joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10007049
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007084
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10007080
lea ebx, [ebx]
cmp esi, edx
jae 0x10007084
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10007070
cmp esi, edx
jb 0x1000708b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10018870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0xe], 0x3233
push eax
mov dword [ebp - 0x13], 0x656e7265
mov byte [ebp - 0xf], 0x6c
mov dword [ebp - 0xb], 0x6c6c64
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0x14], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000837b
mov esp, ebp
pop ebp
ret

Function at 0x10018910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x14]
mov word [ebp - 0x14], 0x7250
push eax
mov edi, edx
mov dword [ebp - 0x11], 0x73736563
mov esi, ecx
mov dword [ebp - 0xd], 0x654e3233
mov word [ebp - 9], 0x7478
mov byte [ebp - 7], 0
mov byte [ebp - 0x12], 0x6f
call fcn.10018870
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018970
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000837b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1000837b
mov esp, ebp
pop ebp
ret

Function at 0x10018990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10018830
mov edi, eax
test edi, edi
je 0x100189f7
lea eax, [ebp - 0x14]
mov word [ebp - 0x14], 0x7349
push eax
push edi
mov dword [ebp - 0xe], 0x6956776f
mov word [ebp - 0x11], 0x6e69
mov dword [ebp - 9], 0x656c6269
mov byte [ebp - 0x12], 0x57
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100189f0
push ebx
call eax
mov esi, eax
mov ecx, edi
call fcn.10018cd0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000837b
mov esp, ebp
pop ebp
ret

Function at 0x10018a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
mov word [ebp - 0x15], 0x4664
push eax
mov esi, ecx
mov word [ebp - 9], 0x57
mov dword [ebp - 0xe], 0x6d756c6f
mov word [ebp - 0x18], 0x6946
mov dword [ebp - 0x13], 0x74737269
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0xf], 0x56
call fcn.10018870
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018a7a
push 0x104
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000837b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop esi
call fcn.1000837b
mov esp, ebp
pop ebp
ret
Function at 0x10018a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], 0x704f
mov dword [ebp - 0xa], 0x7365636f
mov word [ebp - 0xd], 0x506e
mov byte [ebp - 0xe], 0x65
mov word [ebp - 6], 0x73
mov byte [ebp - 0xb], 0x72
call fcn.10018870
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018aef
push esi
push 0
push 1
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000837b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000837b
mov esp, ebp
pop ebp
ret

Function at 0x10018c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x626f6c47
push eax
mov esi, ecx
mov word [ebp - 0xb], 0x466c
mov word [ebp - 8], 0x6565
mov byte [ebp - 6], 0
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 9], 0x72
call fcn.10018870
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018cb8
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000837b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000837b
mov esp, ebp
pop ebp
ret

Function at 0x10018cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xf], 0x4c656572
push eax
mov esi, ecx
mov word [ebp - 6], 0x79
mov dword [ebp - 0xb], 0x61726269
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 7], 0x72
call fcn.10018870
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018d25
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000837b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000837b
mov esp, ebp
pop ebp
ret

Function at 0x10018d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10021010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.100188c0
mov edi, eax
test edi, edi
je 0x10018d98
lea eax, [ebp - 0x10]
mov dword [ebp - 0xd], 0x6e496f54
push eax
push edi
mov word [ebp - 9], 0x4174
mov word [ebp - 0xf], 0x7274
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 7], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018d91
push ebx
call eax
mov esi, eax
mov ecx, edi
call fcn.10018cd0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000837b
mov esp, ebp
pop ebp
ret
Function at 0x401207
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x4182d8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4182dc]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], 0x9e3779b9
mov dword [ebp - 0x34], eax
call fcn.00401200
add dword [ebp - 0x10], 0x23f
cmp dword [0xec3544], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x834]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov eax, dword [0x4182e4]
mov edi, dword [0x4182e0]
push 0x20
pop edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov eax, esi
mov dword [ebp - 0xc], 0xedeb2e40
shl eax, 4
add eax, edi
cmp dword [0xec3544], 0xfa9
mov dword [ebp - 8], eax
mov eax, dword [0xec3540]
cmove eax, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
cmp dword [0xec3544], 0x3eb
mov dword [0xec3540], eax
mov eax, dword [0xec3498]
cmove eax, dword [ebp - 0xc]
mov dword [0xec3498], eax
mov eax, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
shr eax, 5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
and dword [ebp - 0x14], 0
mov dword [0xec353c], 0xf4ea3dee
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 0x18], eax
mov eax, ebx
shl eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
add eax, ebx
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor dword [ebp - 0x14], eax
cmp dword [0xec3544], 0xb03
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jne 0x401362
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x10], eax
dec edx
mov dword [ebp - 0x20], edx
jne 0x401277
mov edi, dword [ebp - 0x30]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c062
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f6c
mov dword [ebp - 0x14], eax
cmp dword [0x81ed34], esi
jne 0x40c155
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c0e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c235
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c235
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c235
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x81ed34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x81ed38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x81ed3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81ed44], eax
test eax, eax
je 0x40c152
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81ed40], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c17a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c16d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c18f
push 4
pop eax
jmp 0x40c237
cmp dword [ebp - 0x14], esi
je 0x40c18f
push dword [0x81ed34]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c174
mov eax, dword [0x81ed40]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c1ed
cmp dword [0x81ed44], edi
je 0x40c1ed
push eax
call ebx
push dword [0x81ed44]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c1ed
test eax, eax
je 0x40c1ed
call ecx
test eax, eax
je 0x40c1e2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c1e2
test byte [ebp - 8], 1
jne 0x40c1ed
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c21d
mov eax, dword [0x81ed38]
cmp eax, edi
je 0x40c21a
push eax
call ebx
test eax, eax
je 0x40c21a
call eax
mov esi, eax
test esi, esi
je 0x40c21a
mov eax, dword [0x81ed3c]
cmp eax, edi
je 0x40c21a
push eax
call ebx
test eax, eax
je 0x40c21a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x81ed34]
call ebx
test eax, eax
je 0x40c235
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c237
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040a8
mov esp, ebp
pop ebp
ret
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40645d
pop dword [ebp - 0x50]
mov eax, 0x3ee010d7
add eax, 0xc1605386
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xb0369579
add dword [ebp - 0x60], 0x9e1bafd2
mov dword [ebp - 0x5c], 0xe451c1ca
add dword [ebp - 0x5c], 0x4de18a7b
mov dword [ebp - 0x58], 0xd7a76f76
add dword [ebp - 0x58], 0x74a4d4b8
mov dword [ebp - 0x54], 0xec9d7206
add dword [ebp - 0x54], 0x13628dfa
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x2a475d23
add dword [ebp - 0x60], 0x4a2b0c33
mov dword [ebp - 0x5c], 0xd8660ed8
sub dword [ebp - 0x5c], 0x96f9ad63
mov dword [ebp - 0x58], 0x68f509d
add dword [ebp - 0x58], 0x5ce01bcf
mov dword [ebp - 0x54], 0x502bd19c
sub dword [ebp - 0x54], 0x502bd19c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xeed3bb54
add eax, 0x116cc528
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3684b
push 0
call eax
mov ecx, 0xec3dd1a6
add ecx, 0x13c27437
xor edx, edx
add edx, eax
mov edi, 0x451400
add edi, dword [ebp - 0x50]
mov esi, 0x3d34e452
sub esi, 0x8d54d6be
mov dword [ebp - 0x14], 0x908b70f4
mov ebx, dword [edi]
sub dword [ebp - 4], 0x68ffd805
sub ebx, esi
add dword [ebp - 0x2c], edi
mov dword [edx], ebx
xor dword [ebp - 0x2c], 0xfeb4ae43
add edx, 0xd2ed81e1
add edx, 0x2d127e23
add edi, 0x24d7a04
sub edi, 0x24d7a00
loop 0x406576
add eax, 0xe66c17b7
add eax, 0x1994f290
xor ebx, ebx
add ebx, eax
add eax, 0x512ed8a7
sub eax, 0x512ed8a2
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x410170
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040ffe6
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x10775580
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.107756d0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x107755a6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10775592
add dl, dl
jne 0x107755b1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10775604
xor eax, eax
add dl, dl
jne 0x107755be
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x107756a5
add dl, dl
jne 0x107755cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107755d8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107755e3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107755ee
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x107755fa
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1077559d
mov eax, 1
add dl, dl
jne 0x10775612
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1077561d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10775609
sub eax, ebx
mov ebx, 1
jne 0x10775650
mov ecx, 1
add dl, dl
jne 0x10775636
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10775641
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1077562d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1077559d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10775667
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10775672
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1077565e
cmp eax, 0x7d00
jae 0x10775695
cmp eax, 0x500
jb 0x10775690
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1077559d
cmp eax, 0x7f
ja 0x10775698
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1077559d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x107756c6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1077559d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10002c76
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x54
mov eax, 0x100107c5
call fcn.10005004
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10002e71
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
push eax
call fcn.10003341
mov byte [ebp - 4], 0
xor esi, esi
push 0
inc esi
lea ecx, [ebp - 0x2c]
push esi
call fcn.10001408
lea eax, [ebp - 0x2c]
push eax
call fcn.10002f1f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
push eax
call fcn.10003341
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push 0
push esi
call fcn.10001408
lea eax, [ebp - 0x2c]
push eax
call fcn.10002fcc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x50]
push eax
call fcn.10003341
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push 0
push esi
call fcn.10001408
lea eax, [ebp - 0x2c]
push eax
call fcn.10003075
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x50]
push eax
call fcn.10003341
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push 0
push esi
call fcn.10001408
lea eax, [ebp - 0x2c]
push eax
call fcn.10003123
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x50]
push eax
call fcn.10003341
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push 0
push esi
call fcn.10001408
lea eax, [ebp - 0x2c]
push eax
call fcn.100031cf
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
push eax
call fcn.10003341
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push 0
push esi
call fcn.10001408
lea eax, [ebp - 0x2c]
push eax
call fcn.1000327b
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x50]
push eax
call fcn.10003341
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push 0
push esi
call fcn.10001408
mov esi, dword [ebp - 0x50]
jmp 0x10002e54
push 0
push esi
mov edx, ebx
lea ecx, [ebp - 0x20]
call fcn.10002b3e
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x20]
cmp edi, dword [ebp - 0x1c]
je 0x10002e45
mov edx, esi
lea ecx, [ebp - 0x44]
call fcn.10002c18
mov ebx, eax
mov byte [ebp - 4], 9
cmp dword [ebx + 0x14], 8
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x58], eax
jb 0x10002de4
mov ebx, dword [ebx]
mov ecx, dword [edi]
lea edx, [ebp - 0x54]
and dword [ebp - 0x54], 0
add eax, eax
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x60], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10002e2a
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + ecx]
push eax
push ebx
mov ebx, dword [ebp - 0x60]
push ebx
call fcn.10004870
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
add esp, 0xc
push eax
push dword [ebp - 0x54]
lea eax, [ecx + ecx]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x44]
push 0
push 1
call fcn.10001408
add edi, 4
cmp edi, dword [ebp - 0x1c]
jne 0x10002dc6
mov ebx, dword [ebp - 0x5c]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100023ff
add esi, 0x18
cmp esi, dword [ebp - 0x4c]
jne 0x10002dab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.1000241b
mov al, 1
call fcn.10004fc2
ret
Function at 0x51c87b
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
nop
cdq
inc edi
inc ebx
lcall 0xd709, 0x3ab7c1e5
invalid
or eax, 0xf7cb52a
sub esi, dword [ebx]
sub dh, byte [ebp + 0x332b0f7c]
xlatb
sbb eax, 0x48419670
ror byte [edi - 0x3c], cl
inc edi
fnstsw word [eax + 0x4868ecbe]
or ebx, esp
mov bh, 0x9c
mov bh, 0x86
mov dh, 0xf9
sar byte [ebx], 1
imul esi, dword [edi], 0x1fba7e7e
push esp
mov bl, bl
wait
xchg edx, eax
xor al, 0x73
jo 0x51c87c
in eax, dx
sub eax, 0x234d71
mov esp, 0xb96d5a2a
push ebx
fdivr dword [ebp + 0x20]
jge 0x51c85e
invalid

Function at 0x54a5bb
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x325f3de0
stosd dword es:[edi], eax
dec esp
inc ecx
cmpsb byte [esi], byte es:[edi]
jl 0x54a615
sbb dword [edx], edx
cmp dword [edx], edx
cmp byte [esi - 0x6728b60c], cl
xchg esi, eax
mov ebx, 0x97cb1c1d
pop esi
pop eax
jne 0x54a5d8
loopne 0x54a5e0
add al, 0xcb
inc edx
imul ebx, ebp, 0x4d
retf
dec ebp
mov esi, 0x285f6732
mov edx, 0xbfd55c14
pop edi
xchg ecx, eax
ljmp 0x79bf
sbb eax, 0xa28040f
jnp 0x54a5db
jecxz 0x54a673
test byte [esi], ch
enter 0x4119, 0xffffffffffffffb3
sbb byte [esi + 0x576bbd00], cl
invalid
rol byte [edx + 0x2a], 0xb2
in eax, dx
test dword [eax + 0x77ff71e], ebp
sub esi, edx
dec edx
xor byte [edx], al
stosd dword es:[edi], eax
sbb al, byte [0x563752ad]
add eax, 0x8c3a8530
in eax, dx
loop 0x54a678
movsd dword es:[edi], dword [esi]
adc esi, ecx
imul dword [edi + 0xf]
xchg edi, eax
mov eax, dword [edx + edx + 8]
mov al, 0xd2
adc esp, ebx
push ebx
sub byte [edi + 0x248649da], bl
call 0xe9f9627f
push cs
dec ecx
xchg byte [eax + ebp*8], ah
sar byte [ebx + 0xef2e9a4], cl
and dword [ecx], edx
aam 0x18
pop esi
push ebx
mov eax, 0xbfb8cb8c
pop ebx
mov al, 0x68
sbb eax, 0x7fdd6cdc
int1
out dx, al
mov al, 0x41
mov esp, 0xc715d6fc
adc ch, byte [0xbfce9035]
shr byte [eax], 1
cwde
cmp al, 0x4b
or ah, dl
sub ecx, eax
or byte [esi + 0x23a70932], ch
sahf
leave
inc esi
aad 0xe8
out 0xfb, al
imul ecx, dword [bx + di + 0x74fc], 0x91ad775
loop 0x54a703
imul ecx, dword [edx + 0x63], 0x4515c5be
loop 0x54a736
test eax, 0x468bad6e
lcall 0xe34c, 0x4a173df2
nop
pop ss
dec edx
dec esp
jecxz 0x54a698
lodsd eax, dword [esi]
mov ds, word [ebx + 0x1d]
jg 0x54a6a5
mov word [ebx], fs
lea esp, [ebx - 0x55ca03c9]
xchg esi, eax
lds edi, [edi]
ljmp 0x43bd
aaa
ret

Function at 0x54dcdb
Capabilities:
Encode data using xor

Disassembly:
add dword [edx - 0x8581418], 0x6c3ef35e
xchg ebp, eax
adc al, 0xf2
bound eax, qword [edx - 0x35]
in al, dx
invalid
fist word [eax]
pop esp
adc ebp, dword [ecx + 0x1b]
cli
adc byte [ebx + edx + 0x69], bl
sbb edi, edx
mov dword [edi + 0x618cc1cf], esi
cmp eax, 0xb6adf7d0
stosd dword es:[edi], eax
rol dword [ebp - 0x3b], 0xa5
out 0x17, eax
dec edi
jns 0x54dc66
mov al, 0x50
pop ebx
sub bh, al
jb 0x54dcc2
imul ebx, dword [eax + edi*8 - 9], 0xffffffef
jae 0x54dcea
jns 0x54dcc3
sub dword [eax + 0x688d19af], ebx
xor dh, byte [esi]
in eax, dx
retf