joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5294be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x529525
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x529542
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x5295ab
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0057248e
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x52957e
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x52956e
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x5295a5
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x5295ff
inc edi
cmp edi, ecx
jb 0x529592
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.0055ce2e
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570d0a
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x5295a5
cmp dword [esi + 0x14], 0x10
jb 0x52960e
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x529628
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0057248e
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x52965e
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x52964e
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x52969c
cmp ecx, edx
je 0x529713
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x529684
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.005483fe
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0055cf5e
mov eax, esi
jmp 0x5295e4
or ecx, 0xffffffff
jmp 0x52969e
Function at 0x52993e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce2e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a61
push ecx
lea ecx, [esi + 0x18]
call fcn.0054915e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a78
push ecx
lea ecx, [esi + 0x24]
call fcn.0054906e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x531dde
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
daa
invalid
mov dh, 0x1a
pop ss
mov esi, 0x18090d40
cmp byte [edi + 0x49], bh
cwde
je 0x531d7e
or byte [ecx], ch
inc esp
salc
xor byte [ebx], 0x58
mov dword [ecx + edx], 0xb090c0a5
xor byte [eax + 0x57d838c3], cl
call 0xca4ef960
js 0x531db3
fnstenv [eax - 0x53]
xor eax, 0x134d3d62
inc eax
imul ebx, dword [ebx + 0x8039152], 0x7aefcff0
jp 0x531da3
jp 0x531da3
cmc
inc ecx
rol dword [ebx*2 - 0x1727577e], cl
mov byte [0xdab98aba], dl
pop esp
pushal
pop esi
cld
mov eax, 0x44a85a93
sub dword [eax], esi
push 0x3a2804d9
aad 0xe8
and dword [eax - 0x607473b], edx
jns 0x531de2
cmp dword [eax - 0x47a75730], ebx
push esp
salc
sbb byte [ebx + 0x48], ch
or esp, dword [eax]
call 0x12bd5c37
sub eax, 0x30a92b2a
sti
clc
rcr cl, 0x89
invalid
Function at 0x54883e
Capabilities:
Encode data using xor

Disassembly:
fstp xword [eax - 0x30]
push 0xe7c023ee
out dx, al
aas
dec edi
jmp 0x548887
loope 0x548872
jb 0x548802
mov byte [esp + ecx*8 - 0x1e03178a], bl
fld dword [esi - 0x7b6b55d7]
imul ebp, dword [ecx], 0x5411e848
sbb dword [ebx], eax
call 0x872e6a47
sub dword [edx + 0x29698494], ebp
dec eax
call 0x36ddc68
adc dword [ecx + ebx + 3], edx
jp 0x548874
push edi
in al, dx
jbe 0x548846
sub byte [eax], ch
cmp dword [eax], ebp
loop 0x548861
test byte [0x88b9f8f8], bh
invalid
push esp
or ebx, dword [0x50cfa2ad]
sbb eax, 0x50cfa2ad
cmp esp, edx
aad 0x37
fdivr dword [eax + 0x24]
push 0xf51b3cd4
shr dword es:[edx + 0x60], cl
shr dword [edx + 0x60], cl
push 0x60
imul edi, dword [edx], 0xbdff4699
lcall 0x6698, 0x58064cc8
fprem
jns 0x5488a9
push 0x29af780d
aaa
loope 0x5488e9
mov edx, 0xc6a9ab6a
cmc
inc edi
jb 0x548853
push 0xa0e7b96d
out 0x43, eax
aam 0x58
ja 0x5488ee
ret 0x3978
invalid
jns 0x5488cc
jo 0x548886
xchg ebp, eax
clc
test al, 0x14
xlatb
pop eax
pop eax
pop ebx
pop ds
pop ecx
mov al, byte [0xeb0aef89]
popal
mov eax, 0x76bf172f
imul ebx, dword [esi + 0x4d], 0x617fd8f8
aas
xchg byte [edi - 0x68], ch
mov edi, edx
aas
lea edi, [ebx + 0x77]
fmul dword [ebp - 0x365d1665]
sbb eax, 0xa76cd8d8
fstp xword [edi]
enter 0x6ed7, 0xffffffffffffffdf
in eax, 0xa2
call dword [edx + 0x184e3d6e]
sub dword [ebp - 0x7580616], ecx
mov ch, bl
jno 0x54896e
outsb dx, byte [esi]
invalid
js 0x548922
sbb cl, byte [ecx + 0x41fee710]
adc al, byte [ecx + 0xef280fa]
idiv dword [0xf554275a]
ret 0x87a1
test al, 0xb8
adc al, 4
stosd dword es:[edi], eax
arpl word fs:[eax + edi*2 + 0xb], ax
xor ecx, ebp
sbb dh, cl
add eax, 0xced6b915
push es
sub dh, byte [esi - 0x1f]
cmpsb byte cs:[esi], byte es:[edi]
or eax, 0xa9ad8dbc
dec ecx
fst dword [ecx]
add ecx, eax
adc edi, edx
nop
jae 0x548972
imul edx, dword [edx], 0xd8e84f42
sub byte [ebx + 0x5cd8b89d], al
sti
mov eax, 0x85fd36e
rcr dword [edi + 8], cl
push 0xc87fbbbe
in al, dx
inc eax
mov al, byte [0x390c2c48]
inc ebp
mov eax, 0xe80dc268
jne 0x5489a8
sub eax, 0xb9f7a9fe
fsub dword [ebx]
clc
clc
jmp 0xb8c2d3b0
Function at 0x572f4e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005a643e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573071
push ecx
lea ecx, [esi + 0x18]
call fcn.0059276e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573088
push ecx
lea ecx, [esi + 0x24]
call fcn.0059267e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5786e2
Capabilities:
Encode data using xor

