joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aae80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.004c8cd0
add esp, 0xc
xor edx, ebx
xor edx, ebx
or ecx, 0
or eax, 0
jns 0x4aaebf
pushf
and esp, 0xffffffff
popf
jmp 0x4aaeae
xchg edx, edx
lea eax, [eax + 0x608e]
lea eax, [eax - 0x608e]
js 0x4aaebf
mov eax, 0x6db166b0
mov al, 0x66
mov cl, 0x6d
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x6e
mov byte [ebp - 0x17], al
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xc], al
mov byte [ebp - 8], al
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], cl
mov byte [ebp - 0xd], cl
mov byte [ebp - 7], 0x58
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x4f
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xf], 0x47
mov byte [ebp - 0xa], 0x62
xchg edi, ebx
xchg edi, ebx
xchg edi, ecx
xchg edi, ecx
and esp, 0xffffffff
jbe 0x4aaf1b
mov esp, esp
ja 0x4aaf1b
xor eax, 0x8ae85d8a
push ebp
in eax, dx
mov bl, byte [ebp - 0x18]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0xe]
mov al, byte [ebp - 9]
dec bl
dec dl
mov byte [ebp - 0x18], bl
mov bl, byte [ebp - 0x17]
dec cl
mov byte [ebp - 0x13], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0xd]
mov byte [ebp - 9], al
mov al, byte [ebp - 8]
dec bl
dec dl
mov byte [ebp - 0x17], bl
mov bl, byte [ebp - 0x16]
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0x11]
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0xc]
mov byte [ebp - 8], al
mov al, byte [ebp - 7]
dec bl
dec dl
mov byte [ebp - 0x16], bl
mov bl, byte [ebp - 0x15]
dec cl
mov byte [ebp - 0x11], dl
mov dl, byte [ebp - 0x10]
dec al
mov byte [ebp - 0xc], cl
mov cl, byte [ebp - 0xb]
mov byte [ebp - 7], al
mov al, byte [ebp - 0x14]
dec bl
dec dl
dec cl
dec al
mov byte [ebp - 0x15], bl
mov bl, byte [ebp - 0xf]
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xb], cl
mov byte [ebp - 0x14], al
mov dl, byte [ebp - 0xa]
dec bl
dec dl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xa], dl
nop
test edi, esi
mov edx, edx
jg 0x4aafba
jl 0x4aafb4
lea eax, [eax]
jle 0x4aafba
mov ebp, 0xa681e867
add dword [eax], eax
call fcn.004c5640
test eax, eax
jne 0x4aafcc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor esp, 0
rol esp, 0
jbe 0x4aafdf
xchg esi, esi
jl 0x4aafd8
jbe 0x4aafda
jne 0x4aafdc
ja 0x4aafdf
mov edx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.004af430
push 0x13
lea edx, [ebp - 0x18]
mov ebx, eax
push 0
push edx
mov dword [ebp - 4], ebx
call fcn.004c8cd0
add esp, 0xc
call fcn.004ab003
Function at 0x4afc80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004c8cd0
add esp, 0xc
lea esp, [esp]
je 0x4afcbd
pushf
cmp ecx, eax
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
popf
lea edx, [edx + 0x6c4c]
lea edx, [edx - 0x6c4c]
jbe 0x4afcba
jne 0x4afcbd
call 0x65fb7072
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
test edi, esi
mov esi, esi
cmp ebx, dword [esp + 4]
jae 0x4afd11
pushf
test eax, 0x20b6
popf
jne 0x4afd0a
mov esp, esp
jl 0x4afd0e
jb 0x4afd11
sub eax, 0x1592a
call fcn.004c5640
test eax, eax
jne 0x4afd23
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp esi, ecx
nop
call 0x4afd2b
add esp, 4
test dword [esp + 8], edx
je 0x4afd40
jae 0x4afd36
jae 0x4afd38
jl 0x4afd3a
je 0x4afd3c
jne 0x4afd40
lcall 0x5051, 0xf04d8d65
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.004af430
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.004c8cd0
add esp, 0xc
test edi, edi
jne 0x4afd6b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
jle 0x4afd6d
jle 0x4afd6f
jns 0x4afd71
ja 0x4afd91
pushf
xor eax, 0x3da3
xor eax, 0x3da3
rol esp, 0
test dword [esp + 0x10], edx
popf
jmp 0x4afd8a
jne 0x4afd8c
ja 0x4afd8e
jbe 0x4afd91
mov ebx, 0x4ca9e857
add dword [eax], eax
push edi
call fcn.004c4a40
add esp, 4
jne 0x4afd9c
or esi, 0
jp 0x4afdb6
pushf
cmp ecx, dword [esp + 0xc]
xor esi, eax
xor esi, eax
popf
jp 0x4afdaf
mov esp, esp
jge 0x4afdb3
jnp 0x4afdb6
mov ecx, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4b3a50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4a47d0]
push esi
push edi
push eax
push 0x4a5845
mov byte [0x4a5844], 0x45
call fcn.004b32d0
mov edx, dword [0x4a47d0]
mov al, 0x2d
mov byte [0x4a584a], al
mov byte [0x4a584b], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x4a5849], cl
mov byte [0x4a584c], cl
mov esi, 0x4a584d
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x48aa69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x4b3a9f
mov byte [esi], 0
pop edi
mov eax, 0x4a5844
pop esi
ret
Function at 0x4b3e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004c8cd0
add esp, 0xc
jne 0x4b3e1b
sub esp, 0
jne 0x4b3e3f
pushf
or eax, 0
inc edi
dec edi
popf
lea eax, [eax + 0x11d1]
lea eax, [eax - 0x11d1]
lea esp, [esp]
xchg edi, ecx
xchg edi, ecx
je 0x4b3e3f
mov edx, 0x75b066b1
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 7], 0x4a
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 0xa], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 0x70
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 9], cl
mov byte [ebp - 6], 0x6f
cmp esp, 0x20c3
test dword [esp], edi
cmp edx, dword [esp]
mov esp, esp
jp 0x4b3e91
jns 0x4b3e89
xchg ecx, edx
xchg ecx, edx
jnp 0x4b3e91
add eax, 0xfc558ad3
mov dl, byte [ebp - 4]
mov cl, byte [ebp - 0xb]
mov al, byte [ebp - 0xf]
mov bl, byte [ebp - 0xd]
dec dl
dec cl
mov byte [ebp - 4], dl
mov dl, byte [ebp - 9]
dec al
mov byte [ebp - 0xb], cl
mov cl, byte [ebp - 0xc]
dec bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xd], bl
mov bl, byte [ebp - 6]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 8]
dec cl
dec al
mov byte [ebp - 0xc], cl
mov cl, byte [ebp - 0x10]
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 7]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 5]
mov byte [ebp - 8], dl
mov dl, byte [ebp - 0xe]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x10], cl
mov byte [ebp - 7], al
mov byte [ebp - 5], bl
mov byte [ebp - 0xe], dl
sub ecx, 0
ja 0x4b3efe
jns 0x4b3f06
jno 0x4b3f02
js 0x4b3f06
mov esi, 0x1735e8ff
add dword [eax], eax
call fcn.004c5640
test eax, eax
je 0x4b3f8e
nop
xchg ecx, ecx
ror esi, 0
ja 0x4b3f17
jns 0x4b3f21
je 0x4b3f1b
ja 0x4b3f1d
js 0x4b3f21
cmp edi, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.004af430
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.004c8cd0
add esp, 0xc
add ebx, 0x1c9b
sub ebx, 0x1c9b
test ecx, 0x2652
jo 0x4b3f57
ja 0x4b3f53
jno 0x4b3f57
mov ebx, 0x74f68595
xor esi, dword [eax + eax + 0x7d]
adc esp, dword [esi - 0x64]
test esi, esi
je 0x4b3f8e
je 0x4b3f5d
jge 0x4b3f72
pushf
lea esp, [esp]
and edi, 0xffffffff
popf
jmp 0x4b3f6b
jl 0x4b3f6d
mov eax, eax
jl 0x4b3f72
mov eax, 0xac8e856
add dword [eax], eax
push esi
call fcn.004c4a40
add esp, 4
jae 0x4b3f7d
mov eax, eax
jo 0x4b3f88
ja 0x4b3f83
jno 0x4b3f88
add eax, 0x458b50b3
or byte [eax - 1], dl
salc
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bb0f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004c8cd0
add esp, 0xc
cmp eax, dword [esp + 8]
cmc
jns 0x4bb129
pushf
ror edi, 0x15
ror edi, 0xb
popf
lea esi, [esi + 0x2e92]
lea esi, [esi - 0x2e92]
js 0x4bb129
mov esi, 0x72b173b0
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], al
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], al
mov byte [ebp - 5], cl
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], al
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 3], 0x74
call fcn.004c5640
test eax, eax
jne 0x4bb176
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.004af430
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.004c8cd0
add esp, 0xc
test esi, esi
jne 0x4bb1a1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
jb 0x4bb1a3
add esp, 0
rol ecx, 3
rol ecx, 0x1d
jle 0x4bb1c3
pushf
ror esp, 0
jns 0x4bb1b5
nop
popf
jge 0x4bb1ba
xchg ebx, edx
xchg ebx, edx
jbe 0x4bb1c0
jg 0x4bb1c3
lcall 0, 0x9877e856
push esi
call fcn.004c4a40
add esp, 4
lea eax, [eax + 0x36b9]
lea eax, [eax - 0x36b9]
add edi, 0x7dd0
sub edi, 0x7dd0
jl 0x4bb1e6
or esp, 0
jge 0x4bb208
pushf
jg 0x4bb1ef
test edx, 0x2132
or edx, edx
popf
lea eax, [eax + 0x22c3]
lea eax, [eax - 0x22c3]
jl 0x4bb208
mov ecx, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c5280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004c8cd0
add esp, 0xc
neg edi
neg edi
jbe 0x4c52b6
jg 0x4c52a1
lea eax, [eax + 0x6471]
lea eax, [eax - 0x6471]
jnp 0x4c52af
lea edx, [edx]
ja 0x4c52b6
mov eax, 0x6db14869
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
and ebx, ebx
rol edx, 6
rol edx, 0x1a
jle 0x4c531d
mov edx, edx
xchg edi, edi
lea edi, [edi + 0x67ad]
lea edi, [edi - 0x67ad]
jg 0x4c531d
mov ebx, 0x8aec558a
dec ebp
int1
mov dl, byte [ebp - 0x14]
mov cl, byte [ebp - 0xf]
mov al, byte [ebp - 0xa]
mov bl, byte [ebp - 5]
dec dl
dec cl
mov byte [ebp - 0x14], dl
mov dl, byte [ebp - 0x13]
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xe]
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 9]
mov byte [ebp - 5], bl
mov bl, byte [ebp - 4]
dec dl
dec cl
mov byte [ebp - 0x13], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 9], al
mov al, byte [ebp - 8]
mov byte [ebp - 4], bl
mov bl, byte [ebp - 3]
dec dl
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0x11]
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0xc]
dec bl
mov byte [ebp - 8], al
mov al, byte [ebp - 7]
mov byte [ebp - 3], bl
mov bl, byte [ebp - 0x10]
dec dl
dec cl
dec al
dec bl
mov byte [ebp - 0x11], dl
mov dl, byte [ebp - 0xb]
mov byte [ebp - 0xc], cl
mov byte [ebp - 7], al
mov byte [ebp - 0x10], bl
mov cl, byte [ebp - 6]
dec dl
dec cl
mov byte [ebp - 0xb], dl
mov byte [ebp - 6], cl
xor esp, 0
clc
jle 0x4c53ba
jae 0x4c53b5
js 0x4c53b7
jg 0x4c53ba
mov ebx, 0xfe9971e8
dec dword [ebx + 0x75c985c8]
or dword [edi + 0x5e], ebx
call 0x4aed30
mov ecx, eax
test ecx, ecx
jne 0x4c53ce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
jno 0x4c53d0
and eax, 0xffffffff
jp 0x4c53f1
pushf
lea ebx, [ebx + 0x549c]
sub ebx, 0x549c
sub esp, 0
popf
jno 0x4c53ea
jae 0x4c53ec
jo 0x4c53ee
jnp 0x4c53f1
mov ebx, 0x52ec558d
lea edx, [ebp - 0x14]
push edx
push ecx
call fcn.004af430
mov esi, eax
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004c8cd0
add esp, 0xc
test esi, esi
jne 0x4c541c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
shl esp, 0
and ecx, 0xffffffff
jo 0x4c542a
jb 0x4c5426
jno 0x4c542a
mov esp, 0x10e8561b
idiv bh
inc dword [ebx - 0x1406fb3c]
add bh, dh
invalid
push esi
call fcn.004c4a40
add esp, 4
stc
jmp 0x4c5436
neg edx
neg edx
jae 0x4c5443
jp 0x4c543e
mov edi, edi
jb 0x4c5443
xor eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c73e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004c8cd0
add esp, 0xc
xor edi, dword [esp]
xor edi, dword [esp]
je 0x4c740e
jns 0x4c7403
je 0x4c7405
jo 0x4c7407
jmp 0x4c7409
jne 0x4c740e
add eax, 0x66b05699
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
add edx, dword [esp]
sub edx, dword [esp]
je 0x4c7456
xchg edx, ebx
xchg edx, ebx
xchg ebx, ebx
jbe 0x4c7452
jne 0x4c7456
lcall 0x5d8a, 0xf0458ac3
cmc
mov al, byte [ebp - 0x10]
mov bl, byte [ebp - 0xb]
mov dl, byte [ebp - 6]
mov cl, byte [ebp - 0xf]
dec al
dec bl
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xb], bl
mov bl, byte [ebp - 5]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 0xe]
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 9]
dec al
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xd]
dec dl
mov byte [ebp - 5], bl
mov bl, byte [ebp - 8]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xc]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 7]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0xd], al
mov byte [ebp - 8], bl
mov byte [ebp - 0xc], dl
mov byte [ebp - 7], cl
call fcn.004c5640
mov ecx, eax
test ecx, ecx
je 0x4c7546
jne 0x4c74c7
xor eax, 0
jge 0x4c74d9
jb 0x4c74ce
lea esp, [esp]
jg 0x4c74d3
mov eax, eax
jl 0x4c74d9
sub eax, 0xf0558dad
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.004af430
mov edi, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004c8cd0
add esp, 0xc
test edi, edi
je 0x4c7546
cld
je 0x4c7514
pushf
add esp, 0
lea eax, [eax + 0x103d]
lea eax, [eax - 0x103d]
popf
js 0x4c7511
jne 0x4c7514
mov esp, 0xd526e857
invalid
push edi
call fcn.004c4a40
add esp, 4
ror esp, 0
jb 0x4c7522
jp 0x4c7540
pushf
test eax, ebx
and edx, 0xffffffff
popf
mov ebx, ebx
lea esi, [esi + 0x7dd7]
lea esi, [esi - 0x7dd7]
xchg edx, edx
jnp 0x4c7540
mov esi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1232b1c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1232b26
pushal
call 0x1232b2c
pop ebp
sub ebp, 0x10
sub ebp, 0xe32b1c
jmp 0x1232b42
mov eax, 0xe32b1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x588
mov edx, 0x8bbd4259
xor byte [eax], dl
inc eax
dec ecx
jne 0x1232b59
jmp 0x1232b6c
rcl byte [edx + edx*8 + 0x595965d0], cl
pop ecx
fcomp dword [eax + 0x595959a1]
pop edx
xchg esp, eax
loope 0x1232bda
pop ecx
pop ecx
pop ecx
jecxz 0x1232bf4
pop ecx
pop ecx
pop ecx
scasb al, byte es:[edi]
mov ebx, 0xd8d2915a
push ebp
pop ecx
pop ecx
pop ecx
pop edx
pushfd
or dword [ecx], ecx
xor dword [ecx + 0x4c], edi
jns 0x1232bf2
xor dword [ebp + 0x58599a4c], esp
jne 0x1232c1e
xor dword [ebp - 0x18], ebp
cmp eax, 0x595cb15f
pop ecx
pop ecx
mov al, 0x71
pop ecx
pop ecx
pop ecx
or al, 0xd
add al, 0xd2
fcom qword [ecx + 0x59]
pop ecx
pop ecx
ror ah, cl
push ebp
pop ecx
pop ecx
pop ecx
rcl ah, cl
dec ecx
pop ecx
pop ecx
pop ecx
cwde
mov al, 0x5b
push 0x5d9bda5b
adc byte [esi - 0x24], dl
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
add al, 0x9b
push ebp
pop ecx
rcl ch, cl
jge 0x1232c39
pop ecx
pop ecx
pop ecx
xor dword [ecx + 0x4c], edi
jns 0x1232c3d
xor dword [ebp + 0x58599a4c], esp
jne 0x1232c69
or byte [ecx + 0x5959595c], dh
mov al, 0x14
pop ebx
pop ecx
pop ecx
or al, 0xd4
xor eax, 0x2ca6597d
push ebp
cmpsb byte [esi], byte es:[edi]
sub al, 0x51
mov cl, 0x27
pop ecx
pop ecx
pop ecx
shl ah, cl
push ecx
pop ecx
pop ecx
pop ecx
fsubr dword [eax + 0xf9f7a13]
fsubr dword [eax + 0xf9f7a13]
push 0xffffffffffffff90
fsubr dword [ebx + 0x2625f701]
fsubr dword [ebx + 0x2625f701]
push 0xffffffffffffff8b
fidiv dword [ecx - 0x22a9eea4]
mul dword [0x1abd826]
mul dword [0xda8b6a26]
mov cl, 0x5c
adc dword [esi - 0x23], edx
pop ss
pop ecx
pop ecx
pop ecx
push esi
rcl dword [ecx]
pop ecx
pop ecx
pop ecx
aas
rol byte [ebp + 0x60], cl
fldenv [edx + 0x43dd56b1]
pop ecx
pop ecx
pop ecx
fldenv [edx + 0x48dd56b0]
pop ecx
pop ecx
pop ecx
aas
fsub dword [edx - 0x22a9835a]
dec esp
pop ecx
pop ecx
pop ecx
sbb byte [eax - 0x5959596b], dh
jo 0x1232c77
pushal
pop eax
ficomp dword [eax + 0x5db1da5c]
pop ebp
mov al, 0xe4
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
jo 0x1232c7e
pushal
pop ebx
ficomp dword [eax + 0x5db3da5f]
mov bl, 0x5d
fidiv dword [ecx - 0x590d4fa4]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
add al, 0x9b
push ebp
pop ecx
or al, 0xd2
mov ch, 0xf
push cs
or al, 0xd2
sub al, 0x55
shl byte [ecx + edx*2], cl
movsd dword es:[edi], dword [esi]
jmp 0x1232c6d
Function at 0x15ff564
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
je 0x16004e2
pushfd
test cx, sp
cmc
sub al, 0x30
jmp 0x15fb7c5
push ecx
cmp al, 9
call 0x15ff58a
pop ebp
mov dh, byte [ebx + 9]
mov ecx, 0x8a4bb507
cdq
inc ebp
push eax
rcl cl, 0x67
pop esi
dec ecx
jge 0x15fb806
sti
das
out 0xbf, al
pop esp
retf
sub dword [ebx - 0x2bda0ec7], ebx
invalid
mov edi, dword [edi + ecx*4]
cmp bh, dh
pushfd
test bh, 0xbd
sub esp, 0xffffffec
jbe 0x26da022
test edi, edi
pushfd
pushfd
lea esp, [esp + 8]
je fcn.026dfe31
pushal
call fcn.026dd8d3
pushfd
pushal
lea esp, [esp + 0x30]
ja 0x15ffb0b
jmp 0x26d8e65
push esi
pushfd
mov word [esp + 4], cx
jmp 0x26da034
cmc
mov edi, edx
rol cl, cl
pushfd
jmp 0x26d6b63
pushfd
clc
rcl al, cl
cmc
add edi, 1
setle al
mov al, byte [edi]
pushfd
jmp 0x26e316c
mov ecx, edi
lea esp, [esp + 4]
rcr al, cl
pushal
ror al, cl
pushal
mov al, byte [ecx]
clc
mov byte [esp + 4], cl
pushfd
mov byte [esp], bl
mov ah, al
bt bx, dx
rol al, 2
mov word [esp + 4], 0xd140
call fcn.015f8890
imul edx, edx, 0xa
pushal
add edx, eax
lea esp, [esp + 0x20]
push ebx
mov word [esp], di
lea esp, [esp + 4]
jmp 0x16018f4
clc
test edi, edi
pushal
mov byte [esp], 0xc3
call fcn.016018b6
mov esp, esi
pushfd
pushal
lea esp, [esp + 0x24]
jmp fcn.026dfe31
cmc
test al, al
jmp 0x15f68d9

Function at 0x15ffb48
Capabilities:
Encode data using xor

Disassembly:
ja 0x1600350
pushal
pushal
pushfd
pushfd
lea esp, [esp + 0x48]
jb 0x16008aa
bt si, 1
bt edi, 0x14
jmp 0x16022d5
cmp al, byte [edi]
sets al
not ax
pop eax
lea esp, [esp + 0x10]
jp 0x26da166
lea edi, [edi + 1]
bswap ax
setne ah
movzx ax, bl
pop eax
jmp 0x15f886e
pushfd
lea edi, [edi + 1]
setg ah
bswap ax
mov eax, dword [esp + 4]
call fcn.026de446
or dword [edi + edx - 0x1519243], ebp
or edi, ebp
xor ebp, 0x70
clc
jbe 0x26da170
and dword [ebp + 0x1d0c23fd], esp
stc
add byte [ebp + 0x6e5c668d], dl
invalid

Function at 0x16006de
Capabilities:
Encode data using xor

Disassembly:
push ecx
aam 0x67
invalid
pushal
clc
add edi, eax
mov dword [esp + 4], 0x43bc8c8
call fcn.026d89a3
jb 0x1600739
mov al, byte [0xd4da4bde]
cmp esi, dword [ebx]
lds ebx, [esi - 0x1d]
fcomp dword [0xc3e9e274]
pop esi
jecxz 0x16006d4
sbb eax, 0xc3e9e274
pop edi
mov bh, 0x6d
insd dword es:[edi], dx
lcall 0xb75e, 0xac123550
out dx, al
jbe 0x16006f9
adc cl, dl
call dword [edx + 5]
add ch, byte [eax + 0x65]
fld xword [ebx + ecx*4 + 0x56]
jp fcn.016006de
and al, 0x86
mov ebp, 0x1aa12414
or edx, dword [0xf0032811]
not byte [ecx - 0x33]
popal
sti
add ah, byte [eax + edx*4 + 0x55599e1e]
sahf
pop ecx
push ebp
aad 0x31
stc
cmp ebx, dword [ecx + edi*2 - 0xa]
pop esp
jns 0x1600732
fst dword [ecx - 0x4786b1d3]
push edi
call 0xb68342bc
dec edx
jae 0x1600703
jge 0x1600791
xchg edx, eax
adc eax, 0xdd0c5814
invalid
into
out dx, al
movsd dword es:[edi], dword [esi]
add eax, 0xb4c49a20
fbld tbyte [edx]
movsd dword es:[edi], dword [esi]
push ebp
adc byte [eax + 0xad269f5], ah
add byte [eax], al
add byte [eax], bh
invalid
Function at 0x26dc279
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, dword [ebp - 0x10]
push edi
lea esp, [esp + 0xc]
jae 0x26dfe38
movzx di, bl
mov ebx, eax
lea edi, [esi - 0x67b1f329]
jmp 0x296c120

Function at 0x296fa49
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
test bh, 0xae
push dword [esp]
bt si, 0xf
test eax, eax
pushfd
lea esp, [esp + 0xc]
je fcn.026dfe31
movsx si, dl
xadd si, dx
shrd esi, ebx, 1
mov esi, dword [eax + 0x3c]
rcr edx, 9
add esi, eax
shr dh, 7
rol dl, 3
bt dx, si
mov edx, dword [esi + 0x78]
call fcn.015fd05a
inc ax
push ebp
test dl, 0x10
mov ebp, esp
dec ah
bsr ax, bx
sub esp, 0x18
dec ah
sal ax, cl
push esi
mov al, 0x3a
lea eax, [ebp - 0x35c614ae]
push edi
xor eax, edi
setb ah
pushfd
aam 0xf5
mov dword [esp], ebx
bswap eax
stc
bsr ax, bp
stc
push edx
dec ax
shrd ax, cx, 5
mov eax, dword [ebp + 8]
je 0x16004a3
test eax, eax
push ebp
call fcn.026da02f
btc eax, 0x1e
jmp 0x296e2d8

Function at 0x29822e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esi, [ebp*8 - 0x2f9f68d9]
lea esp, [esp + 0x38]
push esp
bswap si
push ecx
not esi
movzx si, dl
push edx
pushal
pushal
mov dword [esp + 0x3c], edi
pushfd
jmp 0x298234b

Function at 0x29824d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ror si, cl
mov dword [esp + 0x18], 0
clc
clc
mov esi, dword [esp + 0x48]
pushal
xor esi, 0xfe67d08a
push 0x327802de
lea esp, [esp + 0x3c]
jmp 0x298173f
lea esi, [eax*8 + 0x7ddff2e4]
pushfd
pop dword [esp + 0x20]
cmc
sbb esi, ecx
stc
push dword [0x2983c4d]
pop dword [esp + 0x1c]
clc
jmp 0x298249c

Function at 0x2982534
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, ecx
pushal
pushal
xor esi, 0xfe67d08a
push edx
pushfd
push dword [esp + 4]
mov word [esp + 0x28], 0xc547
lea esp, [esp + 0x50]
jmp 0x298173f

Function at 0x2982b3b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esi, [edi*4 + 0x28019e65]
mov dword [esp], edx
movsx si, dl
push edi
bswap si
push 0x2b57a3e8
pushfd
pop dword [esp]
and esi, 0x93a20745
sal si, cl
push dword [0x2983c4d]
clc
push 0
push 0xb944f08e
mov esi, dword [esp + 0x34]
pushal
xor esi, 0xfe67d08a
push 0x92b19561
pushfd
mov byte [esp + 0xc], 0x50
pushfd
lea esp, [esp + 0x30]
jmp 0x298173f

Function at 0x2983472
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
xor esi, 0xfe67d08a
push 0x95a8da61
pushal
mov byte [esp + 4], 0x87
push eax
lea esp, [esp + 0x44]
jmp 0x298173f
lea esp, [esp + 4]
jne 0x2982af8
lea esi, [ebp + 0xb91e78c]
pushfd
pushfd
pop dword [esp]
shrd si, di, 5
pushal
bsr si, di
inc si
push dword [0x2983c4d]
pop dword [esp + 0x1c]
neg si
and esi, esp
bswap si
mov dword [esp + 0x18], 0
sal si, cl
mov si, 0xbf81
rcl si, 1
neg si
mov esi, dword [esp + 0x48]
jmp 0x29833c0

Function at 0x2983706
Capabilities:
Encrypt data using rc4 prga

Disassembly:
clc
pushal
xor esi, 0xfe67d08a
mov word [esp], bp
mov byte [esp], ch
lea esp, [esp + 0x28]
jmp 0x298173f

Function at 0x2983fac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test al, dh
xor esi, 0xfe67d08a
pushal
pushfd
push dword [esp]
push 0x9ae0f2ac
lea esp, [esp + 0x48]
jmp 0x298173f