joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9fd520f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x8009fc20
adc ecx, ecx
push 0xf7b03b78
push 0x55946315
jmp 0x9fd4c72
not al
jmp 0x9fda99b
pushfd
push dword [esp]
pushfd
lodsb al, byte [esi]
bt si, 3
stc
xor al, 0x62
clc
neg al
jmp 0x9965748
lea esp, [esp + 0xc]
je 0x9f10fca
clc
jmp 0x9ff1909
bt si, 0xe
or ah, ah
jg 0x9fd51f4
pushal
pushal
push 0xe7c47580
lea esp, [esp + 0x44]
je 0x9f10ff6
push edx
cmc
push 0x294620e0
cmp ah, 0x2e
lea esp, [esp + 8]
pushfd
mov byte [esp], cl
push dword [esp + 4]
ret 8
jmp 0x9fd7401
lea esp, [esp + 0xc]
call fcn.09f14369
jmp 0x9fdb62e
call fcn.09fd739c
jo 0x9fd33b2
pushfd
lea esp, [esp + 4]
jae 0x9ff5208
call fcn.0996ad04
lea esp, [esp + 0x28]
call fcn.09f14369
jnp 0x996037f
pushal
adc ecx, ecx
mov byte [esp + 4], bh
lea esp, [esp + 0x20]
call fcn.09f14369
push edx
pushfd
pushfd
call 0x9fdb008
call fcn.09fd1f8c
cld
xchg esp, eax
dec edx
into
pop ebp
ror dword [esp + ecx*8], 0x87
or eax, 0x6f1dcece
pop esp
dec eax
mov bl, 0xfd
push ss
mov ch, byte [ecx + 0x5b]
loopne 0x9fd6dcf
or esi, dword [eax - 9]
mov eax, dword [0xff423be9]
xchg ebp, eax
lcall 0x4abf, 0x7c9fa644
pop esi
push edx
cmp dword [eax], ebx
add al, 0xf2
rol dword [ebp + 0x70e59810], 0x3c
iretd
pushal
lea esp, [esp + 0x20]
jae 0x9ff5208
bt cx, 0xd
xor eax, eax
pushal
lea esp, [esp + 0x20]
call fcn.09f14369
pushfd
lea esp, [esp + 4]
jae 0x9969c86
mov bl, 0x63
jmp 0x9fd6dca
test bl, 0x7a
call fcn.09ff1158
lea esp, [esp + 0xc]
call fcn.09f14369
call fcn.09f146f5
sbb ah, byte [esi - 0x3e6621c5]
or al, 0xbc
ja 0x9fda9f4
mov ebp, 0xe8fff399
inc esp
popfd
call [edx]
cmpsb byte [esi], byte es:[edi]
cmp ebx, esi
cdq
ror dword [esp + edi*4], 0x77
cmp edx, ebx
retf 0x6331
fcmove st(0), st(2)
xor dword [ebx + 0x78], esp
xor al, 0xd7
mov ecx, 0x17859e1a
aam 0xe0
cmp ecx, dword [ebp - 0x78e6054a]
insb byte es:[edi], dx
and byte [ebx - 0x4c9ec11f], ch
add ebx, dword [ecx + 0xc]
add al, 0x86
ja 0x9fda9a8
sub ecx, dword [edi + 0x6b8d7efd]
test dh, 0x78
cmpsb byte ss:[esi], byte es:[edi]
cmp dh, dl
int 0x58
push eax
outsb dx, byte [esi]
push es
sbb dword [esi + 4], ebp
mov ebx, dword [ebx]
sbb eax, 0x4ec3e2da
sbb ebx, dword [0x4ec3e2da]
outsb dx, byte [esi]
mov ebp, 0x5eb2d9ff
add ah, ch
sahf
push 0x41838028
test al, 0x69
push edx
xchg ebx, eax
test al, 0x14
stc
aad 0x61
xor ebx, dword [edi]
xchg ebp, eax
jnp 0x9fdaa60
insd dword es:[edi], dx
sti
xchg edi, eax
ljmp 0x5bd1
in al, 7
movsd dword es:[edi], dword [esi]
xor dh, byte [ecx + 0x5fc4f4df]
pop ebp
into
test byte [ebp + 0x7b], 0xb8
adc byte [ebx], dh
pop ecx
and byte [esi], al
inc edi
imul esi, dword [ebp - 0xb], 0x602c769a
imul esp, dword [ecx], 0xffffff92
inc ebx
fadd st(3), st(0)
push ebp
or ch, al
rcr byte [ebx], cl
jmp 0x356e7a5e
pushal
push dword [esp + 4]
call 0x9fd520f
lea esp, [esp + 0x10]
jb 0x9fdaffe
pushal
push edx
push dword [esp + 0x24]
ret 0x28
pushal
lea esp, [esp + 0x20]
jb 0x9fdaffe
pushfd
push dword [esp]
push dword [esp + 8]
ret 0xc
call fcn.09fdb644
mov ebp, 0xa5bbee3
ret
Function at 0x9fd8644
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
call fcn.09f12532
in al, 0xdc
bound esi, qword [esi - 0x1cf34af5]
mov dword [0x81ba0a11], eax
pinsrw mm2, eax, 0xb
cdq
bound ecx, qword [edx - 0x3f]
retf
lea esp, [esp + 0x28]
je 0x9ff5211
jge 0x9fd5236
not esi
pushal
mov esi, eax
call fcn.09fef01d
lea esi, [eax - 0x45d265e2]
mov esi, eax
push edx
jmp 0x9f11bdf
pushal
pushfd
jmp 0x9f15488

Function at 0x9fde7ae
Capabilities:
Encode data using xor

Disassembly:
cmp al, byte [edi]
jmp 0x9fed564
cmc
stc
mov dword [esp], ebp
neg al
pushfd
pushfd
lea esp, [esp + 0x24]
jae 0x9f11dde
inc al
test edi, 0x3f562466
jmp 0x9fdb095
lea edi, [edi + 1]
not eax
not ah
mov eax, esp
lea eax, [esp - 0x26d2a5dc]
pop eax
push 0x384299cb
mov byte [esp], dh
mov byte [esp], 0x61
lea esp, [esp + 4]
ja 0x9960721
pushal
lea esp, [esp + 0x20]
jb 0x9ff4ee4
test ebx, edx
test bl, ch
cmc
cmp byte [edi - 1], 0
call fcn.09964abb
Function at 0x10013502
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022df0]
jne 0x1001350c
repz ret
jmp fcn.10013cd3

Function at 0x10013990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001399f
pop dword [ebp - 8]
mov eax, 0x1001399f
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xaab225fe
sub dword [ebp - 0x18], 0x5c5fe0b3
mov dword [ebp - 0x14], 0xb9eb645c
sub dword [ebp - 0x14], 0x87b81817
mov dword [ebp - 0x10], 0xb3a84457
sub dword [ebp - 0x10], 0x675c0029
mov dword [ebp - 0xc], 0xb2c54827
sub dword [ebp - 0xc], 0xb2c54827
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xa01f2aa4
sub dword [ebp - 0x18], 0x2bacc14e
mov dword [ebp - 0x14], 0xf76d1ac9
add dword [ebp - 0x14], 0x49ff46ac
mov dword [ebp - 0x10], 0x273fd1f7
add dword [ebp - 0x10], 0x3c2f9a75
mov dword [ebp - 0xc], 0xb130dc76
sub dword [ebp - 0xc], 0xb130dc76
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x4043b7ab
add eax, 0xcfbdb97d
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3956f
push 0
call eax
mov ecx, 0x4bb0
xor edx, edx
add edx, eax
mov ebx, 0x33e04ef4
add ebx, 0xdc22870c
add ebx, dword [ebp - 8]
mov esi, 0xdfa584ff
add esi, 0xbd8c36d0
add dword [ebp - 4], ebx
mov edi, dword [ebx]
sub edi, esi
xor dword [ebp - 4], ebx
mov dword [edx], edi
add dword [ebp - 4], ebx
add edx, 0x9227499
sub edx, 0x9227495
add ebx, 0xdccf3b3c
sub ebx, 0xdccf3b38
loop 0x10013ab3
add eax, 0xd17b58e5
sub eax, 0xd17a3752
xor ebx, ebx
add ebx, eax
add eax, 0x4c084559
sub eax, 0x4c084554
mov ecx, 0x7a288024
add ecx, 0x95d77fdc
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x6b93f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6b948e
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x6b9452
cmp byte [ebx + 0x11], 0
jne 0x6b9452
cmp byte [ebx + 0x24], 0
jne 0x6b9452
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x6b9473
lea edx, [ebp - 4]
mov eax, dword [0x76e2f8]
call fcn.0040ee40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x693c6c]
call fcn.00425d94
call fcn.00409280
jmp 0x6b9473
lea edx, [ebp - 8]
mov eax, dword [0x76e2f8]
call fcn.0040ee40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x693c6c]
call fcn.00425d94
call fcn.00409280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b9495
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409c20
ret

Function at 0x6b9ca8
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x6b9cf6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.006b9270
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6b9d0f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x6b9d18
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.006b9270
dec esi
jne 0x6b9d3a
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x71dd50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x71dd58
mov eax, edx
pop esi
pop ebx
ret

Function at 0x733450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00409cb4
xor eax, eax
push ebp
push 0x733548
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x78], 0
je 0x73352a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
dec eax
test eax, eax
jl 0x73352a
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov ecx, 0
call fcn.0040a258
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.0040a4c0
jne 0x733522
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x73352a
inc dword [ebp - 0x18]
dec dword [ebp - 0x24]
jne 0x7334c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73354f
lea eax, [ebp - 0x28]
call fcn.00409be4
lea eax, [ebp - 8]
call fcn.00409be4
ret
Function at 0x733558
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7336c1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x7336d0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
lea eax, [ebp - 0x18]
mov edx, 0x7336ec
mov ecx, 0
call fcn.0040a258
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00733450
mov dword [0x76a738], eax
mov eax, dword [ebp - 4]
call fcn.0040a6ac
push eax
call dword [0x76a738]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x733683
test byte [ebp - 0xb], 4
je 0x733679
test byte [ebp - 0xc], 0x10
je 0x7335da
mov byte [ebp - 5], 0
jmp 0x7336a6
push 0x7336d0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
lea eax, [ebp - 0x1c]
mov edx, 0x733700
mov ecx, 0
call fcn.0040a258
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00733450
mov dword [0x76a734], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040a6ac
push eax
call dword [0x76a734]
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x73366f
push 0x7336d0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
lea eax, [ebp - 0x20]
mov edx, 0x73370c
mov ecx, 0
call fcn.0040a258
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00733450
mov dword [0x76a730], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [0x76a730]
mov byte [ebp - 5], 1
jmp 0x7336a6
cmp dword [ebp - 0x14], 0x20
sete byte [ebp - 5]
jmp 0x7336a6
test byte [ebp - 0xc], 0x10
sete byte [ebp - 5]
jmp 0x7336a6
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
je 0x73369d
cmp dword [ebp - 0x14], 3
je 0x73369d
cmp dword [ebp - 0x14], 0x7b
jne 0x7336a1
xor eax, eax
jmp 0x7336a3
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7336c8
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00409c50
ret

