joyce8/EMBER2024-capa huggingface dataset:
Function at 0x25680e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x25680f7
add esp, 0xfffffff0
call fcn.024986f0
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0249835c
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x256811d
cmp dword [esi + 0x58], 0x40
jb 0x2568303
jmp 0x2568123
jl 0x2568303
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.0249c9c8
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.025679e8
cmp word [ebx + 0xc], 0x5a4d
jne 0x2568303
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x2568303
cmp ecx, 0x10000
jge 0x2568303
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x256817e
cmp eax, dword [esi + 0x58]
ja 0x2568303
jmp 0x2568184
jg 0x2568303
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.0249c9c8
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.025679e8
cmp dword [ebx + 0x4c], 0x4550
jne 0x2568303
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.0249c9c8
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.025679e8
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x256823b
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x25681ff
cmp eax, dword [esi + 0x58]
ja 0x256828c
jmp 0x2568205
jg 0x256828c
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.0249c9c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.025679e8
mov byte [ebx + 4], 1
jmp 0x256828c
cmp ax, 0x14c
jne 0x256828c
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x256825c
cmp eax, dword [esi + 0x58]
ja 0x256828c
jmp 0x256825e
jg 0x256828c
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.0249c9c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.025679e8
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x2568303
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x25682bd
cmp eax, dword [esi + 0x58]
ja 0x2568303
jmp 0x25682bf
jg 0x2568303
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x2567470]
call fcn.0249a99c
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.025679e8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x256831a
call fcn.02498748
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x2569000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x25690bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x25690b1
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x256909a
test esi, esi
jbe 0x25690b1
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0249f644
test eax, eax
jne 0x256908c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x25690b1
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x2569069
jmp 0x25690b1
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x25690b1
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x25690c6
ret
Function at 0x2569ae0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x2569c8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.02499980
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x2569b1b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x2569b34
lea eax, [ebp - 0x10]
mov edx, dword [0x25c9f00]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.024999e0
jmp 0x2569b47
lea eax, [ebp - 0x10]
mov edx, dword [0x25c9f00]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.024999e0
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x2569b53
adc edx, 0
mov edx, dword [edx*4 + 0x25b78ac]
call fcn.02499bec
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.02499bd0
push eax
call fcn.0249bb4c
mov esi, eax
cmp esi, 0xffffffff
je 0x2569c61
mov eax, 0x40
call fcn.02497714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.0249bf5c
test eax, eax
je 0x2569c54
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x2569c54
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.0249bfcc
mov eax, edi
call fcn.02497734
mov eax, 0x18
call fcn.02497714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.0249bf5c
test eax, eax
je 0x2569c54
mov eax, edi
cmp dword [eax], 0x4550
jne 0x2569c54
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x2569c54
cmp dx, 0x150
ja 0x2569c54
mov eax, edi
call fcn.02497734
mov eax, 0xe0
call fcn.02497714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.0249bf5c
test eax, eax
je 0x2569c54
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x2569c54
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.024999bc
mov eax, edi
call fcn.02497734
push esi
call fcn.0249bb04
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.02499cf8
jne 0x2569c79
inc ebx
cmp ebx, 0x19
jne 0x2569b0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2569c96
lea eax, [ebp - 0x10]
call fcn.02499980
ret
Function at 0x2569f9c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
xor ebx, ebx
push 0
push 0
push 0
push edi
call fcn.0249bfcc
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call fcn.0249bf5c
test eax, eax
je 0x256a039
cmp word [esi], 0x5a4d
jne 0x256a039
push 0
push 0
mov eax, dword [esi + 0x3c]
push eax
push edi
call fcn.0249bfcc
push 0
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.0249bf5c
test eax, eax
je 0x256a039
cmp dword [ebp - 0x1c], 0x4550
jne 0x256a039
lea edx, [ebp - 0x18]
mov ecx, 0x14
mov eax, dword [ebp + 0xc]
call fcn.0249c9c0
mov ax, word [ebp - 0x18]
cmp ax, 0x14c
jb 0x256a039
cmp ax, 0x150
ja 0x256a039
push 0
lea eax, [ebp - 4]
push eax
push 0xe0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.0249bf5c
test eax, eax
je 0x256a039
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2585d58
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x2585d86
mov eax, ebx
call fcn.0258680c
cmp dword [ebx + 0x40], 0
je 0x2585d7f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x2585df7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x2585de9
cmp dword [ebx + 8], 0
je 0x2585da8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x2585dba
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x2585de9
cmp dword [ebx + 8], 0
je 0x2585d9b
cmp eax, 3
je 0x2585dcd
dec eax
jne 0x2585d9b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x2585d9b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x2585d9b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x2585e15
cmp dword [ebx + 0x14], 0xcc
je 0x2585e15
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.02585e20
pop ebx
ret
Function at 0x259e3a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x25d6594
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x259e3c2
shr eax, 1
xor eax, 0xedb88320
jmp 0x259e3c4
shr eax, 1
dec edx
jne 0x259e3b0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x259e3a9
mov byte [0x25d6994], 1
pop esi
pop ebx
ret

Function at 0x259e3e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x25d6994], 0
jne 0x259e3f7
call fcn.0259e3a0
mov eax, edi
dec eax
test eax, eax
jl 0x259e420
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x25d6594]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x259e401
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x25a0e80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x25a0eb1
dec al
je 0x25a0eed
dec al
je 0x25a0f31
dec al
je 0x25a0f9c
jmp 0x25a1026
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x25a1026
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x25a0ec1
jmp 0x25a1026
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x25a1026
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x25a0efd
jmp 0x25a1026
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x25a1026
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x25a0f5f
xor ebp, ebp
jmp 0x25a0f70
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x25a0f79
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x25a0f41
jmp 0x25a1026
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x25a1026
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x25a0ff4
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0259e428
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x25a0fb0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x280dee8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x280deee
pop ebp
sub ebp, 6
sub ebp, 0x80dee8
jmp 0x280df4c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x280df63
mov eax, 0x2552a14
jmp eax
jmp 0x280df6c
mov eax, 0x80dee8
add eax, ebp
add eax, 0xaa
mov ecx, 0x5bd
mov edx, 0x1c384b3d
xor byte [eax], dl
inc eax
dec ecx
jne 0x280df83
jmp 0x280df96
mov ecx, ebp
mov ecx, dword [ecx + 0x3c]
add ecx, 0xf8
add ecx, ebp
mov eax, 0xb
mov edx, 0x28
mul edx
add ecx, eax
mov eax, dword [ecx + 0xc]
add eax, ebp
push eax
push eax
push 0xd32cc
push 0x73ac1a
add dword [esp], ebp
push 0xa323bded
call fcn.0280dfda
jmp 0x280e002
mov ecx, dword [esp + 4]
push 0xd32cc
push 0x73ac1a
add dword [esp], ebp
push ecx
call fcn.0280e021
jmp 0x280e260
pop edi
pop esi
jmp 0x280e26b
mov eax, 0x80dee8
add eax, ebp
add eax, 0x3a9
mov ecx, 0x2be
mov edx, 0x7ea6b8ca
xor byte [eax], dl
inc eax
dec ecx
jne 0x280e282
jmp 0x280e295
xchg esi, edi
xchg edi, esi
mov esi, dword [edi + 0x3c]
xchg edi, esi
mov edi, dword [edi + esi + 0xa0]
add edi, esi
lea ebx, [esi]
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x34]
sub ebx, eax
xchg edx, edi
mov edi, dword [edx]
xchg edx, edi
xchg ecx, edi
mov edi, dword [ecx + 4]
xchg ecx, edi
cmp edx, 0
je 0x280e316
add edx, esi
add edi, 8
sub ecx, 8
cmp ecx, 0
je 0x280e2b6
mov ax, word [edi]
shr eax, 0xc
and eax, 0xf
cmp eax, 3
jne 0x280e30c
mov ax, word [edi]
and eax, 0xfff
add eax, edx
add dword [eax], ebx
dec ecx
dec ecx
add edi, 2
jmp 0x280e2de
jmp 0x280e31f
mov eax, 0x80dee8
add eax, ebp
add eax, 0x45d
mov ecx, 0x20a
mov edx, 0x8a311b1b
xor byte [eax], dl
inc eax
dec ecx
jne 0x280e336
jmp 0x280e349
mov edi, dword [esi + 0x3c]
mov edi, dword [edi + esi + 0x80]
add edi, esi
cmp dword [edi + 0xc], 0
je 0x280e3f4
xchg edi, eax
mov edi, dword [eax + 0xc]
xchg edi, eax
add eax, esi
push eax
call dword [ebp + 0x71325c]
cmp eax, 0
jne 0x280e385
mov eax, dword [edi + 0xc]
add eax, esi
push eax
call dword [ebp + 0x713268]
cmp dword [edi + 0xc], 0
je 0x280e3f4
cmp dword [edi], 0
jne 0x280e3a3
cmp dword [edi + 0x10], 0
je 0x280e3e8
push ebp
mov edx, ebp
mov ebp, dword [edi + 0x10]
add ebp, esi
cmp dword [ebp], 0
je 0x280e3e8
mov ecx, dword [ebp]
push eax
push edx
or ecx, ecx
jns 0x280e3c8
push ecx
jmp 0x280e3d1
add ecx, esi
add ecx, 2
push ecx
push eax
call dword [edx + 0x713260]
pop edx
mov dword [ebp], eax
pop eax
add ebp, 4
jmp 0x280e3ab
pop ebp
add edi, 0x14
jmp 0x280e355
push esp
push dword fs:[0]
push 0x80e550
push ebp
push esi
xchg esi, eax
mov esi, dword [eax + 0x3c]
xchg esi, eax
mov eax, dword [eax + esi + 0x28]
add eax, esi
jmp eax

Function at 0x280dfda
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0x280dff2
pop ebp
ret 0xc
Function at 0x280e0a1
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x280e0d2
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x280e0b0
add dl, dl
jne 0x280e0e5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x280e155
xor eax, eax
add dl, dl
jne 0x280e0fa
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x280e22a
add dl, dl
jne 0x280e10d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x280e11c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x280e12b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x280e13a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x280e148
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x280e0c5
mov eax, 1
add dl, dl
jne 0x280e167
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x280e176
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x280e15a
sub eax, ebx
mov ebx, 1
jne 0x280e1bd
mov ecx, 1
add dl, dl
jne 0x280e19b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x280e1aa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x280e18e
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x280e0c5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x280e1d8
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x280e1e7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x280e1cb
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x280e0c5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x280e252
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x280e0c5
pop ebp
sub edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100076b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100076bf
pop dword [ebp - 0x50]
mov eax, 0x455b7405
sub eax, 0x355afd46
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x739d5d0e
add dword [ebp - 0x60], 0xdab4e83d
mov dword [ebp - 0x5c], 0x60822ef0
add dword [ebp - 0x5c], 0xd1b11d55
mov dword [ebp - 0x58], 0x43f6fb5e
add dword [ebp - 0x58], 0x85548d0
mov dword [ebp - 0x54], 0x59694674
sub dword [ebp - 0x54], 0x59694674
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x38517529
add dword [ebp - 0x60], 0x3c20f42d
mov dword [ebp - 0x5c], 0x1da79524
sub dword [ebp - 0x5c], 0xdc3b33af
mov dword [ebp - 0x58], 0xa2a88f13
sub dword [ebp - 0x58], 0x3f3922a7
mov dword [ebp - 0x54], 0x3bb334de
sub dword [ebp - 0x54], 0x3bb334de
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x393e0
push 0
call eax
mov ecx, 0x744627f3
add ecx, 0x8bba21fa
xor edx, edx
add edx, eax
mov ebx, 0xa21980c1
add ebx, 0x6de8b73f
add ebx, dword [ebp - 0x50]
mov esi, 0x599fcc75
add dword [ebp - 0x2c], edx
mov edi, dword [ebx]
add dword [ebp - 0xc], eax
sub edi, esi
xor dword [ebp - 0x24], 0x834461bb
mov dword [edx], edi
xor dword [ebp - 0x38], esi
add edx, 0x683fb1ee
add edx, 0x97c04e16
add ebx, 4
loop 0x100077d3
add eax, 0x6474de7b
sub eax, 0x6473c3f4
mov ebx, eax
add eax, 0x38bfd247
sub eax, 0x38bfd242
mov ecx, 0x43a68607
sub ecx, 0x33a68607
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1000b110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b168
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b168
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.100076b0
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000b700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x495b0f
Capabilities:
Encode data using xor

Disassembly:
wait
fcomp qword [eax]
cmp eax, 0x17041859
fisttp dword [esi - 0x12]
xchg esi, eax
add eax, 0xbd68bd8
push esi
sub ebp, esi
dec ebx
fcmovnu st(0), st(7)
inc esi
lodsd eax, dword [esi]
ljmp 0xfa05
imul edi, ebp, 0xffffffb1
invalid
jno 0x495af7
sbb eax, 0x692feb86
xor dword [ebx + edi], ebp
sub dword [edx - 0x2c64dd5], eax
cmp ebp, dword [ecx]
sub byte [ebx], 0xb2
cmp ebp, edi
jle 0x495a8a
cmp byte [edx + 0x33], bh
adc ebp, edx
popal
mov bl, 0xc2
and eax, 0x6ddeee84
and bl, byte [ebx]
std
cmpsd dword [esi], dword es:[edi]
sub ebp, ebx
dec ecx
pop eax
les ecx, [ebx + 0x36]
test dword [edi + 0x19b04a], esp
cld
adc eax, dword [esp + edx*8]
sbb eax, 0x43836cd6
jne 0x495aee
pop edx
jecxz 0x495ab2
lahf
xchg byte [esi - 0x34f5ae0a], dh
push ss
int3

Function at 0x495bfa
Capabilities:
Encode data using xor

Disassembly:
cld
and esi, dword [ebx - 0x53fff46f]
xchg ebx, ebp
sbb al, 0xd0
xchg dl, bl
fcompi st(5)
push ebx
or ebx, ebx
xchg edx, eax
lahf
xlatb
aam 0x5e
salc
cmp eax, 0x3b2ee906
pushal
in eax, dx
inc eax
fisubr word [esi + 0x4d]
xor cl, byte [edi]
jbe 0x495c1a
mov edi, 0x77cdbabe
inc esi
invalid
Function at 0x496d86
Capabilities:
Encode data using xor

Disassembly:
and al, 0x3d
fild qword [0x46e6098d]
push es
push esi
in eax, dx
or dword [ecx + ebp*2 + 0x15], eax
adc ebp, esp
jo 0x496df0
cmp dword [ebx], ebp
or eax, 0x1432d806
inc eax
pop ebp
popal
or dword [eax - 0x7d239a48], ebx
adc al, 0xde
and al, 1
fadd qword gs:[edx + 0x124de14]
adc esp, dword [ebp - 0x24]
sub dword [edx], esp
movsb byte es:[edi], byte [esi]
pushfd
push esp
xor eax, 0xaeccaa9c
or dh, al
lea edx, [ebp + ecx + 0x6e60e29d]
popfd
clc
pushfd
stosb byte es:[edi], al
int3
arpl word [esi], si
les ecx, [ebp + 0x57143620]
lcall 0x183f, 0x312f55fe
xor eax, 0x1d62e624
xor dword [edi], edi
sbb byte [0x1d62e624], dh
inc ebx
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
mov al, byte [0x97701739]
dec ebx
sub byte [edi + 0x29], dh
mov dword [esi + 0x6b], esi
leave
dec ebx
pop edx
imul edx, dword [esi], 0x26
jne 0x496dc6
aad 0x52
push edx
mov dword [0x25b8303e], eax
push edi
stosd dword es:[edi], eax
jne 0x496dd2
out dx, eax
test eax, 0x50884517
jns 0x496e63
add dh, ah
and dword [eax], ecx
jnp 0x496e6f
js 0x496da6
cmp eax, dword [ebx - 0x17]
out 0xfe, al
scasb al, byte es:[edi]
loopne 0x496db7
sbb dword [edx - 0x3546eaf8], 0x18b6ecfe
enter 0xffffffffffffdcc4, 0xffffffffffffff9d
jo 0x496df1
xchg ebp, eax
or al, 0x89
push ebx
adc cl, byte [edi]
inc edx
jnp 0x496eca
xor al, 0x42
adc al, 0x38
adc ah, byte [ecx + 0x21]
sbb esp, dword [ebp - 0x75]
salc
mov byte [0x8ef0ff24], al
sbb byte [eax], 0x75
fdiv qword [esi + 0x63]
and eax, 0x719ec0e6
xchg ebp, eax
push ebx
mov ch, byte [ebp + 0x244af9db]
fimul word [0xf3b56953]
and al, 0xde
or eax, 0xf3b56953
inc ecx
jbe 0x496e90
stosd dword es:[edi], eax
fcmovnb st(0), st(2)
push ds
int3
cmp byte [eax + 0x5f], bh
push 0xb6025055
test eax, 0x643aca9e
sbb byte ds:[eax - 0x17], dl
ror byte [eax - 0x6ec0ef97], cl
push eax
jmp 0x10b2f7b1
mov byte [ecx + 0x10], ch
aas
xchg ecx, eax
mov word [bx + di], gs
mov bl, 0x9d
mov eax, dword [0xda13447a]
sahf
inc edx
loope 0x496ed9
xrelease xchg dword [esi - 0x30], ecx
bound ecx, qword [edx + 0x59]
or eax, 0x248f23be
lea esi, [ecx + 0x3f03cd61]
add edi, dword [edi]
repne lodsd eax, dword [esi]
mov word [edx + 0x674bf0e2], es
ja 0x496edc
push 0x7dec1f3c
nop
invalid