joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100168b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [0x10a6d548]
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
test ebx, ebx
je 0x100169b3
mov eax, dword [0x10a6d540]
mov edx, dword [ebp + 8]
add eax, 0x14
nop dword [eax]
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, edx
jne 0x100168fd
inc esi
add eax, 0x2c
cmp esi, ebx
jb 0x100168e0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100169b3
xor eax, eax
test edx, edx
setne al
push eax
lea eax, [ebp - 0x10]
push 0xffffffffffffffff
push eax
call fcn.10016d50
mov edx, dword [0x10a6d548]
add esp, 0xc
cmp esi, edx
jae 0x10016967
mov ecx, dword [ebp + 8]
imul ebx, esi, 0x2c
nop dword [eax]
mov eax, dword [0x10a6d540]
movzx eax, byte [ebx + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ecx
je 0x1001695c
push ecx
push esi
call fcn.10016a80
mov edi, eax
add esp, 8
test edi, edi
jne 0x10016964
mov edx, dword [0x10a6d548]
mov ecx, dword [ebp + 8]
inc esi
add ebx, 0x2c
cmp esi, edx
jb 0x10016930
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100169b3
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x100169a4
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10016998
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10016977
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x10a6c804]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016a80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
imul esi, dword [ebp + 8], 0x2c
mov eax, 5
push edi
mov dword [ebp + 8], eax
add esi, dword [0x10a6d540]
test byte [esi + 0x14], 1
mov edi, dword [esi]
je 0x10016aaa
sub edi, eax
mov eax, 7
mov dword [ebp + 8], eax
lea ecx, [ebp - 4]
push ecx
push 0x40
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10016ac7
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10016aec
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10016b0d
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10016b0d
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10016b07
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10016b0d
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
and cl, 0xfb
or cl, bl
xor eax, eax
pop ebx
pop edi
mov byte [esi + 0x14], cl
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10016bb0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x10016c97
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10016c90
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x10016c76
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10016c76
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10016c76
mov ecx, dword [esi]
test ecx, ecx
jne 0x10016c3f
push 0x200
push ecx
mov dword [esi + 4], 0x80
push dword [0x10a6c804]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x10016c8f
jmp 0x10016c68
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10016c68
shl eax, 3
push eax
push ecx
push 0
push dword [0x10a6c804]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x10016c8f
mov ecx, dword [esi + 4]
add ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edx, dword [esi + 8]
mov ecx, dword [esi]
mov eax, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10016c00
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret
Function at 0x10016d50
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10016bb0
add esp, 4
cmp dword [esi], 0
je 0x10016dbc
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10016dbb
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10016db4
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10016fb0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10016d82
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x100170f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0
je 0x10017140
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x1001712f
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10017128
