joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78c5f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0x18
pop eax
call fcn.006f8060
mov eax, dword [ebp + 0x1c]
and dword [ebp - 4], 0
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 0x18]
movzx ecx, byte [esi]
push edi
mov edi, dword [eax]
lea eax, [esi + 1]
mov dh, byte [eax]
mov dword [ebp - 8], eax
xor ebx, ebx
or ecx, edx
inc eax
movzx edx, byte [eax]
shl edx, 0x10
or ecx, edx
inc eax
movzx edx, byte [eax]
shl edx, 0x18
or ecx, edx
inc eax
movzx edx, byte [eax]
inc eax
mov bh, byte [eax]
mov byte [ebp - 0x10], cl
or edx, ebx
inc eax
xor ebx, ebx
mov bh, byte [eax + 1]
mov bl, byte [eax]
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xf], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xe], al
shl ebx, 0x10
or edx, ebx
mov eax, edx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, edx
shr eax, 0x10
mov ebx, ecx
mov byte [ebp - 0xa], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
shr ecx, 0x18
mov byte [ebp - 0xc], dl
shr edx, 0x18
test eax, eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xd], cl
mov byte [ebp - 9], dl
je 0x78c73c
mov dword [ebp + 0x18], eax
test edi, edi
jne 0x78c6e3
push 1
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
call fcn.00933000
mov ebx, dword [ebp - 0x18]
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xf], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x14]
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0xb], cl
mov ecx, eax
mov byte [ebp - 0xc], al
shr ecx, 0x10
shr eax, 0x18
add esp, 0xc
inc dword [ebp - 4]
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xa], cl
mov byte [ebp - 9], al
mov al, byte [ebp + edi - 0x10]
mov ecx, dword [ebp + 8]
xor al, byte [ecx]
mov ecx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
inc dword [ebp + 8]
inc edi
and edi, 7
dec dword [ebp + 0x18]
mov byte [ecx], al
jne 0x78c691
cmp dword [ebp - 4], 0
je 0x78c73c
mov eax, dword [ebp - 8]
mov byte [esi], bl
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
mov ecx, dword [ebp - 0x14]
inc eax
shr ebx, 0x18
mov byte [eax], bl
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
mov byte [eax], dl
mov byte [eax + 1], cl
mov eax, dword [ebp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x791d86
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x1c
pop eax
call fcn.006f8060
push esi
mov esi, dword [ebp + 0xc]
dec esi
lea eax, [esi - 0x29]
cmp dword [ebp + 0x14], eax
jle 0x791da9
push 0x2d
push 0xb96138
push 0x6e
jmp 0x791db7
cmp esi, 0x29
jge 0x791dca
push 0x33
push 0xb96138
push 0x78
push 0x79
push 4
call fcn.0077309b
add esp, 0x14
xor eax, eax
jmp 0x791ed3
push edi
push 0x37
lea eax, [esi - 0x14]
mov edi, 0xb96138
push edi
push eax
mov dword [ebp + 0xc], eax
call fcn.00773bb7
add esp, 0xc
test eax, eax
mov dword [ebp - 8], eax
jne 0x791e01
push 0x3a
push edi
push 0x41
push 0x79
push 4
call fcn.0077309b
add esp, 0x14
xor eax, eax
jmp 0x791ed2
mov eax, dword [ebp + 8]
push ebx
lea ecx, [eax + 1]
push 0
mov byte [eax], 0
mov dword [ebp - 4], ecx
lea ebx, [eax + 0x15]
call fcn.00779b8d
push eax
push 0
push ebx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.00778f45
mov ecx, esi
sub ecx, dword [ebp + 0x14]
xor eax, eax
sub ecx, 0x29
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 0x14]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x14]
mov eax, ebx
sub eax, ecx
add eax, esi
mov esi, dword [ebp + 0x10]
mov byte [eax - 0x15], 1
lea edi, [eax - 0x14]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x14
rep movsb byte es:[edi], byte [esi]
pop edi
push edi
push dword [ebp - 4]
call fcn.00778c25
add esp, 0x20
test eax, eax
jg 0x791e7a
xor eax, eax
jmp 0x791ed1
mov esi, dword [ebp - 8]
push edi
push dword [ebp - 4]
push dword [ebp + 0xc]
push esi
call fcn.00791d67
add esp, 0x10
cmp dword [ebp + 0xc], 0
jle 0x791ea3
mov ecx, dword [ebp + 0xc]
mov eax, ebx
sub esi, ebx
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x791e9a
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push ebx
push edi
push eax
call fcn.00791d67
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x1c]
add esp, 0x10
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x791ebc
push dword [ebp - 8]
call fcn.00773d55
xor eax, eax
pop ecx
inc eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x791ed6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x30
pop eax
call fcn.006f8060
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 0x18]
dec ebx
cmp ebx, 0x29
push esi
push edi
jl 0x792031
mov edi, ebx
sub edi, dword [ebp + 0x14]
jns 0x791f09
mov dword [ebp - 8], 1
xor edi, edi
mov esi, dword [ebp + 0x10]
push 0x7a
sub esi, edi
lea eax, [esi + 0x14]
add ebx, 0xffffffec
push 0xb96138
push ebx
mov dword [ebp + 0x18], eax
call fcn.00773bb7
add esp, 0xc
test eax, eax
mov dword [ebp - 4], eax
jne 0x791f48
push 0x7d
push 0xb96138
push 0x41
push 0x7a
push 4
call fcn.0077309b
add esp, 0x14
jmp 0x792058
push ebx
push dword [ebp + 0x18]
lea eax, [ebp - 0x1c]
push 0x14
push eax
call fcn.00791d67
add esp, 0x10
jmp 0x791f64
mov al, byte [esi + edi]
xor byte [ebp + edi - 0x1c], al
inc edi
cmp edi, 0x14
jl 0x791f5c
push 0x14
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 4]
call fcn.00791d67
add esp, 0x10
test ebx, ebx
jle 0x791f92
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 0x18]
sub esi, eax
mov edi, ebx
mov cl, byte [esi + eax]
xor byte [eax], cl
inc eax
dec edi
jne 0x791f89
push 0
call fcn.00779b8d
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call fcn.00778f45
mov esi, dword [ebp - 4]
add esp, 0x18
push 5
pop ecx
lea edi, [ebp - 0x30]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x792031
cmp dword [ebp - 8], eax
jne 0x792031
push 0x14
pop eax
cmp ebx, eax
jle 0x791fd7
mov ecx, dword [ebp - 4]
cmp byte [eax + ecx], 0
jne 0x791fd7
inc eax
cmp eax, ebx
jl 0x791fc9
mov ecx, dword [ebp - 4]
cmp byte [eax + ecx], 1
jne 0x792031
mov ecx, eax
inc eax
cmp ecx, ebx
jge 0x792031
sub ebx, eax
cmp dword [ebp + 0xc], ebx
jge 0x79200b
push 0x9b
push 0xb96138
push 0x6d
push 0x7a
push 4
call fcn.0077309b
add esp, 0x14
or ebx, 0xffffffff
jmp 0x792024
mov edx, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov ecx, ebx
lea esi, [eax + edx]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 4]
call fcn.00773d55
pop ecx
mov eax, ebx
jmp 0x79205b
push 0xa8
push 0xb96138
push 0x79
push 0x7a
push 4
call fcn.0077309b
add esp, 0x14
cmp dword [ebp - 4], 0
je 0x792058
push dword [ebp - 4]
call fcn.00773d55
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7920e4
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x14], edx
push esi
jne 0x79217d
mov eax, dword [esp + 0x10]
mov cl, byte [eax]
cmp cl, 0x6a
je 0x792103
cmp cl, 0x6b
jne 0x79217d
cmp cl, 0x6b
lea esi, [eax + 1]
jne 0x79214b
lea eax, [edx - 3]
xor ecx, ecx
test eax, eax
jle 0x792126
mov dl, byte [esi]
inc esi
cmp dl, 0xba
je 0x792126
cmp dl, 0xbb
jne 0x79213a
inc ecx
cmp ecx, eax
jl 0x792114
sub eax, ecx
test ecx, ecx
jne 0x79214e
mov eax, 0x8a
push eax
push 0xb96150
push eax
jmp 0x792189
push 0x81
push 0xb96150
push 0x8a
jmp 0x792189
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x792165
push 0x93
push 0xb96150
push 0x8b
jmp 0x792189
push edi
mov edi, dword [esp + 0xc]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push 0xb96150
push 0x89
push 0x80
push 4
call fcn.0077309b
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x7e078e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x7e07c7
and dword [esi + 4], 0xff
xor dword [esi + 0x56], 0xacddddca
push ebx
push 8
mov dword [esi], 0x44646441
pop ebx
mov eax, ebx
cdq
push 3
pop ecx
idiv ecx
mov al, bl
mov ecx, edx
shl al, cl
xor byte [ebx + esi], al
inc ebx
cmp ebx, 0x4a
jl 0x7e07af
pop ebx
pop esi
ret

Function at 0x818023
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x10
xor edi, edi
lea eax, [ebp - 0x14]
push edi
push eax
xor esi, esi
call fcn.006f6cc0
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.00707f49
add esp, 0x14
mov eax, 0x140c
nop
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
push 0xa6c4a4
call fcn.006f6980
add esp, 0xc
xor ecx, ecx
cmp dword [ebp + 0xc], edi
jbe 0x81808b
mov dl, byte [esi + 0xa6c4a0]
xor dl, byte [ebp + edi - 0x14]
mov eax, dword [ebp + 8]
add eax, ecx
xor byte [eax], dl
inc esi
and esi, 7
inc edi
and edi, 0xf
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x81806c
pop edi
pop esi
leave
ret

Function at 0x8223b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [0xa6c648]
push esi
mov esi, dword [0xa6c644]
add esi, 2
add ebx, 0xfffffffa
cmp esi, ebx
jae 0x822400
push edi
mov eax, dword [0xa6c640]
lea edi, [eax + esi]
xor edx, edx
mov eax, esi
push 7
pop ecx
div ecx
mov eax, dword [0xa6c64c]
movzx eax, word [eax]
mov ecx, edx
shl ax, cl
mov ecx, esi
and ecx, 3
mov edx, esi
shl edx, cl
add eax, edx
xor word [edi], ax
inc esi
inc esi
cmp esi, ebx
jb 0x8223cd
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
ret

Function at 0x890c12
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push ebx
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, 0x367a23df
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, dword [esi]
xor ebx, edx
add eax, ebx
add esi, 4
dec ecx
jne 0x890c25
xor eax, 0x731678d3
pop ebx
pop ecx
pop esi
leave
ret 8
Function at 0x890c49
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push ebx
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, 0xbd853e14
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, dword [esi]
xor ebx, edx
add eax, ebx
add esi, 4
dec ecx
jne 0x890c5c
xor eax, 0x34a88d3e
pop ebx
pop ecx
pop esi
leave
ret 8

Function at 0x92f02c
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
xor ecx, ecx
or esi, 0xffffffff
xor edi, edi
cmp dword [esp + 0xc], ecx
jbe 0x92f080
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x14], 0
je 0x92f05c
cmp ecx, 1
jbe 0x92f05c
cmp byte [ecx + edx - 2], 0xff
jne 0x92f05c
cmp byte [ecx + edx - 1], 0x15
jne 0x92f05c
push 4
pop edi
test edi, edi
ja 0x92f078
xor eax, eax
mov al, byte [ecx + edx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0xb5fe70]
jmp 0x92f079
dec edi
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x92f03f
mov eax, esi
pop edi
not eax
pop esi
ret

Function at 0x930906
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
sub esi, dword [ebp + 8]
push edi
inc esi
push esi
call fcn.006f73b2
mov ebx, eax
test ebx, ebx
pop ecx
lea edi, [ebx + esi - 1]
je 0x93098c
push esi
push dword [ebp + 8]
push ebx
call fcn.006f6980
add esp, 0xc
cmp ebx, edi
mov esi, ebx
jae 0x930974
push esi
call fcn.00708bdc
test eax, eax
pop ecx
mov dword [ebp + 8], eax
jl 0x930974
lea ecx, [eax - 1]
test ecx, ecx
jle 0x93095f
dec eax
push eax
lea eax, [esi + 1]
push 0
push eax
call fcn.006f6cc0
mov eax, dword [ebp + 8]
add esp, 0xc
mov cl, byte [esi]
cmp cl, 0xcc
je 0x93096b
cmp cl, 0x90
jne 0x93096e
mov byte [esi], 0
add esi, eax
cmp esi, edi
jb 0x930937
push 0
push ebx
sub edi, ebx
push edi
call fcn.0092f02c
push ebx
mov esi, eax
call fcn.006f73ad
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x986150
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
xor ecx, ecx
xor eax, eax
movsx edx, byte [eax + 0x97f2b0]
dec edx
cmp edx, ecx
je 0x98616e
inc eax
cmp eax, 0x20
jl 0x98615a
jmp 0x986172
mov byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0x20
jl 0x986158
and dword [ebp - 8], 0
push ebx
lea eax, [ebp - 0x2c]
push esi
mov dword [ebp - 0xc], eax
mov eax, 0x97d578
push edi
xor edx, edx
mov dword [ebp - 4], eax
mov eax, edx
sar eax, 1
mov ecx, edx
and ecx, 1
shl ecx, 4
and eax, 0xf
or eax, ecx
mov ecx, edx
and ecx, 0x20
or eax, ecx
mov ecx, dword [ebp - 8]
movsx edi, byte [ecx + eax + 0x97f0b0]
xor ebx, ebx
xor esi, esi
push 8
pop eax
mov ecx, esi
sar eax, cl
test edi, eax
je 0x9861d4
mov eax, dword [ebp - 0xc]
movsx eax, byte [eax + esi]
push 0x1f
pop ecx
sub ecx, eax
xor eax, eax
inc eax
shl eax, cl
or ebx, eax
inc esi
cmp esi, 4
jl 0x9861b6
mov eax, dword [ebp - 4]
add dword [ebp - 4], 4
inc edx
cmp edx, 0x40
mov dword [eax], ebx
jl 0x98618f
mov eax, dword [ebp - 4]
add dword [ebp - 8], 0x40
add dword [ebp - 0xc], 4
cmp eax, 0x97dd78
jl 0x98618a
pop edi
pop esi
pop ebx
leave
ret

Function at 0x98626f
Capabilities:
Encrypt data using des

Disassembly:
call fcn.00986150
push 0x97efb8
push 0x97dd78
call fcn.00986200
push 0x97eff8
push 0x97e578
call fcn.00986200
add esp, 0x10
xor eax, eax
ret
Function at 0xa94b51
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0xa94b7f
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0xa94b86
cmp ebx, dword [eax + 4]
jae 0xa94b86
xor eax, eax
jmp 0xa94d76
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0xa94b97
xor eax, eax
inc eax
jmp 0xa94d75
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0xa94bad
cmp ecx, edx
jae 0xa94cf2
cmp dword [eax + 4], 0
je 0xa94bb6
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0xa94b9e
cmp dword [ebp + 8], 0
je 0xa94bd8
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0xa94cf2
cmp eax, esi
jae 0xa94cf2
mov eax, dword [0x421b28]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0xa94bfd
cmp dword [esi*4 + 0x421b30], edi
je 0xa94cf6
inc esi
cmp esi, eax
jl 0xa94beb
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x41a16c]
test eax, eax
je 0xa94d72
cmp dword [ebp - 8], 0x1000000
jne 0xa94d72
test byte [ebp - 0xc], 0xcc
je 0xa94c7b
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0xa94d72
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0xa94d72
cmp word [eax + 0x18], 0x10b
jne 0xa94d72
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0xa94d72
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0xa94c7b
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0xa94c7b
test byte [ecx + 0x27], 0x80
jne 0xa94cf2
push 1
push 0x421b70
call dword [0x41a168]
test eax, eax
jne 0xa94b8f
mov ecx, dword [0x421b28]
test ecx, ecx
mov edx, ecx
jle 0xa94caf
lea eax, [ecx*4 + 0x421b2c]
cmp dword [eax], edi
je 0xa94caf
dec edx
sub eax, 4
test edx, edx
jg 0xa94ca3
test edx, edx
jne 0xa94ce0
push 0xf
pop ebx
cmp ecx, ebx
jg 0xa94cbc
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0xa94cd4
lea eax, [edx*4 + 0x421b30]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0xa94cc2
cmp ecx, 0x10
jge 0xa94ce0
inc ecx
mov dword [0x421b28], ecx
push 0
push 0x421b70
call dword [0x41a168]
jmp 0xa94b8f
xor eax, eax
jmp 0xa94d75
test esi, esi
jle 0xa94b8f
mov ebx, dword [0x41a168]
push 1
push 0x421b70
call ebx
test eax, eax
jne 0xa94b8f
cmp dword [esi*4 + 0x421b30], edi
je 0xa94d4c
mov eax, dword [0x421b28]
lea esi, [eax - 1]
test esi, esi
jl 0xa94d3a
cmp dword [esi*4 + 0x421b30], edi
je 0xa94d36
dec esi
jns 0xa94d2a
test esi, esi
jge 0xa94d4a
cmp eax, 0x10
jge 0xa94d45
inc eax
mov dword [0x421b28], eax
lea esi, [eax - 1]
jmp 0xa94d4c
je 0xa94d64
xor ecx, ecx
test esi, esi
jl 0xa94d64
lea eax, [ecx*4 + 0x421b30]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0xa94d52
push 0
push 0x421b70
call ebx
jmp 0xa94b8f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0xad8270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00ae046c
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov eax, 0x1000
cmp esi, eax
jge 0xad82ef
test esi, esi
jl 0xad82ef
push eax
lea eax, [ebp - 0x1000]
push 0
push eax
call fcn.00ae029c
push esi
add edi, 4
lea eax, [ebp - 0x1000]
push edi
push eax
call fcn.00ae061c
lea eax, [esi - 2]
add esp, 0x18
test eax, eax
jl 0xad82cc
mov cl, byte [ebp + eax - 0xfff]
xor byte [ebp + eax - 0x1000], cl
dec eax
jns 0xad82bb
lea eax, [esi + 1]
cmp eax, dword [ebp + 0x10]
jle 0xad82d7
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.00ae061c
mov eax, dword [ebp + 0xc]
add esp, 0xc
jmp 0xad82f1
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0xadabb2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x417a51
call fcn.00ae17fc
push ecx
push esi
mov esi, ecx
and dword [esi + 4], 0
push edi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
push 0x40654b
push 0x20
push 0xc
lea edi, [esi + 0x30]
push edi
mov dword [esi], 0x419730
call fcn.00ada99a
and dword [esi + 0x1b8], 0
lea eax, [esi + 0x1b4]
and dword [eax], 0
push 5
lea ecx, [esi + 0x1b0]
push eax
push ecx
push edi
mov dword [ecx], 0x20
call fcn.00adba23
mov dword [esi + 4], 3
call fcn.00adbbbd
push 0x20
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
push 0x419720
push eax
call fcn.00ae1e5c
mov ecx, dword [ebp - 0xc]
add esp, 0x1c
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0xade282
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
jne 0xade294
xor al, al
jmp 0xade2c2
push ebx
mov ebx, dword [ebp + 0x18]
cmp ebx, esi
jne 0xade29e
mov ebx, edi
cmp dword [ebp + 0xc], esi
jle 0xade2bf
sub edi, ebx
mov eax, esi
cdq
idiv dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
lea ecx, [esi + ebx]
mov al, byte [edx + eax]
xor al, byte [edi + ecx]
inc esi
cmp esi, dword [ebp + 0xc]
mov byte [ecx], al
jl 0xade2a5
mov al, 1
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0xae734b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0xae7379
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0xae7380
cmp ebx, dword [eax + 4]
jae 0xae7380
xor eax, eax
jmp 0xae7570
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0xae7391
xor eax, eax
inc eax
jmp 0xae756f
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0xae73a7
cmp ecx, edx
jae 0xae74ec
cmp dword [eax + 4], 0
je 0xae73b0
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0xae7398
cmp dword [ebp + 8], 0
je 0xae73d2
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0xae74ec
cmp eax, esi
jae 0xae74ec
mov eax, dword [0x421d00]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0xae73f7
cmp dword [esi*4 + 0x421d08], edi
je 0xae74f0
inc esi
cmp esi, eax
jl 0xae73e5
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x41816c]
test eax, eax
je 0xae756c
cmp dword [ebp - 8], 0x1000000
jne 0xae756c
test byte [ebp - 0xc], 0xcc
je 0xae7475
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0xae756c
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0xae756c
cmp word [eax + 0x18], 0x10b
jne 0xae756c
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0xae756c
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0xae7475
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0xae7475
test byte [ecx + 0x27], 0x80
jne 0xae74ec
push 1
push 0x421d48
call dword [0x41819c]
test eax, eax
jne 0xae7389
mov ecx, dword [0x421d00]
test ecx, ecx
mov edx, ecx
jle 0xae74a9
lea eax, [ecx*4 + 0x421d04]
cmp dword [eax], edi
je 0xae74a9
dec edx
sub eax, 4
test edx, edx
jg 0xae749d
test edx, edx
jne 0xae74da
push 0xf
pop ebx
cmp ecx, ebx
jg 0xae74b6
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0xae74ce
lea eax, [edx*4 + 0x421d08]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0xae74bc
cmp ecx, 0x10
jge 0xae74da
inc ecx
mov dword [0x421d00], ecx
push 0
push 0x421d48
call dword [0x41819c]
jmp 0xae7389
xor eax, eax
jmp 0xae756f
test esi, esi
jle 0xae7389
mov ebx, dword [0x41819c]
push 1
push 0x421d48
call ebx
test eax, eax
jne 0xae7389
cmp dword [esi*4 + 0x421d08], edi
je 0xae7546
mov eax, dword [0x421d00]
lea esi, [eax - 1]
test esi, esi
jl 0xae7534
cmp dword [esi*4 + 0x421d08], edi
je 0xae7530
dec esi
jns 0xae7524
test esi, esi
jge 0xae7544
cmp eax, 0x10
jge 0xae753f
inc eax
mov dword [0x421d00], eax
lea esi, [eax - 1]
jmp 0xae7546
je 0xae755e
xor ecx, ecx
test esi, esi
jl 0xae755e
lea eax, [ecx*4 + 0x421d08]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0xae754c
push 0
push 0x421d48
call ebx
jmp 0xae7389
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0xb05b25
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [0x100148c0]
push esi
mov esi, dword [0x100148bc]
add esi, 2
add ebx, 0xfffffffa
cmp esi, ebx
jae 0xb05b71
push edi
mov eax, dword [0x100148b8]
lea edi, [eax + esi]
xor edx, edx
mov eax, esi
push 7
pop ecx
div ecx
mov eax, dword [0x100148c4]
movzx eax, word [eax]
mov ecx, edx
shl ax, cl
mov ecx, esi
and ecx, 3
mov edx, esi
shl edx, cl
add eax, edx
xor word [edi], ax
inc esi
inc esi
cmp esi, ebx
jb 0xb05b3e
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
ret

Function at 0xb05dfd
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret