joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b86da
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x4b86f5
mov eax, dword [ebp + 8]
call fcn.00691a9e
mov dword [ebp + 8], eax
mov eax, 0x689110
call fcn.00685242
mov word [ebp - 0x14], 8
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.005dfc72
add dword [ebp - 8], 2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp + 8]
mov dx, word [ebp + 0x1c]
mov word [eax + 0x34], dx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp + 8]
mov byte [edx + 0xf], 1
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x4b8752
call fcn.00691aab
mov esp, ebp
pop ebp
ret

Function at 0x4b8c1e
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x4b8c39
mov eax, dword [ebp + 8]
call fcn.00691a9e
mov dword [ebp + 8], eax
mov eax, 0x689134
call fcn.00685242
mov word [ebp - 0x14], 8
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.005dfc72
add dword [ebp - 8], 2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [eax + 0x34], edx
mov ecx, dword [ebp + 8]
mov ax, word [ebp + 0x1c]
mov word [ecx + 0x38], ax
mov edx, dword [ebp + 8]
mov byte [edx + 0xf], 1
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x4b8c96
call fcn.00691aab
mov esp, ebp
pop ebp
ret

Function at 0x4b9136
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x4b9151
mov eax, dword [ebp + 8]
call fcn.00691a9e
mov dword [ebp + 8], eax
mov eax, 0x689158
call fcn.00685242
mov word [ebp - 0x14], 8
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.005dfc72
add dword [ebp - 8], 2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0xf], 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x4b919a
call fcn.00691aab
mov esp, ebp
pop ebp
ret
Function at 0x4b919e
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x4b91b9
mov eax, dword [ebp + 8]
call fcn.00691a9e
mov dword [ebp + 8], eax
mov eax, 0x68917c
call fcn.00685242
mov word [ebp - 0x14], 8
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.005dfc72
add dword [ebp - 8], 2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp + 8]
mov dx, word [ebp + 0x1c]
mov word [eax + 0x38], dx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x20]
mov dword [ecx + 0x34], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x24]
mov dword [edx + 0x3c], ecx
mov eax, dword [ebp + 8]
mov dx, word [ebp + 0x28]
mov word [eax + 0x40], dx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x44], eax
mov edx, dword [ebp + 8]
mov byte [edx + 0xf], 1
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x4b9233
call fcn.00691aab
mov esp, ebp
pop ebp
ret
Function at 0x4cadda
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x24]

Function at 0x4d313a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x692ed0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
call fcn.00685242
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, edx
lea eax, [eax + eax*4]
cmp edi, ecx
lea esi, [eax*8 + 0x69229c]
jle 0x4d318b
mov eax, ecx
push ecx
mov ecx, 0x28
cdq
idiv ecx
pop ecx
mov al, byte [esi + edx]
xor byte [ebx], al
inc ecx
inc ebx
cmp edi, ecx
jg 0x4d3174
mov word [ebp - 0x18], 0
jmp 0x4d31d1
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d31e2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x692f20
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
call fcn.00685242
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, edx
lea eax, [eax + eax*4]
cmp edi, ecx
lea esi, [eax*8 + 0x69229c]
jle 0x4d3233
mov eax, ecx
push ecx
mov ecx, 0x28
cdq
idiv ecx
pop ecx
mov al, byte [esi + edx]
xor byte [ebx], al
inc ecx
inc ebx
cmp edi, ecx
jg 0x4d321c
mov word [ebp - 0x18], 0
jmp 0x4d3279
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e66d6
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x4e66f1
mov eax, dword [ebp + 8]
call fcn.00691a9e
mov dword [ebp + 8], eax
mov eax, 0x699fbc
call fcn.00685242
mov dword [ebp - 8], 1
lea edx, [ebp + 0x14]
lea eax, [ebp + 0x14]
call fcn.006908de
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov word [ebp - 0x14], 0x14
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.005dfc72
add dword [ebp - 8], 2
mov eax, dword [ebp + 8]
add eax, 0x38
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov byte [ecx + 0xf], 1
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov dword [eax + 0x30], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x24]
mov dword [ecx + 0x34], eax
lea edx, [ebp + 0x14]
mov eax, dword [ebp + 8]
add eax, 0x38
call fcn.00690b2a
mov edx, dword [ebp + 8]
mov cx, word [ebp + 0x18]
mov word [edx + 0x3c], cx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0x40], edx
dec dword [ebp - 8]
lea eax, [ebp + 0x14]
mov edx, 2
call fcn.00690afa
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x4e679d
call fcn.00691aab
mov esp, ebp
pop ebp
ret

Function at 0x4ee32a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
test dl, dl
push ebx
push esi
mov byte [ebp - 0xc], dl
jle 0x4ee33e
call fcn.00691a9e
mov ebx, ecx
mov byte [ebp - 0x2d], dl
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov eax, 0x69d4f0
call fcn.00685242
mov word [ebp - 0x1c], 8
mov ecx, ebx
xor edx, edx
mov eax, dword [esi]
call fcn.005dfc72
add dword [ebp - 0x10], 2
mov eax, dword [esi]
add eax, 0x2027c
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0x10]
mov eax, dword [esi]
add eax, 0x20280
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0x10]
mov eax, dword [esi]
add eax, 0x20284
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0x10]
mov eax, dword [esi]
add eax, 0x202cc
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0x10]
mov ecx, dword [esi]
mov byte [ecx + 0xf], 1
push 0
push 0
mov word [ebp - 0x1c], 0x14
mov eax, dword [esi]
mov edx, dword [eax + 8]
lea eax, [ebp - 8]
call fcn.00690ab6
inc dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [0x551af8]
push edx
mov dl, 1
call fcn.005e61d2
mov ecx, dword [esi]
mov edx, 2
mov dword [ecx + 0x30], eax
lea eax, [ebp - 8]
dec dword [ebp - 0x10]
call fcn.00690afa
call fcn.0070adfc
mov ecx, dword [esi]
mov dword [ecx + 0x20298], eax
mov eax, dword [esi]
add eax, 0x202b4
push eax
call fcn.0070a2ba
mov edx, 0x69c5c6
mov eax, dword [esi]
add eax, 0x20284
call fcn.0069148a
mov edx, dword [esi]
xor ecx, ecx
mov dword [edx + 0x202d4], ecx
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x202b0], edx
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov eax, dword [esi]
cmp byte [ebp - 0x2d], 0
je 0x4ee43c
call fcn.00691aab
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x527e76
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x371], 0
jne 0x527f3e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x238], 0
jne 0x527f3e
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x371], 1
xor edx, edx
push ebp
push 0x4938f1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x365], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00527bbe
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [eax + 0x371], dl
cmp byte [ebp - 5], 0
je 0x527efd
mov eax, dword [ebp - 4]
mov byte [eax + 0x372], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4938f8
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x527f46
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x238], 0
je 0x528051
mov eax, dword [ebp - 4]
cmp byte [eax + 0x373], 0
jne 0x528051
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x373], 1
xor edx, edx
push ebp
push 0x493a04
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x36d], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00527692
mov edx, dword [ebp - 0xc]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0052575a
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [eax + 0x373], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00527692
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
mov edx, 2
call fcn.00651726
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00527692
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
xor edx, edx
call fcn.00651726
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493ac4
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret
mov eax, dword [ebp - 4]
cmp byte [eax + 0x372], 0
jne 0x52810a
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x372], 1
xor edx, edx
push ebp
push 0x493abd
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x365], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00527692
mov edx, dword [ebp - 0xc]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0052575a
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [eax + 0x372], dl
cmp byte [ebp - 5], 0
je 0x5280c9
mov eax, dword [ebp - 4]
mov byte [eax + 0x371], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493ac4
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x528112
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
xor ecx, ecx
push ebp
push 0x493c9b
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x238], 0
je 0x5281a8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x373], 0
je 0x5281a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
xor ecx, ecx
mov edx, 2
call fcn.00651726
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
xor ecx, ecx
xor edx, edx
call fcn.00651726
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x36d]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0052575a
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x5282a7
mov eax, dword [ebp - 4]
mov byte [eax + 0x373], 0
jmp 0x5282a7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x371], 0
je 0x5281da
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00527bbe
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x5282a7
mov eax, dword [ebp - 4]
mov byte [eax + 0x371], 0
jmp 0x5282a7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x372], 0
je 0x5282a7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x365]
mov ecx, edx
mov edx, dword [ebp - 4]
xchg edx, eax
call fcn.0052575a
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x5282a7
mov eax, dword [ebp - 4]
mov byte [eax + 0x372], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
test eax, eax
je 0x5282a7
mov esi, dword [eax + 0x244]
mov edi, dword [esi + 8]
dec edi
test edi, edi
jl 0x5282a7
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.005d77fa
cmp eax, dword [ebp - 4]
je 0x5282a3
mov edx, ebx
mov eax, esi
call fcn.005d77fa
mov edx, dword [0x48bdf0]
call fcn.005f9c86
test al, al
je 0x5282a3
mov edx, ebx
mov eax, esi
call fcn.005d77fa
mov edx, dword [0x48bdf0]
call fcn.005f9caa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00528356
test al, al
je 0x5282a3
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x371], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x330]
cmp byte [eax + 0x2b], 0
je 0x5282a7
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x5282a7
inc ebx
dec edi
jne 0x528237
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493ca2
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret

Function at 0x5f9392
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x6a6ccc], 0x8088405
inc edx
mov dword [ebx + 0x6a6ccc], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x5f93ae
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x6a6ccc], 0x8088405
inc edx
mov dword [ebx + 0x6a6ccc], edx
fld qword [ebx + 0x6a6d1c]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret
Function at 0x62bbf6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x62bbfc
ret

Function at 0x64c7d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b8341
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.005faf16
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x5b8358
call fcn.005fab7a
mov eax, ebx
call fcn.005e06ba
mov edi, eax
dec edi
test edi, edi
jl 0x64c88e
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.005e068e
mov edx, dword [0x57568c]
call fcn.005f9c86
test al, al
je 0x64c88a
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.005e068e
lea edx, [ebp - 0x14]
call fcn.00652aaa
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.005faf16
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.005fabee
inc esi
dec edi
jne 0x64c83c
mov al, byte [0x5b835c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x5b8368
mov eax, dword [ebp - 0xc]
call fcn.005ed08e
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.005fa8fe
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00652aaa
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x5b8358
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.00652aaa
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x5b8358
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x5b8358
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x5b8374
call fcn.005e88e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b8348
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.005fa88a
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.005fa88a
lea eax, [ebp - 0x14]
call fcn.005fa866
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.005fa88a
ret
Function at 0x9c9b6a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.009c9be9
jae 0x9c9b76
xor ecx, ecx
call fcn.009c9be9
jae 0x9c9ba0
xor eax, eax
call fcn.009c9be9
jae 0x9c9bb1
mov al, 0x10
call fcn.009c9be9
adc al, al
jae 0x9c9b92
jne 0x9c9bde
stosb byte es:[edi], al
jmp 0x9c9b77
call fcn.009c9bf5
dec ecx
loop 0x9c9bbd
mov eax, ebp
call fcn.009c9bf3
jmp 0x9c9bdf
lodsb al, byte [esi]
shr eax, 1
je 0x9c9c05
adc ecx, 2
mov ebp, eax
jmp 0x9c9bdf
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.009c9bf3
cmp eax, 0x7d00
jae 0x9c9bdd
cmp eax, 0x500
jae 0x9c9bde
cmp eax, 0x7f
ja 0x9c9bdf
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9c9b77
pop ebp
ret 8
Function at 0x7ffe53e2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
xor eax, ecx
xor eax, ecx
push eax
pop eax
push bx
inc esp
inc esp
push es
pop ds
xor eax, ecx
xor eax, ecx
push es
pop ds
push bx
inc esp
inc esp
add al, 0
xor eax, ecx
xor eax, ecx
inc esi
dec esi
add al, 4
sub al, 4
inc esi
dec esi
push bx
inc esp
inc esp
and al, 0xff
push bx
inc esp
inc esp
inc esi
dec esi
not eax
not eax
push eax
pop eax
push bx
inc esp
inc esp
inc esi
dec esi
add al, 4
sub al, 4
call 0x7ffe542d
pop edx
and al, 0xff
and al, 0xff
xor dx, dx
nop
add al, 0
add edx, 0xd5e0
push es
pop ds
add al, 0
xor ecx, ecx
inc esi
dec esi
xor eax, ecx
xor eax, ecx
mov cl, 0x1e
cld
xor byte [ecx + edx], 0xeb
loop 0x7ffe544d
xor eax, ecx
xor eax, ecx
push es
pop ds
and al, 0xff
push dword fs:[0x24]
inc esi
dec esi
not eax
not eax
push es
pop ds
pop dword [edx + 0xa]
pushf
popf
stc
add al, 0
mov cl, 0xff
add al, 0
and al, 0xff
clc
push edx
loop 0x7ffe547b
push bx
inc esp
inc esp
push eax
pop eax
mov dword [edx + 0x11], 0xffffacbb
pushf
popf
nop
add al, 0
mov ecx, dword [eax + 0x2c]
inc esi
dec esi
add al, 4
sub al, 4
and al, 0xff
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
xor eax, ecx
xor eax, ecx
and bh, 0xff
mov dword [eax + 0x2c], esp
cld
push 0
nop
inc esi
dec esi
push 0
and bh, 0xff
push 0
add al, 0
push 0
cld
and al, 0xff
push 0x30
cld
push 0x20
cld
push 0
push eax
pop eax
push es
pop ds
push 0
push eax
pop eax
push eax
pop eax
add edx, 0xffff7f35
push eax
pop eax
not eax
not eax
push edx
push eax
pop eax
xor eax, ecx
xor eax, ecx
clc
push edx
xor eax, ecx
xor eax, ecx
push 0
inc esi
dec esi
call dword [edx + 0x820e]
add al, 4
sub al, 4
stc
add esp, 0x3f8
push es
pop ds
stc
xor eax, eax
inc eax
add al, 4
sub al, 4
stc
ret 0xc
Function at 0x10001840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006198
push 0x10004ed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov edx, dword [0x100076a4]
mov dword [0x10007a90], edx
mov eax, dword [0x1000769c]
mov dword [0x10007a98], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x100018d4
push 0x10007b24
push edx
call sub.MSVCRT.dll__strcmpi
add esp, 8
test eax, eax
je 0x100018d4
push 0
push 0
push 0
push 0x10001450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1c], eax
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10007a90]
push ecx
push 0x10007b24
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [0x10007a90]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x100019c4
mov edx, dword [0x10007a98]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x100019c4
push edx
push 0x10007ae4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100019c4
mov edx, dword [0x100076b0]
mov eax, dword [edx]
mov dword [0x10007aa4], eax
test eax, eax
je 0x100019c4
mov eax, dword [0x1000768c]
mov dword [0x10007a94], eax
mov ecx, dword [0x100076ac]
mov dword [0x10007aa0], ecx
mov edx, dword [0x100075b8]
mov eax, dword [edx]
mov dword [0x10007aa8], eax
mov ecx, dword [0x10007698]
mov edx, dword [ecx]
mov dword [0x10007aac], edx
mov eax, dword [0x10007a90]
push eax
push 0x10007ab0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
mov ecx, dword [0x10007a98]
push ecx
push 0x10007ae4
call esi
push 0
push 0
push 0
push 0x10001150
push 0
push 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
call edi
mov esi, eax
mov dword [ebp - 0x24], esi
push 0
push 0
push 0
push 0x10001780
push 0
push 0
call edi
mov edi, eax
mov dword [ebp - 0x20], edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
jmp 0x100019c4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001e40
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xfc
dec eax
jne 0x10001edb
push edi
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0xfa
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xfa
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
xor eax, eax
mov ecx, 0x3e
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
stosw word es:[edi], ax
call sub.MSVCRT.dll__strlwr
push str.bingame.exe
push eax
call sub.MSVCRT.dll_strstr
add esp, 0x10
test eax, eax
pop edi
je 0x10001edb
push 0
push 0
push 0
push 0x10001c70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10003390
mov eax, 1
add esp, 0xfc
ret 0xc