joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461e30
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x461e63
push esi
call fcn.004701d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x461e5c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x461ee9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x461ed2
mov eax, dword [esi + 8]
test eax, eax
je 0x461e87
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x461ece
cmp eax, 2
je 0x461ed2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x461e7a
cmp eax, 3
je 0x461ead
cmp eax, 1
jne 0x461e7a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x461e7a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x461e7a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00461f10
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x461ef8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00461f10
add esp, 4
pop esi
ret

Function at 0x462780
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4627a1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4627a1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4627a1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x490512
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49054a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048e5c9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048e5a1
jmp 0x490556
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x491c07
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x491c49
call fcn.004976bc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x491c49
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x491c40
xor eax, eax
jmp 0x491c51
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00491c57
pop edi
pop esi
pop ebx
ret 4
Function at 0x497bec
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x497c1a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x497c38
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00497b52
jmp 0x497c38
mov eax, dword [esi + 0x14]
test eax, eax
je 0x497c38
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00497b52
test edi, edi
mov eax, edi
jne 0x497c22
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5a1eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test esi, esi
mov ecx, edi
jbe 0x5a1ed0
mov dl, byte [esp + 0x14]
mov al, byte [ecx]
add al, dl
xor al, dl
mov byte [ecx], al
inc ecx
dec esi
jne 0x5a1ec4
mov eax, edi
pop edi
pop esi
ret

Function at 0x5aee22
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, eax
rdtsc
lea esp, [esp + 0xc]
js 0x5b0ce3
setg cl
cwde
mov ecx, 0x11
jbe 0x5c27c7
lea edi, [0x7dac498d]
push edx
lea edi, [ebp - 0x54]
pop eax
cdq
mov al, bl
pushfd
rep movsd dword es:[edi], dword [esi]
xor dx, bx
rcr ch, 2
mov ecx, dword [ebp + 8]
rdtsc
dec eax
mov edx, dword [ebp - 0x44]
xor ax, bx
rol al, 2
not al
rol eax, cl
mov dword [ecx + 0x10], edx
push ecx
adc dl, dl
rcr dword [ecx - 0x3f01932b], 0x8b
inc ebp
or byte [esi - 0x2d], ah
shl dword [esi + 0xf], 1
mov esi, 0xe1d366cb
btc cx, si
mov ecx, dword [ebp - 0x40]
sal dx, cl
sbb dh, 0x27
cmp ax, 0xf29f
mov dword [eax + 0x14], ecx
jmp fcn.005c7a00
movsx edi, cl
push 0x717e9193
mov ecx, 0x11
push ecx
push 0xcea21c08
jmp 0x5a44ad
lahf
rdtsc
cwde
lea edi, [ebp - 0x54]
not dx
pushfd
pushal
call fcn.005c4c34
mov byte [esp + 8], ah
mov dword [ebp - 0x24], edx
pushfd
mov dword [ebp - 0x3c], 0
pushfd
mov dword [esp], 0x37eb653d
lea esp, [esp + 0x38]
jmp 0x5d7c45
shrd dx, bp, 8
sar dh, 1
rcl dx, cl
rol dx, cl
mov edx, dword [ebp - 0x34]
clc
bt bp, 0xf
test al, dh
push 0x5a070d5a
sub eax, eax
movzx ax, al
btc ax, 9
call fcn.005d45c9

Function at 0x5afa70
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
cmp dword [edx + 0x10], 0
mov byte [esp], 0x25
pushal
pushfd
push dword [esp]
lea esp, [esp + 0x30]
je 0x5d2b98
rdtsc
rdtsc
mov eax, dword [ebp - 0x74]
setge ch
mov ecx, dword [eax + 0xc]
shr al, cl
pushfd
cmc
sar dh, cl
add ecx, dword [ebp + 0x10]
movzx eax, bl
aas
rcr dx, 3
xchg dx, ax
mov edx, dword [ebp - 0x74]
call fcn.005c3b19
push 0x5a6718
pushal
mov byte [esp + 8], bh
pushfd
lea esp, [esp + 0x24]
call fcn.005bad4a
push 0x1366adef
mov dword [esp], eax
pushfd
push ebx
lea esp, [esp + 8]
call fcn.005cd1f1
cmp bp, bp
stc
cmp cl, bl
test sp, 0x270a
mov dword [ebp - 0x18], eax
push ebx
push dword [esp]
test dl, dh
cmp dword [ebp - 0x18], 0
pushal
call fcn.005cc31a
sete al
pushfd
push dword [esp]
mov edx, dword [ebp - 0x34]
call fcn.005c217a
pushfd
mov dword [esp], str.VirtualQuery
jmp 0x5c88ef

Function at 0x5b24d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x2c]
je 0x5bee4d
setb ah
push 0xc1165ce
mov eax, 0xc0000001
pushal
mov byte [esp], 0x5f
push ebp
push 0x544d7e42
lea esp, [esp + 0x2c]
jmp fcn.005d3844
Function at 0x5b507a
Capabilities:
Encode data using xor

Disassembly:
jle 0x5b50a4
jl 0x5b50fd
invalid
dec esi
sub eax, dword [edx]
push ebx
inc edx
sub edi, dword [ecx + 0x65]
or eax, esi
scasb al, byte es:[edi]
pop edi
mov bh, 0x4c
jne 0x5b50a1
mov byte [0xe181ee63], al
xor eax, ebp
retf
pop esp
inc esi
wait
invalid
mov ebx, 0x938fcd8b
test al, 0xda
dec ebp
adc dword [eax + 6], edi
xor al, 0x7e
xor cl, al
mov ebx, 0x1615bbe6
jno 0x5b50f8
pop edx
popal
pop edi
mov byte [0x9abc8e88], al
stosd dword es:[edi], eax
lcall 0x48ae, 0x436af91d
xchg ecx, eax
rep lodsd eax, dword es:[esi]
outsd dx, dword [esi]
hlt

Function at 0x5b725b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dh, dh
push dword [esp]
cmp dword [ebp + 0x18], 4
pushfd
lea esp, [esp + 0xc]
jne 0x5dd5a1
pushfd
cmp dword [ebp + 0x14], 8
jmp 0x5c528a
mov eax, 0xc0000001
pushfd
pushal
lea esp, [esp + 0x24]
jmp fcn.005d3844
lea esp, [esp + 4]
je 0x5bee4d
not ax
setp ah
jmp 0x5b9824

Function at 0x5b84c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5c9d35
add esp, 0xc
cmc
clc
cmc
test eax, eax
push 0x30b740ec
lea esp, [esp + 4]
jne 0x5c8b82
rdtsc
lahf
mov eax, dword [ebp + 0x14]
movzx dx, cl
push eax
jmp 0x5bd27b

Function at 0x5b8ded
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5c3f50
mov word [esp], 0xd480
mov byte [esp + 4], 0xd8
lea esp, [esp + 0xc]
je 0x5c4038
xor dh, al
lea ecx, [ebp*2 + 0x3bb1ffe0]
clc
mov edx, dword [ebp + 0xc]
sbb ah, 0x42
neg cl
push 0xf48786c6
mov dword [edx], 0
xadd ah, cl
mov dword [edx + 4], 0
xor cx, 0x83a2
btc dx, cx
shr eax, 8
rcr dh, 4
mov eax, dword [ebp + 0xc]
movsx dx, dl
shld dx, dx, 0xf
mov dword [eax + 8], 0
movzx dx, bl
or dl, 0x8b
and cl, cl
pushfd
mov dword [eax + 0xc], 0
pushal
cdq
seta cl
mov ecx, dword [ebp + 0xc]
sub ah, 0x46
inc esi

Function at 0x5b9415
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x5bee4d
bswap ax
mov eax, 0xc0000001
pushfd
lea esp, [esp + 4]
jmp fcn.005d3844

Function at 0x5b9af7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0x5cb860
call fcn.005d014d
Function at 0x5bc991
Capabilities:
Enumerate pe sections
Execute anti-debugging instructions

Disassembly:
mov dword [eax + 4], ecx
clc
cmc
call fcn.005d2fff
mov dword [esp + 0x20], eax
pushal
lea esp, [esp + 0x40]
jle 0x5de76a
push 0xa5f50899
lea esp, [esp + 4]
call 0x5a3deb
rcl cx, 6
bt edi, 7
add esp, 4
shld ecx, edi, 0x1a
mov ecx, dword [ebp + 8]
shrd dx, bx, 8
mov edx, dword [ebp + 8]
sbb ah, al
pushal
adc ax, 0x1f73
sal al, cl
sub edx, dword [ecx + 8]
and cl, 0xf2
sar al, 3
pop eax
mov dword [ebp - 0x1c], edx
aaa
mov eax, dword [ebp + 0xc]
xadd ecx, edx
bswap ecx
mov dword [ebp - 0x14], eax
cdq
rcl dh, 6
shrd cx, sp, 3
shl cl, 5
mov ecx, dword [ebp - 0x14]
btr dx, bx
stc
and edx, 0x9fc9683c
shl dl, 2
mov dword [ebp - 0xc], ecx
pushfd
lea ecx, [edx - 0x557f776a]
sar cx, cl
mov edx, dword [ebp - 0xc]
btc cx, 8
cmc
mov eax, dword [ebp - 0xc]
ror cx, 0xe
add eax, dword [edx + 0x3c]
test bp, 0x53cb
sar cl, 2
rcl ecx, cl
bts cx, bp
mov dword [ebp - 8], eax
bsr cx, ax
aas
dec ah
and cl, al
mov ecx, dword [ebp - 8]
das
mov ah, byte [esp + 0xc]
btc ax, 1
xor edx, edx
call fcn.005bf245
pushfd
pushal
jmp 0x5c4a43

Function at 0x5c4885
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ch
mov dword [eax], 0
cmc
cmp dl, 0xe
btr cx, 4
clc
mov ecx, dword [ebp + 0x14]
cmp cl, bl
mov dword [ecx + 4], 1
clc
call fcn.005c7e6d
mov dword [ecx + 4], 0
rdtsc
add ax, 0x1935
mov edx, dword [ebp - 0xc]
pushal
mov dword [edx], 1
adc ax, 0x3b52
rdtsc
mov eax, dword [ebp - 0xc]
cmp bl, al
xor cl, ah
pop ecx
shl ch, cl
mov ecx, dword [ebp - 4]
sal dx, 0xd
mov dword [eax + 8], ecx
bsf dx, di
mov edx, dword [ebp - 0xc]
das
cwde
mov eax, dword [ebp - 8]
sal cx, 1
pop ecx
mov dword [edx + 0xc], eax
cmc
btc dx, 1
bts cx, cx
mov ecx, dword [ebp - 0xc]
sal dh, 6
or ecx, 0x80000000
ror dl, cl
push edx
mov edx, dword [ebp + 8]
mov byte [esp + 8], 0xbe
mov dword [edx], ecx
bt ax, 0xb
bt cx, bp
clc
pushfd
cmp dword [ebp + 0x14], 0
mov byte [esp + 8], cl
pushal
push esi
lea esp, [esp + 0x44]
je 0x5af88a
invalid
shrd ax, dx, cl
aam 0x17
sal cx, 0xf
mov eax, dword [ebp + 0x14]
bswap cx
jmp 0x5b94d6
mov byte [esp + 4], 0x21
lea esp, [esp + 8]
je 0x5cba43
bsr dx, ax
sub dl, al
aam 4
mov ecx, dword [ebp - 0xc]
jmp 0x5c1a3b
Function at 0x5c4a02
Capabilities:
Enumerate pe sections
Execute anti-debugging instructions

Disassembly:
dec dh
mov dword [ebp - 0x20], ecx
bsf dx, sp
sbb dx, 0xa33b
lea edx, [0xe49ec282]
inc dx
mov edx, dword [ebp - 0x20]
pushal
push 0xb68cda9e
test bl, 0x36
cmp edx, dword [ebp - 0x1c]
push dword [esp + 0xc]
mov byte [esp + 0x10], dl
call fcn.005d55cf
jmp 0x5bfb90
btr ax, 9
das
jmp 0x5d235b
cmc
cmc
sub ecx, ecx
bswap cx
mov cx, word [eax + 6]
cmp cl, bh
cmp dword [ebp - 0x10], ecx
jmp 0x5d4b7c
sub ecx, 0xd1b458f2
pushfd
call fcn.005d3571
lea esp, [esp + 0x10]
je 0x5c4a2f
or ah, ah
lahf
mov edx, dword [ebp + 0x14]
adc eax, 0x70cfaa13
setbe ch
mov eax, dword [edx]
sal dl, cl
test dl, dl
mov dword [ebp - 0x10], eax
cmp ax, 0x174f
and dh, 0xe8
mov ecx, dword [ebp - 4]
shl dl, cl
mov edx, dword [ecx + 0xc]
call fcn.005cc2d8
lea esp, [esp + 0x24]
call 0x5a3deb
pushfd
add esp, 8
push esp
aas
mov ecx, dword [ebp + 8]
ror ax, cl
sbb ah, bh
setae dl
sub ah, ah
mov edx, dword [ebp + 8]
rcr al, 6
shr al, cl
bsr eax, esp
sar al, cl
sub edx, dword [ecx + 8]
inc ch
sub ch, 0x87
cwde
mov dword [ebp - 0x1c], edx
aaa
rcr eax, 0x1f
movsx dx, al
mov eax, dword [ebp + 0xc]
mov dx, 0x4994
shld cx, si, cl
jmp 0x5d19d8
mov dword [ebp - 0x14], eax
cdq
or cl, 0x91
mov ecx, dword [ebp - 0x14]
bts dx, 9
das
rdtsc
xadd dx, ax
mov dword [ebp - 0xc], ecx
btr ax, bp
sal ax, cl
cwde
mov edx, dword [ebp - 0xc]
cmc
clc
mov eax, dword [ebp - 0xc]
shl cl, 4
add eax, dword [edx + 0x3c]
adc ecx, esi
rcl cx, 1
movsx cx, cl
mov dword [ebp - 8], eax
aad 0x3f
rcl cx, cl
dec al
cwde
mov ecx, dword [ebp - 8]
daa
daa
bswap eax
dec ah
xor edx, edx
movzx dx, cl
mov dx, word [ecx + 0x14]
lea ecx, [ecx*4 + 0x70378fd3]
mov eax, dword [ebp - 8]
bswap ecx
movzx cx, dl
push esi
pop ecx
lea ecx, [eax + edx + 0x18]
mov byte [esp], bl
pushal
pushfd
pushfd
mov dword [ebp - 4], ecx
mov byte [esp + 8], al
mov dword [ebp - 0x10], 0
pushfd
lea esp, [esp + 0x30]
jmp 0x5b82da
mov eax, dword [ebp - 8]
jo 0x5b60d8
test dh, 0xa7
xor ecx, ecx
rol ch, 2
shld cx, di, cl
mov cx, word [eax + 6]
push 0x24ff290f
cmp dword [ebp - 0x10], ecx
mov dword [esp], eax
lea esp, [esp + 4]
jge 0x5cedd8
movzx ax, cl
mov edx, dword [ebp - 0x10]
rcr ah, 4
bswap ax
bswap cx
imul edx, edx, 0x28
rol cl, cl
bswap eax
sal al, 1
mov eax, dword [ebp - 4]
shl ch, cl
mov ecx, dword [ebp - 0xc]
cmp sp, 0xfa01
add ecx, dword [eax + edx + 0xc]
jmp 0x5b1ba8
Function at 0x5c63cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi + 0x6105bb05]
lea esp, [esp + 0x28]
jb 0x5ced11
pushal
mov byte [esp], 0xfd
xchg dword [esp + 0x20], edi
pushfd
push dword [esp + 0x24]
ret 0x28
lea esp, [esp + 8]
je 0x5bee4d
lea eax, [esp - 0x6a3cf96a]
movzx ax, cl
push ecx
mov eax, 0xc0000001
pushfd
pushal
pushfd
lea esp, [esp + 0x2c]
jmp fcn.005d3844
cmp dword [ebp - 8], 0
push edx
lea esp, [esp + 4]
jne 0x5bb504
bswap cx
rdtsc
pushal
mov eax, dword [ebp + 0x1c]
pushfd
xchg dword [esp + 0x20], eax
pop ecx
not cl
mov ecx, dword [ebp + 0x18]
pushal
bswap edx
mov dword [esp + 0x38], ecx
rdtsc
mov edx, dword [ebp + 0x14]
pop eax
push 0xa76995db
push 0x379e5bfd
movsx cx, bl
xchg dword [esp + 0x38], edx
lahf
pushfd
mov eax, dword [ebp + 0x10]
xchg cx, dx
call fcn.005d96a8
jmp 0x5b0c4a
jmp 0x5d7776
lea esp, [esp + 0x30]
je 0x5d3958
pushal
stc
push dword [esp + 4]
stc
cmp dword [ebp + 0x18], 4
mov byte [esp], bl
lea esp, [esp + 0x24]
jne 0x5dd5a1
pushfd
clc
push eax
cmp dword [ebp + 0x14], 8
jmp 0x5b3a21
pushfd
xchg dword [esp + 4], edi
mov byte [esp], dh
push dword [esp + 4]
ret 8
aam 0x24
daa
mov edx, dword [ebp + 0x10]
aas
btr ecx, ecx
ror ah, cl
mov dword [ebp - 8], edx
bts ax, di
xor ecx, 0xfe518e5c
sub eax, 0x6a56bb09
mov eax, dword [ebp - 8]
xor cl, bh
and cl, 0x75
sal ch, cl
pushal
mov dword [eax], 7
adc ch, 0xaa
shrd ecx, edi, 9
shrd cx, dx, 3
sal ch, cl
mov ecx, dword [ebp - 8]
call fcn.005da97d
stc
mov dword [ebp - 8], 1
cmc
cmp ecx, 0x14e9c889
jmp 0x5be9bc

Function at 0x5c6a41
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi - 0x4122520c]
push 6
adc byte [ebp + 0x3e08fe94], cl
xor byte [esi + 0x45], ah
add byte [edi + 0x2a6705f0], ah
jae 0x5c6a57
inc eax
dec ebx
cmpsb byte [esi], byte es:[edi]
inc ebp
sub al, 0x9e
test eax, 0xf8b5f3ba
lahf
loop 0x5c6a18
stosd dword es:[edi], eax
cmp al, byte [esi + 0x48913ebd]
xchg byte [ebp + 0x50], bl
xor byte [edi - 0x47902302], dl
dec eax
xchg ebp, eax
das
adc ch, byte [esp + edi*2]
push esi
jne 0x5c6a1e
jb fcn.005c69e2
sub al, 0x81
enter 0xfffffffffffff49d, 0xffffffffffffffad
cld
jmp 0x7d80dffb
Function at 0x6e616058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.6e6161a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x6e61607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6e61606a
add dl, dl
jne 0x6e616089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6e6160dc
xor eax, eax
add dl, dl
jne 0x6e616096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6e61617d
add dl, dl
jne 0x6e6160a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6e6160b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6e6160bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6e6160c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x6e6160d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x6e616075
mov eax, 1
add dl, dl
jne 0x6e6160ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6e6160f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6e6160e1
sub eax, ebx
mov ebx, 1
jne 0x6e616128
mov ecx, 1
add dl, dl
jne 0x6e61610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6e616119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6e616105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6e616075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6e61613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6e61614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6e616136
cmp eax, 0x7d00
jae 0x6e61616d
cmp eax, 0x500
jb 0x6e616168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6e616075
cmp eax, 0x7f
ja 0x6e616170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6e616075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x6e61619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x6e616075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x417db0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x417e12
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
cmp esi, 0x400000
mov eax, 0x400000
ja 0x417ddf
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x417e17
test ecx, ecx
je 0x417e10
test esi, esi
ja 0x417dd0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x417e30
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x417e92
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
cmp esi, 0x400000
mov eax, 0x400000
ja 0x417e5f
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x417e97
test ecx, ecx
je 0x417e90
test esi, esi
ja 0x417e50
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x418200
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x546fc0], ecx
add edx, 1
cmp edx, 0x100
jl 0x418202
cmp edx, 0x800
jae 0x4182eb
mov edi, edi
mov eax, dword [edx*4 + 0x546bc0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x546fc0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x546fbc], eax
jb 0x4182c0
mov dword [0x543960], 0x41a830
call fcn.0041aa00
test eax, eax
jne 0x418308
mov dword [0x543960], 0x41a8e0
ret
Function at 0x41e880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x41e899
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp 0x41e8c0
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x41e8df
jmp 0x41e8d0
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x41e8df
add edi, 1
cmp edi, edx
jb 0x41e8d0
mov eax, edi
sub eax, ecx
mov ecx, eax
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x41e9f5
cmp ecx, 3
jbe 0x41e915
xor ebp, ebp
mov cl, byte [edi + 4]
test cl, cl
mov dword [esp + 0x1c], eax
je 0x41e953
cmp cl, 0xff
je 0x41e953
and ebp, 3
add ebp, ebp
or ebp, 1
add eax, 1
jmp 0x41e8c0
add ecx, 0xffffffff
shl ebp, cl
and ebp, 7
je 0x41e8f8
movzx ecx, byte [ebp + 0x4fc9c4]
mov ebx, edi
sub ebx, ecx
cmp byte [ebp + 0x4fc9bc], 0
mov cl, byte [ebx + 4]
je 0x41e93f
test cl, cl
je 0x41e93f
cmp cl, 0xff
jne 0x41e8f8
and ebp, 3
add ebp, ebp
mov dword [esp + 0x1c], eax
or ebp, 1
add eax, 1
jmp 0x41e8c0
xor edx, edx
mov dh, cl
movzx ecx, byte [edi + 2]
mov dl, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea esp, [esp]
cmp dword [esp + 0x28], 0
je 0x41e97e
lea ebx, [edx + eax]
add ebx, esi
jmp 0x41e984
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x41e9c6
movzx esi, byte [ebp + 0x4fc9c4]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x41e9a9
cmp dl, 0xff
jne 0x41e9c2
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
sub edx, 1
xor edx, ebx
jmp 0x41e970
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
sub dl, 1
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x41e8c0
cmp ecx, 3
pop edi
pop esi
pop ebx
jbe 0x41ea08
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
add ecx, 0xffffffff
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret

Function at 0x425a10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x425a2d
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call fcn.004259f0
add esp, 4
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x425a4d
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x2f
je 0x425a4d
push str.Comments_must_start_with__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
call fcn.00425a70
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov esp, ebp
pop ebp
ret 4