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10017105
pop ebx
push dword [edi]
push 0
push dword [0x10a6c804]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebp
ret
Function at 0x10018960
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10018b10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10018a2d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10149bc8]
jb 0x100189aa
mov eax, dword [ebp - 4]
cmp eax, dword [0x10149bcc]
ja 0x100189aa
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1001897a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001e7e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100189d0
jmp 0x10018a2d
cmp dword [ebp - 0x14], 0x10000
jne 0x10018a13
cmp dword [ebp - 0x18], 0x10000
jb 0x10018a13
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10018a06
mov eax, dword [ebp - 8]
jmp 0x10018a2f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10018a28
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10018b10
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1001897a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10018a40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10018b40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10018b05
mov edx, dword [ebp - 4]
cmp edx, dword [0x10149bc8]
jb 0x10018a85
mov eax, dword [ebp - 4]
cmp eax, dword [0x10149bcc]
ja 0x10018a85
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10018a55
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001e7e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10018aab
jmp 0x10018b05
cmp dword [ebp - 0x14], 0x10000
jne 0x10018aee
cmp dword [ebp - 0x18], 0x10000
jb 0x10018aee
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10018ae1
mov eax, dword [ebp - 8]
jmp 0x10018b07
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10018b00
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10018b40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10018a55
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10018b70
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10018f60
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10a6cb00], 0
jne 0x10018bad
cmp dword [0x10a6cafc], 0
je 0x10018bad
mov eax, dword [0x10a6cafc]
mov dword [0x10a6cb00], eax
cmp dword [0x10a6cb00], 0
je 0x10018c2a
mov ecx, dword [0x10a6cb00]
cmp dword [ecx + 8], 0
je 0x10018c2a
mov edx, dword [0x10a6cb00]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10018c2a
mov ecx, dword [0x10a6cb00]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10018c2a
mov eax, dword [0x10a6cb00]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10018bf9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10018c00
xor eax, eax
jmp 0x10018d49
mov ecx, dword [0x10a6cb00]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001e7e0
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10018d49
mov edx, dword [0x10a6cafc]
mov dword [0x10a6cb00], edx
jmp 0x10018c46
mov eax, dword [0x10a6cb00]
mov ecx, dword [eax + 4]
mov dword [0x10a6cb00], ecx
cmp dword [0x10a6cb00], 0
je 0x10018c86
cmp dword [0x10a6cb00], 0
je 0x10018c84
mov edx, dword [0x10a6cb00]
cmp dword [edx + 8], 0
je 0x10018c84
mov eax, dword [0x10a6cb00]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10018c84
mov edx, dword [0x10a6cb00]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10018c84
jmp 0x10018bde
jmp 0x10018c38
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10018d50
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10018d47
mov eax, dword [ebp - 0x18]
mov dword [0x10a6cb00], eax
mov ecx, dword [0x10a6cb00]
mov dword [ecx], 0x52727464
mov edx, dword [0x10a6cb00]
mov dword [edx + 8], 0
mov eax, dword [0x10a6cb00]
mov ecx, dword [0x10a6cafc]
mov dword [eax + 4], ecx
mov edx, dword [0x10a6cb00]
mov dword [0x10a6cafc], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10a6cb00]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10018d17
