal
jmp 0x58c706

Function at 0x5d3e9d
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [esp], 0x581449
call fcn.00564719
lea esp, [esp + 0x40]
jne 0x56cee4
push 2
jmp 0x56b9f3

Function at 0x5d510f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x567f9b
setl dl
movzx dx, bl
mov edx, 0x41bf73
call fcn.005de460
jmp 0x5d782c
push dword [esp + 8]
xchg dword [esp + 0x14], edx
pushal
mov byte [esp + 4], ah
xchg dword [esp + 0x30], edx
jmp 0x547030

Function at 0x5dcdca
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop esi
mov esi, dword [esp + 0x24]
jmp 0x56e25f
Function at 0x5e248a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 8], 0
pushal
push eax
lea esp, [esp + 0x3c]
je 0x5e24a8
xchg bx, ax
movsx eax, al
setle al
mov eax, dword [ebp + 0x10]

Function at 0x686422
Capabilities:
Check for trap flag exception

Disassembly:
clc
mov byte [esp], ah
rol dl, 3
push dword [esp]
bt sp, bp
stc
xor dl, 0xdb
stc
clc
push word [esp + 8]
popf
call fcn.007bd925
push edi
pushfd
bts esi, 8
mov dword [esp], ebx
xor edi, 0x9f5aa022
btr di, sp
mov esi, dword [esp + 0x14]
pushal
mov edi, dword [esp + 0x38]
rcr dl, cl
xadd dl, al
call fcn.006b7a08
mov byte es:[0xbc069e06], al
mov ch, 0x4f
jno 0x68649c
nop
ret
pop es
rol byte [0x921cca74], 0x4d
sti
in al, 0x43
mov ebp, 0x7311d730
dec edi
sub al, 0xc
outsb dx, byte [esi]
cmp dword [esp + eax - 0x41], esi
wait
and bh, byte [eax + 0x6fb4c1f7]
mov edi, 0xfa5cb806
salc
push ss
pop ebx
mov bh, 0x4c
mov cl, 0xbe
xor dword [ebp + edi - 0x1cb6ca1b], esi
mov ah, 0xa9
sub dword [ebp + 0x5a5f453e], esp
sbb al, byte [ecx]
jle 0x68654b
push edi
in eax, 0xe1
ret 0xde93
aad 0xb4
invalid

Function at 0x6ade20
Capabilities:
Encode data using xor

Disassembly:
stc
push dword [edi]
pop dword [esp + 0x28]
stc
cmc
test cx, dx
cmp edi, ebx
push dword [esp + 0xc]
jmp 0x7bd62c
push dword [esp + 4]
pushfd
lea esp, [esp + 0x34]
ja 0x6b2bd4
push edx
push ebx
neg al
sub ebx, edi
lea edi, [edx*4 - 0x37f097b2]
add esp, 8
add ebx, esp
mov di, 0x8983
add di, ax
adc di, 0x6473
mov edi, ebx
shr al, 3
mov al, 0x2e
bt bx, 0xb
cmc
call fcn.006b72ec
pop es
xor esi, dword [ebx + ebx*2 + 0x4a]
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
adc al, 0x44
invalid
Function at 0x41eeb3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x404606
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push 0x78
pop eax
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x403ff0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call sub.MSVBVM60.DLL___vbaOnError
mov dword [ebp - 4], 3
push 0
call fcn.0040587c
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [ebp - 4], 4
push 0
call fcn.0040587c
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [ebp - 4], 5
push 0
call fcn.0040587c
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [ebp - 4], 6
push 0
call fcn.0040587c
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [ebp - 4], 7
push 0
call fcn.0040587c
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [ebp - 4], 8
push 0
call fcn.0040587c
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [ebp - 4], 9
push 0
call fcn.0040587c
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [ebp - 4], 0xa
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
add ax, 1
jo 0x41f07c
mov ecx, dword [ebp + 8]
sub ax, word [ecx]
jo 0x41f07c
mov word [ebp - 0x6c], ax
mov dword [ebp - 0x74], 2
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.00419e63
mov eax, dword [ebp + 8]
mov ax, word [eax]
mov word [ebp - 0x7c], ax
mov dword [ebp - 0x84], 2
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
call sub.MSVBVM60.DLL___vbaVarMul
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.MSVBVM60.DLL___vbaVarAdd
push eax
lea eax, [ebp - 0x64]
push eax
call sub.MSVBVM60.DLL___vbaVarInt
push eax
call sub.MSVBVM60.DLL___vbaI2Var
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
push 2
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0xc
mov dword [ebp - 4], 0xb
push 0
call fcn.0040587c
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [ebp - 4], 0xc
push 0
call fcn.0040587c
call sub.MSVBVM60.DLL___vbaSetSystemError
push 0x41f067
jmp 0x41f066
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow