joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e2da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.10036e19
add esp, 0xc
xchg edi, ebx
xchg edi, ebx
je 0x1003e30f
pushf
cmp ebx, eax
popf
mov edx, edx
js 0x1003e30a
jl 0x1003e30c
jne 0x1003e30f
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
xor esp, 0
shr ebx, 0
jno 0x1003e3d2
pushf
nop
jmp 0x1003e3c5
cmp esp, 0x414c
popf
jmp 0x1003e3cf
jo 0x1003e3d2
sub eax, 0xfffe0d88
call fcn.1001f15f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1003e3e7
xor eax, eax
jmp 0x1003e47a
jmp 0x1003e3e9
call 0x1003e3ee
lea esp, [esp + 4]
mov esp, esp
jnp 0x1003e3fc
jns 0x1003e3f8
jp 0x1003e3fc
mov eax, 0xe8558d46
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1001f190
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.10036e19
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1003e426
xor eax, eax
jmp 0x1003e47a
call 0x1003e42b
lea esp, [esp + 4]
add eax, 0
and esp, 0xffffffff
jle 0x1003e437
ja 0x1003e445
xchg edi, edi
jne 0x1003e43d
jnp 0x1003e43f
lea esp, [esp]
jbe 0x1003e445
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.1003a66f
add esp, 4
nop
xchg esp, esp
xchg esp, esp
xor ecx, dword [esp]
xor ecx, dword [esp]
jl 0x1003e46f
pushf
ror edx, 0x1d
ror edx, 3
inc ecx
dec ecx
popf
jne 0x1003e46c
jge 0x1003e46f
mov esp, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1012dd80
Capabilities:
Encode data using xor

Disassembly:
add esp, dword [esi + 0xceb5def]
pop esp
mov al, 0xb8
push esp
add edx, dword [ecx]
push ss
xor dword [ecx + ebx + 6], 0x6b572bba
sar dword [ebp - 0xe], cl
and ah, byte [edi + ebx*8 + 0x25]
movsb byte es:[edi], byte [esi]
jno 0x1012de04
mov esi, 0x1c9bd80a
adc al, 0x8f
jno 0x1012ddf5
mov ch, byte [edx]
inc esi
fdiv qword [0x5e1971af]
xchg byte [esi - 0x6d], bl
jmp [edx]
ret
adc dword [ebx], ebx
jl 0x1012ddec
add dword [edi + edx*8 - 1], ebp
insd dword es:[edi], dx
invalid
adc dword [ebx + 0xf], ecx
xchg edx, eax
mov eax, 0x575e78bc
and esi, dword [ebp + 0x6e]
cld
mov edi, dword [0xcc3b4146]
cmpsb byte [esi], byte es:[edi]
add byte [0x35cfee00], al
insb byte es:[edi], dx
xchg esi, eax
call 0x6735e6a0
mov al, 0xde
mov ch, 0x6b
clc
xchg esp, eax
adc byte [ecx - 0x7bf700e0], 0x45
invalid
Function at 0x40fb8c
Capabilities:
Encode data using xor

Disassembly:
int1
mov ah, 0x4f
sbb edi, eax
sub byte [ebp - 0x11], cl
sbb byte [ebp - 0x41], cl
adc dword [esi + 0x5f], ecx
dec ecx
pop es
mov al, byte [0xdaf1bbb8]
das
loop 0x40fb7b
Function at 0x9bfc73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x3c]
and dword [esi], 0
add eax, ebx
mov ecx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
test eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
je 0x9bfdba
test ecx, ecx
je 0x9bfdba
push edi
push ecx
push ebx
call fcn.009bfa19
mov edi, eax
add edi, ebx
push dword [edi + 0x1c]
push ebx
call fcn.009bfa19
push dword [edi + 0x20]
mov ebx, eax
add ebx, dword [ebp + 8]
push dword [ebp + 8]
call fcn.009bfa19
push dword [edi + 0x24]
add eax, dword [ebp + 8]
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.009bfa19
add eax, dword [ebp + 8]
and dword [ebp - 4], 0
add esp, 0x20
cmp dword [edi + 0x18], 0
jbe 0x9bfd50
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call fcn.009bfa19
add eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
imul eax, eax, 0x1c
lea eax, [eax + esi + 0xe]
push eax
call fcn.009c0fc0
mov edx, dword [esi]
mov eax, dword [ebp - 8]
imul edx, edx, 0x1c
movzx ecx, word [eax]
add dword [ebp + 0xc], 4
add esp, 0x10
mov ecx, dword [ebx + ecx*4]
mov dword [edx + esi + 0x20], ecx
movzx ecx, word [eax]
and dword [ebx + ecx*4], 0
mov ecx, dword [esi]
imul ecx, ecx, 0x1c
and byte [ecx + esi + 0xc], 0
inc dword [esi]
inc dword [ebp - 4]
inc eax
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp eax, dword [edi + 0x18]
jb 0x9bfcf4
xor ecx, ecx
cmp dword [edi + 0x14], ecx
jbe 0x9bfd8c
mov eax, dword [ebx]
test eax, eax
je 0x9bfd83
mov edx, dword [esi]
imul edx, edx, 0x1c
mov dword [edx + esi + 0x20], eax
mov eax, dword [esi]
imul eax, eax, 0x1c
mov byte [eax + esi + 0xc], 1
mov edx, dword [esi]
mov ax, word [edi + 0x10]
imul edx, edx, 0x1c
add ax, cx
mov word [edx + esi + 0xe], ax
inc dword [esi]
inc ecx
add ebx, 4
cmp ecx, dword [edi + 0x14]
jb 0x9bfd57
mov eax, dword [esi]
push dword [ebp - 0xc]
imul eax, eax, 0x1c
push 0
add eax, 8
push dword [ebp - 0x10]
mov dword [esi + 4], eax
push dword [ebp + 8]
call fcn.009bfa19
add eax, dword [ebp + 8]
pop ecx
pop ecx
push eax
call fcn.009c10b0
add esp, 0xc
xor eax, eax
pop edi
jmp 0x9bfdbd
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x9c6c4f
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x118]
and dword [esi + 8], 0
mov dword [esi + 0x11c], eax
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [esi + 0x120], ecx
mov dx, word [eax]
cmp dx, 0x5a4d
jne 0x9c6ca3
cmp dword [ecx], 0x4550
jne 0x9c6ca3
mov eax, ecx
mov dword [esi + 8], 1
add eax, 4
mov dword [esi + 0x124], eax
mov eax, ecx
movzx ecx, word [eax + 0x14]
lea eax, [ecx + eax + 0x18]
mov dword [esi + 0x128], eax
pop esi
ret
cmp dx, 0x14c
jne 0x9c6cc8
cmp word [eax + 0x10], 0
jne 0x9c6cc8
mov dword [esi + 8], 2
mov dword [esi + 0x124], eax
movzx ecx, word [eax + 0x10]
lea eax, [ecx + eax + 0x14]
jmp 0x9c6c9b
cmp dx, 0x4944
jne 0x9c6cdf
cmp word [eax + 2], 0
jne 0x9c6cdf
mov dword [esi + 8], 4
pop esi
ret
push 8
push 0x9b90ec
push eax
call fcn.009c14d0
add esp, 0xc
test eax, eax
jne 0x9c6cfc
mov dword [esi + 8], 3
pop esi
ret
and dword [esi + 8], 0
pop esi
ret

Function at 0x9c6d90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x9bdfb8
push 0x40
pop ecx
xor dword [eax], 0xff
add eax, 4
dec ecx
jne 0x9c6d98
cmp eax, 0x9be7b8
jl 0x9c6d95
ret
Function at 0xa60e62
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call fcn.00a63a74
mov esi, dword [ebp + 8]
xor edx, edx
add esp, 0xc
cmp dword [ebp + 0xc], edx
mov al, byte [esi]
mov cl, byte [esi + 1]
mov dword [ebp - 4], edx
jle 0xa60f18
push ebx
push edi
movzx edi, al
movzx ecx, cl
mov dword [ebp - 8], edx
jmp 0xa60ea0
mov ecx, dword [ebp - 0xc]
lea eax, [edi + 1]
mov edi, pe_nt_image_headers32
cdq
idiv edi
movzx edi, dl
movzx eax, byte [edi + esi + 2]
lea ebx, [edi + esi + 2]
add eax, ecx
mov byte [ebp + 0xb], dl
mov ecx, pe_nt_image_headers32
cdq
idiv ecx
movzx eax, dl
mov dword [ebp - 0xc], eax
mov byte [ebp + 0x13], dl
lea eax, [eax + esi + 2]
push eax
push ebx
mov dword [ebp - 0x10], eax
call fcn.00a60f20
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop ecx
movzx edx, byte [edx]
pop ecx
mov ecx, dword [ebp + 0x14]
add ecx, eax
movzx eax, byte [ebx]
add eax, edx
mov ebx, pe_nt_image_headers32
cdq
idiv ebx
movzx eax, dl
mov al, byte [eax + esi + 2]
xor byte [ecx], al
inc dword [ebp - 4]
movsx eax, word [ebp - 4]
cmp eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jl 0xa60e9d
mov cl, byte [ebp + 0x13]
mov al, byte [ebp + 0xb]
pop edi
pop ebx
mov byte [esi], al
mov byte [esi + 1], cl
pop esi
leave
ret
Function at 0xa63154
Capabilities:
Encode data using xor

Disassembly:
push edi
mov di, word [esp + 0x10]
xor cl, cl
test di, di
jbe 0xa63183
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov bl, byte [eax]
xor bl, dl
inc cl
xor dx, dx
mov byte [eax], bl
inc eax
mov dl, cl
inc esi
cmp dx, di
jb 0xa6316b
pop esi
pop ebx
pop edi
ret
Function at 0xa82996
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0xa829a8
push 0x10
pop eax
jmp 0xa82a0d
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0xa829a3
mov dl, byte [ecx]
mov eax, dword [ebp + 0xc]
test eax, eax
mov byte [ebp + 0xb], dl
mov dl, byte [ecx + 4]
mov dword [ebp - 8], eax
mov byte [ebp - 1], dl
je 0xa829fd
push ebx
push esi
dec dword [ebp + 0xc]
inc byte [ebp + 0xb]
movzx eax, byte [ebp + 0xb]
lea esi, [eax + ecx + 8]
mov al, byte [esi]
add byte [ebp - 1], al
movzx edx, byte [ebp - 1]
lea edx, [edx + ecx + 8]
mov bl, byte [edx]
mov byte [esi], bl
mov byte [edx], al
mov dl, byte [esi]
add dl, al
movzx eax, dl
mov al, byte [eax + ecx + 8]
xor byte [edi], al
inc edi
cmp dword [ebp + 0xc], 0
jne 0xa829c6
pop esi
pop ebx
movzx eax, byte [ebp + 0xb]
mov dword [ecx], eax
movzx eax, byte [ebp - 1]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
pop edi
leave
ret
Function at 0xa85c50
Capabilities:
Encode data using xor

Disassembly:
push edi
mov di, word [esp + 0x10]
xor cl, cl
test di, di
jbe 0xa85c7f
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov bl, byte [eax]
xor bl, dl
inc cl
xor dx, dx
mov byte [eax], bl
inc eax
mov dl, cl
inc esi
cmp dx, di
jb 0xa85c67
pop esi
pop ebx
pop edi
ret
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43ea0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x43ea08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43ea08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x374f46b2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x2840378d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4e3510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x247f2454
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov esi, ecx
push 0x247f4958
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], esi
call dword [0x247f40bc]
lea eax, [esp + 0xc]
lea edi, [esi + 4]
push eax
mov ecx, edi
mov dword [esp + 0x34], 0
call fcn.004e3590
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call dword [0x247f40b0]
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov dword [edi], 0x247f491c
mov dword [esi], 0x247f4924
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x4eb7a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x247f2afd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x120]
mov ecx, 0x45
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.004e4550
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x247f4fe4
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0x247f4fd8
mov ecx, dword [ebp - 0x14]
add ecx, 0x64
call fcn.004ed510
mov byte [ebp - 4], 1
movzx eax, byte [0x247f9864]
test eax, eax
jne 0x4eb8ae
mov esi, esp
push 0x247f4fbc
lea ecx, [ebp - 0x11c]
call dword [0x247f40bc]
cmp esi, esp
call fcn.004f1146
mov byte [ebp - 4], 2
mov esi, esp
push 0x247f4fac
lea ecx, [ebp - 0xf8]
call dword [0x247f40bc]
cmp esi, esp
call fcn.004f1146
mov byte [ebp - 4], 3
push 0
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0xf8]
push ecx
call fcn.004e1b71
mov ecx, eax
call fcn.004e1b9b
mov dword [0x247f9868], eax
mov byte [ebp - 4], 2
mov esi, esp
lea ecx, [ebp - 0xf8]
call dword [0x247f40b0]
cmp esi, esp
call fcn.004f1146
mov byte [ebp - 4], 1
mov esi, esp
lea ecx, [ebp - 0x11c]
call dword [0x247f40b0]
cmp esi, esp
call fcn.004f1146
mov byte [0x247f9864], 1
cmp dword [0x247f9868], 0
je 0x4eb8c2
mov eax, dword [ebp - 0x14]
mov word [eax + 0x60], 0x100
jmp 0x4eb8cb
mov eax, dword [ebp - 0x14]
mov word [eax + 0x60], 0
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x62], 1
mov eax, dword [ebp - 0x14]
mov word [eax + 0x30], 0
mov esi, esp
push 0x247f4916
mov ecx, dword [ebp - 0x14]
add ecx, 0x34
call dword [0x247f40f0]
cmp esi, esp
call fcn.004f1146
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x50], 0x35
mov ecx, dword [ebp - 0x14]
call fcn.004ed450
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x54], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x58], 0
call fcn.004e1b71
mov ecx, eax
call fcn.004f01e2
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x5c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x120
cmp ebp, esp
call fcn.004f1146
mov esp, ebp
pop ebp
ret
Function at 0x526180
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10148eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1018d0d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [esi]
push 0
push esi
call dword [eax + 0x30]
xor ebx, ebx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea edi, [esi + 0x64]
mov dword [ebp - 4], ebx
mov ecx, edi
mov dword [ebp - 0x18], edi
call fcn.004e4280
mov eax, dword [esi + 0x5c]
mov byte [ebp - 4], 1
mov esi, dword [eax]
cmp esi, eax
je 0x5262a6
mov edi, dword [ebp - 0x24]
mov ecx, ebx
lea ebx, [ebx]
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jae 0x526229
cmp edi, eax
ja 0x526229
sub eax, edi
sar eax, 2
mov dword [ebp - 0x10], eax
cmp ebx, ecx
jne 0x526220
push 1
lea ecx, [ebp - 0x24]
call fcn.004f2740
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
test ebx, ebx
je 0x52624b
mov eax, dword [edi + eax*4]
jmp 0x526249
cmp ebx, ecx
jne 0x526243
push 1
lea ecx, [ebp - 0x24]
call fcn.004f2740
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
test ebx, ebx
je 0x52624b
mov eax, dword [eax]
mov dword [ebx], eax
add ebx, 4
cmp byte [esi + 0xd], 0
mov dword [ebp - 0x20], ebx
jne 0x526297
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x52627c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x526297
lea ebx, [ebx]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x526270
jmp 0x526297
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x526295
cmp esi, dword [eax + 8]
jne 0x526295
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x526285
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp esi, dword [eax + 0x5c]
jne 0x5261f0
mov edi, dword [ebp - 0x18]
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004e4290
mov eax, dword [ebp - 0x24]
mov ecx, ebx
sub ecx, eax
xor edx, edx
add ecx, 3
xor edi, edi
shr ecx, 2
mov esi, eax
cmp eax, ebx
cmova ecx, edx
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x5262e8
mov ebx, ecx
mov ecx, dword [ebp - 0x14]
push dword [esi]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x30]
inc edi
lea esi, [esi + 4]
cmp edi, ebx
jne 0x5262d2
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x5262f5
push eax
call 0x5eb1ea
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x529f40
Capabilities:
Encode data using xor

Disassembly:
adc ah, byte [esi - 0x75]
mov dh, 0
invalid
push ebp
mov ebp, esp
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
mov edx, dword [ebp + 8]
sar eax, 2
cmp eax, edx
jae 0x529f63
cmp edx, 0x3fffffff
ja 0x529f67
mov dword [ebp + 8], edx
pop ebp
jmp 0x4da790
pop ebp
ret 4
push 0x10178d84
call 0x5e7002
int3
Function at 0x52da40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014992c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1018d0d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x10152880
mov dword [esi + 8], 0x10179698
mov dword [esi + 0xc], 0x10155580
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
lea eax, [esi + 0x14]
mov dword [esi], 0x1015558c
xor ecx, ecx
mov dword [esi + 4], 0x101555b0
mov dword [esi + 8], 0x101555c8
mov dword [esi + 0xc], 0x101555d0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
push eax
mov dword [eax + 0x14], ecx
call dword [0x10152100]
mov dword [esi + 0x2c], 0
xor eax, eax
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x58], 7
mov dword [esi + 0x54], 0
mov word [esi + 0x44], ax
push 0x40
mov byte [ebp - 4], 3
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
call 0x5eb4b2
add esp, 4
test eax, eax
jne 0x52db1c
call 0x5e6fd1
lea ecx, [eax + 4]
mov dword [eax], eax
test ecx, ecx
je 0x52db27
mov dword [ecx], eax
lea ecx, [eax + 8]
test ecx, ecx
je 0x52db30
mov dword [ecx], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x5c], eax
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
call int.00509a00
mov ecx, eax
test ecx, ecx
jne 0x52db78
push 0x80004005
call fcn.0050ed50
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x7c], eax
mov eax, esi
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 0
mov byte [esi + 0xe0], 0
mov dword [esi + 0xb8], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xd0], 0
mov dword [esi + 0xd4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x533aa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
cmp esi, 0x40
jae 0x533ace
or eax, 0xffffffff
pop esi
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov eax, 0x5a4d
mov dword [ecx + 8], edx
push edi
cmp word [edx], ax
jne 0x533b79
mov edi, dword [edx + 0x3c]
cmp edi, esi
jae 0x533b79
lea eax, [edi + 0x18]
cmp eax, esi
jae 0x533b79
movzx eax, word [edi + edx + 4]
mov edi, 0x14c
cmp di, ax
jne 0x533b11
mov dword [ecx + 0xc], 0
jmp 0x533b22
mov edi, 0x8664
cmp di, ax
jne 0x533b79
mov dword [ecx + 0xc], 1
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [ecx + 0xc], 0
push ebx
jne 0x533b33
mov dword [ecx + 0x10], eax
jmp 0x533b36
mov dword [ecx + 0x14], eax
cmp dword [eax], 0x4550
jne 0x533b58
movzx edi, word [eax + 0x14]
movzx eax, word [eax + 6]
mov ebx, dword [edx + 0x3c]
lea eax, [eax + eax*4]
lea eax, [eax + 3]
lea eax, [edi + eax*8]
add eax, ebx
cmp eax, esi
jb 0x533b60
pop ebx
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
lea eax, [ebx + 0x18]
mov dword [ecx + 4], esi
add eax, edi
mov dword [ecx], edx
mov dword [ecx + 0x18], eax
add eax, edx
pop ebx
pop edi
mov dword [ecx + 0x1c], eax
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x533f40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x5394a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edi
test edi, edi
je 0x539551
mov eax, dword [ebp + 0xc]
test al, 7
jne 0x539551
xor ecx, ecx
mov byte [ebp - 0xc], 0
push esi
xor esi, esi
mov dword [ebp - 0xb], ecx
mov word [ebp - 7], cx
mov byte [ebp - 5], cl
test eax, eax
je 0x539550
push ebx
push 8
add edi, esi
lea eax, [ebp - 0xc]
push edi
push 8
push eax
call 0x5ed712
mov cl, byte [ebp - 0xc]
add esp, 0x10
mov al, cl
xor al, 0x6b
mov byte [edi], al
mov edi, dword [ebp - 0x10]
movzx eax, byte [ebp - 0xb]
xor al, cl
mov byte [edi + esi + 1], al
movzx eax, byte [ebp - 0xa]
xor al, cl
mov byte [edi + esi + 2], al
mov al, byte [ebp - 9]
xor al, 0x20
mov byte [edi + esi + 3], al
mov al, byte [ebp - 8]
xor al, 0x3a
mov byte [edi + esi + 4], al
mov al, byte [ebp - 7]
xor al, byte [ebp - 9]
mov byte [edi + esi + 5], al
movzx eax, byte [ebp - 6]
xor al, byte [ebp - 8]
mov byte [edi + esi + 6], al
movzx eax, byte [ebp - 5]
xor al, byte [ebp - 7]
mov byte [edi + esi + 7], al
add esi, 8
cmp esi, dword [ebp + 0xc]
jb 0x5394e2
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call 0x5eb3e5
mov esp, ebp
pop ebp
ret