Disassembly:
fimul word [ebp - 0x1ecb9678]
inc ebp
or dword [esi + edi*4 + 0x4e9ee374], 0x4f35074a
imul esi, dword [edi + 0x5a], 0x7bc35b45
add bh, ch
inc ecx
pop es
cmp dword [ebx], ebp
daa
call 0x92dff5ec
outsd dx, dword [esi]
inc esi
add eax, 0xd2eb6622
mov al, 0xc4
je 0x578601
mov eax, 0x76f98374
or dword [esi + 0x272368f4], edi
mov esi, 0x272368f4
test al, 0x8c
insb byte es:[edi], dx
jno 0x57865d
xchg edi, edi
mov bl, 0xba
or dh, ch
into
mov ah, 0x54
xchg edx, eax
cmp eax, 0xa5cf6b8e
jge 0x5786e1
sbb dword [esi], ebx
popal
shl byte [eax + 0x1a17d186], cl
or byte [edx], dl
insb byte es:[edi], dx
imul esp, dword [edx], 0xffffff96
mov eax, dword [0xd2fdf919]
sbb bh, dh
fimul word [eax + 0x46]
mov dh, 0xa4
cmpsb byte [esi], byte es:[edi]
sub al, 0xe
push 0xe56fe0fb
mov bh, 0xb6
sti
daa
push ss
push edx
sar eax, cl
mov es, word [ebx + 0x73]
invalid
push ds
loopne 0x578677
mov bl, 6
aaa
lodsd eax, dword [esi]
xchg edi, eax
xlatb
nop
retf
Function at 0x58f28e
Capabilities:
Authenticate hmac

Disassembly:
stosb byte es:[edi], al
cmc
and byte [eax], ch
sub dword [eax + ecx*2], 0x36
sub esp, dword [esp + edx*2]
and bl, byte [edx - 0x40c2d3d]
out 0xa4, al
out dx, eax
mov ds, word [esi - 0x3b]
mov ch, cl
invalid
mov esp, esp
push edi
outsb dx, byte [esi]
xchg ebp, eax
jne 0x58f234
jg 0x58f2f0
invalid
jo 0x58f34c
sbb cl, 0x5c
xchg ecx, eax
cld
daa
adc eax, 0x46a0219
add dword [eax], edx
sbb esp, dword [esi + 0x5a]
xchg esi, eax
out dx, eax
imul esi
into
sub al, 0x54
invalid
out 0x20, eax
mov eax, fs
adc eax, 0x3f9c4c83
xchg edx, ebx
xchg edi, eax
je 0x58f36f
jl 0x58f392
invalid
das
test dword [edi + 0x16ca5ad4], 0x5f7b6630
mov ebx, 0x9af98a07
in eax, dx
invalid
shr eax, 8
push esp
jg 0x58f3ca
stc
jb 0x58f3e6
dec ecx
adc al, 0x17
dec edi
sub dh, byte [eax + eax]
mov esp, dword [edx - 0x26c71517]
mov ebx, 0xcd4e3b83
cmp eax, 0xfb3bf6fe
or ecx, dword [ebx - 0x49189d3f]
or edx, dword [esi + 0x43]
salc
mov ah, byte [edi]
sti
test eax, 0xd5be0990
inc edx
inc esi
stosd dword es:[edi], eax
add al, 0x26
scasb al, byte es:[edi]
rcr cl, 0xfa
push 0x29b7aaa4
add dword [esi + 0x31], eax
inc esp
push esi
push esp
int 9
lahf
and bl, byte [ebp - 0x4bbbf9ca]
push esi
push es
inc esp
mov ah, 0x56
cmpsd dword [esi], dword es:[edi]
jmp 0x58f423
cmp al, 0x8b
into
cmc
push edi
xor eax, 0xa01a40eb
mov dh, 0xe1
out 0x6a, al
cmp bh, byte [ebp - 0x4182fa3e]
imul esi, dword cs:[ecx + edi*2], 0xb6cfd241
test al, 0xb7
sub al, 0x95
jmp 0x58f3df
iretd