Function at 0x736be8
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x736c4d
mov eax, dword [esp]
call fcn.00736e98
test al, al
je 0x736c4d
mov eax, dword [esp]
call fcn.00736ca8
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x736c30
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x736c4d
cmp ax, 0x5a
ja 0x736c4d
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x73fa20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x76bef8
test edx, edx
jne 0x73fa3f
xor eax, eax
jmp 0x73fb5d
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x73fa5c
push esi
push edx
push eax
call fcn.0073fb64
add esp, 0xc
jmp 0x73fb5d
push esi
push edx
push eax
call fcn.0073fe24
add esp, 0xc
jmp 0x73fb5d
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x75a9a6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x30], eax
xor edx, edx
mov dword [esi + 0x4c], edx
xor ecx, ecx
mov dword [esi + 0x20], ecx
push esi
call fcn.0075a984
pop ecx
xor ecx, ecx
mov eax, ecx
xor edx, edx
mov ebx, eax
shr ebx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ebx, eax
mov eax, ebx
inc edx
cmp edx, 8
jl 0x75a9ca
mov dword [esi + ecx*4 + 0x70], eax
inc ecx
cmp ecx, 0x100
jb 0x75a9c6
pop esi
pop ebx
pop ebp
ret

Function at 0x75bc06
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [ebx], eax
push dword [ebx]
call fcn.0075bba7
pop ecx
pop ebx
pop ecx
pop ebp
ret

Function at 0x75d577
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov esi, pe_nt_image_headers32
or ebx, 0x100
add edi, edi
mov eax, ebx
shr eax, 7
and eax, 1
push eax
mov edx, esi
and edx, edi
add edx, esi
mov ecx, ebx
shr ecx, 8
add edx, ecx
shl edx, 2
add edx, dword [ebp + 0xc]
push edx
push dword [ebp + 8]
call fcn.0075d4e5
add esp, 0xc
add ebx, ebx
mov ecx, ebx
xor ecx, edi
not ecx
and esi, ecx
cmp ebx, 0x10000
jb 0x75d58e
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x75d637
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 0xc]
xor edx, edx
or eax, 0x100
mov ecx, eax
shr ecx, 8
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + ecx*4]
mov ebx, eax
shr ebx, 7
and ebx, 1
neg ebx
and ebx, 0x7ff
xor ecx, ebx
shr ecx, 4
mov ebx, dword [ebp + 0x10]
add edx, dword [ebx + ecx*4]
add eax, eax
cmp eax, 0x10000
jb 0x75d645
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x75d679
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edx, pe_nt_image_headers32
or eax, 0x100
add ecx, ecx
mov esi, edx
and esi, ecx
add esi, edx
mov edi, eax
shr edi, 8
add esi, edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 7
and edi, 1
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
add ebx, dword [edi + esi*4]
add eax, eax
mov esi, eax
xor esi, ecx
not esi
and edx, esi
cmp eax, 0x10000
jb 0x75d691
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x75d75b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov edi, 1
shl edi, cl
or eax, edi
cmp eax, 1
je 0x75d7a0
mov ecx, eax
shr ecx, 1
mov ecx, dword [ebx + ecx*4]
mov edi, eax
and edi, 1
neg edi
and edi, 0x7ff
xor ecx, edi
shr ecx, 4
add edx, dword [esi + ecx*4]
shr eax, 1
cmp eax, 1
jne 0x75d77d
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x75d7a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, 1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x75d7f2
mov edx, ebx
and edx, 1
shr ebx, 1
mov esi, dword [ebp + 8]
mov esi, dword [esi + eax*4]
mov edi, edx
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
mov esi, dword [edi + esi*4]
add dword [ebp - 4], esi
add eax, eax
or edx, eax
mov eax, edx
dec ecx
test ecx, ecx
jne 0x75d7c2
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x412565
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123e4

Function at 0x41695c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004162ca

Function at 0x416967
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416505

Function at 0xb78058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b781a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb7807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb7806a
add dl, dl
jne 0xb78089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb780dc
xor eax, eax
add dl, dl
jne 0xb78096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb7817d
add dl, dl
jne 0xb780a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb780b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb780bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb780c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb780d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb78075
mov eax, 1
add dl, dl
jne 0xb780ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb780f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb780e1
sub eax, ebx
mov ebx, 1
jne 0xb78128
mov ecx, 1
add dl, dl
jne 0xb7810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb78119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb78105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb78075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb7813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb7814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb78136
cmp eax, 0x7d00
jae 0xb7816d
cmp eax, 0x500
jb 0xb78168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb78075
cmp eax, 0x7f
ja 0xb78170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb78075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb7819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb78075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000ecb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000ecbf
pop dword [ebp - 0x2c]
mov eax, 0x69b7d3eb
sub eax, 0x59b6e72c
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x52988e5b
sub dword [ebp - 0x3c], 0x4464910
mov dword [ebp - 0x38], 0xf0e9dcfd
add dword [ebp - 0x38], 0x41496f48
mov dword [ebp - 0x34], 0x1a5b33b4
sub dword [ebp - 0x34], 0xce0eef86
mov dword [ebp - 0x30], 0x67cc146f
add dword [ebp - 0x30], 0x9833eb91
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x44bd7b2e
sub dword [ebp - 0x3c], 0xd04b11d8
mov dword [ebp - 0x38], 0xaeee0f37
add dword [ebp - 0x38], 0x927e523e
mov dword [ebp - 0x34], 0xed20e785
add dword [ebp - 0x34], 0x764e84e7
mov dword [ebp - 0x30], 0x9ca70ae0
add dword [ebp - 0x30], 0x6358f520
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x55cd5
push 0
call eax
mov ecx, 0xc73f0181
add ecx, 0x38c14d6d
xor ebx, ebx
add ebx, eax
mov esi, 0xabe044bd
add esi, 0x64294143
add esi, dword [ebp - 0x2c]
mov edx, 0x80a014f1
mov dword [ebp - 0x28], 0xd94cb77e
mov edi, dword [esi]
sub edi, edx
xor dword [ebp - 0x14], edx
mov dword [ebx], edi
xor dword [ebp - 0x10], 0x2ff187c
add ebx, 0xd5e8458a
sub ebx, 0xd5e84586
add esi, 4
loop 0x1000edd3
add eax, 0x87c4da6e
sub eax, 0x87c3abe3
xor ebx, ebx
add ebx, eax
add eax, 0x970977b3
add eax, 0x68f68852
mov ecx, 0x5fc88ffe
add ecx, 0xb0377002
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x10010020
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::setPath_class_ScCore::String_const___bool_
cwde
test eax, eax
je 0x10010052
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x10010049
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033360
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033590
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x401db3
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esi + 0xc], eax
pop esi
pop ebp
ret 0x14
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi + 0x3a], 0
jne 0x401f36
add byte [eax], al
mov ebx, dword [ebp + 0xc]
movzx eax, word [ebx + 0x86]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push dword [esi]
call dword [0x48f634]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov edx, dword [esi + 0x44]
mov edi, dword [esi + 0x48]
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp + 8], edi
test ecx, ecx
je 0x43bd51
test eax, eax
je 0x43bd68
cmp dword [esi + 0x19c], 0
jne 0x43bd7f
lea eax, [ebp - 0x34]
push eax
push dword [ebx]
call dword [0x48f694]
invalid
Function at 0x401b6a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401b79
pop dword [ebp - 0x34]
mov eax, 0x585b896
sub eax, 0x5459d1d
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3e03a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x5f22fe8d
add ecx, 0xa0dd3afd
xor edx, edx
add edx, eax
mov esi, 0xdaee0bb1
sub esi, 0xdaaa03b1
add esi, dword [ebp - 0x34]
mov ebx, 0xf798205b
sub ebx, 0x3a57fd3e
xor dword [ebp - 0x30], 0x72af3fc8
mov edi, dword [esi]
sub dword [ebp - 8], 0x6bc68a3d
xor edi, ebx
xor dword [ebp - 0x14], ebx
mov dword [edx], edi
xor dword [ebp - 0x14], ebx
add edx, 0x1757c470
sub edx, 0x1757c46c
add esi, 4
loop 0x401bd5
add eax, 0x5b92cdb4
add eax, 0xa46e0b47
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8aed326f
add ecx, 0x7552cd91
add ecx, dword [ebp - 0x34]
call ebx
leave
ret