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10018d37
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x10018d0e
mov eax, dword [0x10a6cb00]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10018bde
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002ca46
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002c8c5

Function at 0x10031425
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100310e5
Function at 0x4062ca
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4062ee
xor eax, eax
test eax, eax
je 0x406300
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406300
xor ecx, ecx
jmp 0x406303
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4063ef
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x448e04], 0
push esi
jne 0x406426
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406400
mov dword [ecx*4 + 0x448e00], eax
inc ecx
cmp ecx, 0x100
jl 0x4063fb
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406457
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x448e00]
xor eax, esi
inc ecx
dec edx
jne 0x406439
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40829a
Capabilities:
Encode data using xor

Disassembly:
leave
add ah, byte [esi - 0x3f]
cli
ret
mov dword [esp + 8], 0x1f15fcff
lea esp, [esp + 8]
call fcn.004080b4
mov cl, 0x45
nop
inc edx
scasb al, byte es:[edi]
adc eax, ebx
movsb byte es:[edi], byte [esi]
jne 0x4082e2
salc
js 0x408249
sub edx, ebx
lcall 0xa04c, 0xfce040c7
lea edx, [ebx + 2]
sbb ah, dh
aas
mov ecx, 0xb88fc9d1
xor eax, 0xc57a1da5
mov ss, esi
xchg edi, eax
xchg esp, eax
mov esp, 0x48252078
invalid
je 0x408302
int1
or ch, al
int1
rcr byte [edi + 0xe187944], cl
test dword [ebx + 0x10], esp
mov al, byte [0x9486b464]
sal ebp, 0x40
invalid
and dword [esi + 0x46], eax
sbb eax, 0xea42ce7f
mov al, byte [0xa6e74958]
ror ebx, 0x4e
imul eax, dword [edi + 0x49], 0x68
stosb byte es:[edi], al
rol dword [ecx], cl
xchg ebp, eax
adc esi, 4
or byte [esp + 1], 0xb3
shld ax, dx, cl
sar word [esp + 2], 0x68
mov word [esi], ax
call fcn.004361d8
mov ecx, 0x8ba88e8a
mov edx, dword [esi]
movzx ax, byte [edx]
movzx edx, cx
shr ecx, cl
lea esi, [esi + ecx*2 - 0x45d444]
and ecx, ecx
mov word [esi + ecx*2 - 0x45d446], ax
movzx eax, dl
shl dl, 0x46
inc cl
lea edi, [edi + ecx*2 - 0x45d44c]
mov eax, dword [edi + ecx - 0x22ea24]
btr edx, 9
xor eax, ebx
ror eax, 1
not eax
push edx
lea eax, [ecx + eax - 0x2f3e0a2b]
bswap eax
call fcn.004117fd
xchg esi, eax
mov eax, 0x71654812
mov bh, 0x87
mov ecx, 0xd57958e5
lodsd eax, dword [esi]
mov byte [0xdb1db29e], al
nop
push 0xffffffffffffff8e
and al, 0x6b
loope 0x408382
in eax, dx
ljmp 0x8e13
Function at 0x42016d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.0040dfd0
inc ecx
bswap edx
add eax, eax
xor ebx, edx
add ebp, edx
movsx edx, ax
jmp 0x43b27c
xadd dl, ah
xor ecx, ebx
rol edx, 0x1f
not eax
neg ecx
inc ecx
btc edx, edx
jb 0x43a8b0
rol ecx, 3
neg ecx
xor ebx, ecx
mul al
neg edx
add ebp, ecx
neg dl
movsx ecx, ax
push edx
mov edx, dword [esi + edx - 0x7f7ff537]
mov ecx, dword [esi + 4]
add eax, dword [esp]
not eax
bt eax, 0x99
adc esi, 4
xadd byte [esp + 3], ah
not edx
setg al
and ax, word [esp + 2]
cmovle ax, word [esp + 2]
not ecx
sbb ax, ax
rol eax, 0x36
not word [esp + eax*2 - 0x404000]
or edx, ecx
not word [esp + eax*8 - 0x100fffe]
btc eax, 0xe
mov dword [esi + eax - 0x206000], edx
mov dword [esp + eax*8 - 0x1030000], ebp
ret
inc eax
rol dword [esp + ecx*4 - 0x27904], 0x27
jb 0x4115e8
cmp ch, byte [ebx]
sti
imul ebp, edx, 0xf540c7c9
lds edi, [0x13538df3]
dec ebx
mov ch, 0x3f
mov ecx, 0xb8dc9484
xor eax, 0xc52910a8
mov bl, 0xab
les edx, [esp + edi*4 + 0x4955d2e5]
lcall 0x525f, 0x61626ece
push es
mov bl, 0xc2
cmp dword [ebx - 0x7d], ebp
mov esp, 0xebd0f93c
or dl, ch
sbb word [bx + si + 0x4098], si
invalid
pushfd
shr edi, 0x16
add di, di
mov esi, 0xa9a2a4a6
mov esi, edx
adc edi, 0xea0a9181
bswap edi
inc edi
mov edi, eax
jp 0x431409
btc ecx, eax
xchg ecx, eax
sbb edx, 0x94a26fa9
sub word [esp + eax - 0xec], cx
not al
setbe cl
xor ebx, edx
not dword [esp + eax*4 - 0x38]
add ebp, edx
mov eax, dword [esi + eax*2 - 0x1e]
lea ecx, [ecx + ecx*2 + 0x5e37f404]
pop ecx
shr cl, 0x44
mov edx, dword [esi + ecx*4 + 4]
rol byte [esp + ecx + 2], 0x65
sar cl, 0x42
inc cl
mov cl, byte [esi + ecx + 7]
sar dword [esp + 4], 0x59
jns 0x40b3a1
adc esi, 5
xor word [esp + 5], 0xd21b
call fcn.004380ad
lea eax, [eax + ecx + 0x5a980740]
shl dword [esp + ecx*2 - 0x13c82], cl
rol eax, cl
dec dword [esp + ecx - 0x9e41]
jnp 0x41fd3d
not eax
setge dl
sub dx, dx
jns 0x40ec11
mov dword [esp + edi*2 - 0x3032471a], esi
lea edi, [edi*4 - 0x1ff9eeb]
jmp 0x40fc9a
bswap edx
xor eax, ebx
push edx
rol cl, 0x65
jb 0x40ff5b
mov eax, edx
imul ax
mov ecx, dword [edi + eax - 0xda40]
jo 0x40d9bd
sar ecx, cl
mov cl, byte [ecx + edi - 0x50]
pop edx
btr dx, dx
movzx eax, dx
lea edi, [eax + edi - 0x48c0]
xor cl, bl
rol dx, 0x4e
not cl
rol cl, 1
call fcn.0041c1f0
mov eax, dword [esi]
jmp 0x40740a
jno 0x406a5c
mov edx, 0x70149fbd
movzx ecx, dx
mov eax, dword [ecx + edi - 0x9fbd]
btc cx, 0xa8
sbb cl, 0xb2
lea edi, [edx + edi - 0x70149fb9]
jae 0x428cc7
mov ecx, 0x78aa4898
movsx edx, cx
lea edi, [edi + edx*2 - 0x9134]
jmp 0x42f8f7
Function at 0x42146e
Capabilities:
Authenticate hmac

Disassembly:
mov word [esi], dx
rol al, 0x24
mov ecx, dword [edi]
mov edx, 0x15b83f0a
sal byte [esp + edx*2 - 0x2b707e14], 0xe5
push edx
lea edi, [edi + edx*4 - 0x56e0fc24]
cwde
shl eax, 0x7b
xchg al, dl
xor ecx, ebx
xadd word [esp + edx - 0x15b83efe], ax
imul al
or eax, edx
dec ecx
call fcn.00422983
neg dl
sub dl, al
mov dword [esp], eax
xor cx, 0xd3b5
sal ax, 0x2e
xor dl, 0x36
add dl, 0x31
not dl
dec ax
xor bl, dl
dec eax
pop eax
sub esi, 2
or dword [esp], 0x3f06fd18
jns 0x40a4e5
xor eax, 0xf72320b4
shl edx, 0x49
lea eax, [eax + edx - 0x671c12f7]
adc edx, ecx
neg edx
shr edx, 0x39
xor ebx, eax
xor dl, 0xb0
btc cx, cx
add ebp, eax
jmp 0x43b27c
Function at 0x40a330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40a33f
pop dword [ebp - 0x44]
mov eax, 0x7c318f76
sub eax, 0x7bf0ec37
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x565b4e82
add dword [ebp - 0x54], 0xf7f6f6c9
mov dword [ebp - 0x50], 0xc3017b63
add dword [ebp - 0x50], 0x6f31d0e2
mov dword [ebp - 0x4c], 0x5f855d2
sub dword [ebp - 0x4c], 0xb9ac11a4
mov dword [ebp - 0x48], 0xe36e7849
sub dword [ebp - 0x48], 0xe36e7849
lea eax, [ebp - 0x54]
push eax
mov eax, 0x8351a64
add eax, 0xf80c361c
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xc640a271
add dword [ebp - 0x54], 0xae31c6e5
mov dword [ebp - 0x50], 0x14e63f00
sub dword [ebp - 0x50], 0xd379dd8b
mov dword [ebp - 0x4c], 0x576fd814
sub dword [ebp - 0x4c], 0xf4006ba8
mov dword [ebp - 0x48], 0x9b54e2f6
add dword [ebp - 0x48], 0x64ab1d0a
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xa43f6906
sub eax, 0xa3fe18ba
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x38c96
push 0
call eax
mov ecx, 0x524bcc0c
sub ecx, 0x524b8b0b
mov edx, eax
mov esi, 0x41f400
add esi, dword [ebp - 0x44]
mov ebx, 0x9e8094db
add ebx, 0x97f24617
mov dword [ebp - 0x1c], 0xaa162f7f
mov edi, dword [esi]
xor dword [ebp - 0x14], 0x33958407
sub edi, ebx
add dword [ebp - 0x2c], 0xaa8d4d51
mov dword [edx], edi
xor dword [ebp - 0x14], ecx
add edx, 0x8fd2b528
sub edx, 0x8fd2b524
add esi, 0x6362ac7
add esi, 0xf9c9d53d
loop 0x40a45b
add eax, 0xf6d7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x410a37
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x410a76
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x410a76
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410a76
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x410a76
cmp dword [ecx + 0x74], 0xe
jbe 0x410a76
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10