Function at 0x5e305e
Capabilities:
Encode data using xor

Disassembly:
and ecx, ebp
sar ebp, 1
in al, 0xbd
lcall 0xa4a8, 0xc5a77fec
enter 0xffffffffffffb8dd, 0x53
fdiv qword [ebp + edx + 0x64]
mov bl, 0x71
outsd dx, dword [esi]
invalid

Function at 0x5f015e
Capabilities:
Encode data using xor

Disassembly:
sub dword [ecx - 0x16f38705], ebp
push ss
sub byte [edi], 0xe9
xchg edx, eax
sub byte [esi + 0x6ef18ec9], bh
sub byte [esp + edi], bh
cmp eax, 0xffffffff
inc ebx
cdq
mov edi, dword [edi]
bound esi, qword [edi]
nop
xor esp, dword [edx]
imul esp, eax, 0x53
sub dword [ebx - 0x3507a348], esp
inc ecx
rol byte [edi], 0x5b
or dword [edx - 0x73], eax
jae 0x5f017b
salc
mov esp, 0x1ba31550
dec esi
cmpsd dword [esi], dword es:[edi]
sar byte [eax], cl
adc byte [eax - 0x2c201638], cl
and bh, byte [ebp + edi*2 - 0x2eea03cd]
enter 0x3ab3, 0xffffffffffffffc7
mov esp, 0xa553a3d3
daa
mov al, 0x5b
pop esp
into
pmaxub mm1, mm1
mul byte [ebx + 8]
out 0x8f, eax
or al, 0x2e
dec edx
xchg ebx, eax
pushal
dec eax
mov eax, 0x8efd9f95
xchg edx, eax
invalid
Function at 0x6062fe
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.006397ee
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606421
push ecx
lea ecx, [esi + 0x18]
call fcn.00625b1e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606438
push ecx
lea ecx, [esi + 0x24]
call fcn.00625a2e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x63042e
Capabilities:
Encode data using xor

Disassembly:
or dword [0xcd403a8b], 0xffffffc3
rol bl, 1
mov ch, 0x63
lahf
lodsb al, byte [esi]
popfd
pop ds
mov eax, 0x94338c03
sahf
push eax
cmp byte [ebx + 0x33], dl
aad 0xd2
adc eax, 0x6c31f263
and byte [ebp + 0x2bdb9c53], bh
sbb eax, 0x924c3a83
movsd dword es:[edi], dword [esi]
adc esp, eax
add esp, dword [edx]
cmp esp, 0x9adca28e
movsd dword es:[edi], dword [esi]
bt dword [esi], 0xa3
mov eax, dword [eax - 0x52]
push 0x17121b0c
outsd dx, dword [esi]
cmp al, 0x40
adc ecx, dword [esi + 0x4f93202d]
xchg ebx, eax
dec edi
xchg ebx, eax
dec edi
xor byte [ebx - 0x5a2d2cba], 0x12
cdq
and dword [eax], 9
shl byte [ecx + 0x2b9c2fcd], 0x1e
xchg ebx, eax
adc byte [edi + 0x30], dh
mov ch, 0x80
xor cl, byte [ebp - 0x10]
scasd eax, dword es:[edi]
sahf
imul esp, esi, 0xffffffb6
jne 0x6303e2
pop esi
std
and al, ah
dec edi
bound eax, qword [eax + 0x2c9913c0]
cmc
cmp eax, 0x53ba7d34
push cs
or al, 0x10
stosb byte es:[edi], al
add al, byte [ebx]
xchg edx, eax
call 0x900c080b
mov edx, 0x4e7691b8
xor bl, byte [edi + 0x30]
mov eax, 0xde939647
dec ebp
push edx
sbb eax, 0x2ce8bc7e
cmc
pop ebp
xor ecx, dword [ebp - 0x7b]
xchg esi, eax
lodsd eax, dword [esi]
ret
Function at 0x64d5ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x655338
cmp edx, dword [eax]
je 0x64d60f
add eax, 8
inc ecx
cmp eax, 0x6553c8
jl 0x64d600
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x655338]
jne 0x64d73d
test dword [ecx + eax], ebx
add byte [eax], al

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001440
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x1001e57c]
push esi
test ebx, ebx
jne 0x10001497
push 0x28
call fcn.10003c6b
mov ebx, eax
add esp, 4
mov dword [ebp - 0xc], ebx
mov dword [0x1001e57c], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x24], 0
mov eax, dword [0x1001e5d0]
lea edx, [ebp - 8]
push 1
push edx
mov dword [ebp - 0xc], str.IStream__::TVPCreateIStream_const_ttstr__tjs_uint32_
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
xor esi, esi
push edx
push eax
mov dword [ebp - 4], esi
call dword [ecx + 4]
add esp, 0x10
test al, al
jne 0x100014e8
mov eax, dword [0x1001e5d0]
lea edx, [ebp - 8]
push 1
push edx
push 0x1001d904
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
add esp, 0x10
test al, al
jne 0x100014e2
mov dword [0], esi
push dword [ebp - 0xc]
call dword [ebp - 8]
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x10001548
xor esi, esi
cmp byte [edi], 0xcc
je 0x10001546
mov eax, edi
mov ecx, 0x558b
mov edx, 0x4d8b
cmp word [eax], cx
jne 0x10001534
add esi, 2
cmp byte [esi + edi], 0xc
lea eax, [esi + edi]
jne 0x10001534
inc esi
cmp word [esi + edi], dx
lea eax, [esi + edi]
jne 0x10001534
add esi, 2
cmp byte [esi + edi], 8
lea eax, [esi + edi]
jne 0x10001534
inc esi
cmp byte [esi + edi], 0xe8
lea eax, [esi + edi]
je 0x10001565
mov ecx, eax
call fcn.10002b40
add esi, eax
cmp byte [esi + edi], 0xcc
lea eax, [esi + edi]
jne 0x100014f9
xor esi, esi
cmp dword [ebx + 4], 0
pop edi
je 0x10001625
cmp dword [ebx + 0xc], 0
je 0x10001625
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + edi]
lea edi, [eax + 5]
add edi, dword [eax + 1]
je 0x10001546
mov al, byte [edi]
xor esi, esi
cmp al, 0xc3
je 0x100015a9
mov ecx, edi
nop word [eax + eax]
cmp al, 0xe8
je 0x10001597
call fcn.10002b40
add esi, eax
mov al, byte [esi + edi]
lea ecx, [esi + edi]
cmp al, 0xc3
jne 0x10001580
jmp 0x100015a9
mov ecx, dword [esi + edi + 1]
lea eax, [esi + edi]
add eax, 5
add eax, ecx
add esi, 5
mov dword [ebp - 4], eax
mov al, byte [esi + edi]
lea ecx, [esi + edi]
cmp al, 0xc3
je 0x100015e8
cmp al, 0xe8
je 0x100015ca
call fcn.10002b40
add esi, eax
mov al, byte [esi + edi]
lea ecx, [esi + edi]
cmp al, 0xc3
jne 0x100015b3
jmp 0x100015e8
cmp byte [esi + edi - 2], 0x6a
lea eax, [esi + edi]
jne 0x100015e8
cmp byte [eax - 1], 0xc
jne 0x100015e8
mov ecx, dword [eax + 1]
add eax, 5
add eax, ecx
add esi, 5
mov dword [ebx + 4], eax
mov al, byte [esi + edi]
lea ecx, [esi + edi]
cmp al, 0xc3
je 0x1000161d
cmp al, 0xc7
jne 0x100015fd
cmp byte [esi + edi + 1], 0
je 0x10001616
call fcn.10002b40
add esi, eax
mov al, byte [esi + edi]
lea ecx, [esi + edi]
cmp al, 0xc3
jne 0x100015f2
mov esi, dword [ebp - 4]
jmp 0x10001548
mov ecx, dword [esi + edi + 2]
mov dword [ebx + 0xc], ecx
mov esi, dword [ebp - 4]
jmp 0x10001548
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401007
Capabilities:
Delete file
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4aa718]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4aa71c]
push edi
mov edi, dword [ebx]
xor ecx, ecx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x4aa720]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [0x4aa724]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
jmp 0x40105d
xor ecx, ecx
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x4b9974], 0xc
mov dword [ebp - 4], eax
jne 0x401087
push ecx
lea eax, [ebp - 0x38]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x4b9974]
cmp eax, 0xfa9
jne 0x4010a3
mov dword [0x4b9970], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c8
push str.xuzujamasahigomurefexob
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
and dword [0x4b98c8], 0
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x4b996c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
cmp dword [0x4b9974], 0xb03
jne 0x401147
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x40105b
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret