joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50cba0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50cc48
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x50cc0f
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x50cbf9
call fcn.0044b940
jmp fcn.0050cba0

Function at 0x510040
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x510087
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
ret
call fcn.0044b940
jmp fcn.00510040
Function at 0x533e90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53402c
sub esp, 0x40
mov eax, dword [0x88fb04]
mov dword [esp + 0x28], eax
lea ecx, [0x640e60]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call fcn.00438de0
mov eax, dword [esp + 0xc]
mov ecx, dword [0x88fb04]
mov dword [esp + 0x34], ecx
mov edx, dword [0x88fb00]
mov dword [esp + 0x3c], edx
movzx ebx, byte [esp + 0x48]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x28]
xor edi, edi
xor edi, edi
mov dword [esp + 0x24], edi
jmp 0x533f0d
inc edi
mov edx, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x34]
cmp edi, ecx
jge 0x534018
movzx edx, word [edx + edi*2]
test ebp, ebp
je 0x533f3a
movzx ecx, word [ebp + 0x88]
test cx, cx
je 0x534011
cmp dx, cx
jae 0x533f38
mov ecx, dword [esp + 0x24]
jmp 0x533efc
test ebp, ebp
je 0x533f53
movzx ecx, word [ebp + 0x8a]
test cx, cx
je 0x533f53
cmp dx, cx
jbe 0x533f53
mov ecx, dword [esp + 0x24]
jmp 0x533efc
test bl, bl
je 0x533f64
cmp dx, 0x301
jae 0x533f64
mov ecx, dword [esp + 0x24]
jmp 0x533efc
mov dword [esp + 0x30], edi
mov word [esp + 0x22], dx
cmp dx, 0x304
je 0x533fde
xor ecx, ecx
test cl, cl
je 0x533f83
mov ecx, dword [esp + 0x24]
jmp 0x533efc
mov ecx, dword [esp + 0x24]
lea ebx, [ecx + 1]
cmp ebx, esi
ja 0x533f9e
mov word [eax + ecx*2], dx
mov ecx, ebx
movzx ebx, byte [esp + 0x48]
jmp 0x533efc
lea edx, [0x640e60]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
call fcn.00438ea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea ebx, [ecx + 1]
mov ecx, dword [esp + 0x24]
movzx edx, word [esp + 0x22]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x30]
jmp 0x533f8e
mov dword [esp + 0x2c], esi
mov dword [esp + 0x38], eax
call fcn.00534040
movzx ecx, byte [esp]
xor ecx, 1
mov eax, dword [esp + 0x38]
movzx edx, word [esp + 0x22]
movzx ebx, byte [esp + 0x48]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
jmp 0x533f76
test ebp, ebp
jmp 0x533f3a
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], esi
add esp, 0x40
ret
call fcn.0044b940
jmp fcn.00533e90
Function at 0x535270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53537e
sub esp, 0x1c
mov eax, dword [esp + 0x24]
cmp eax, 1
jl 0x535366
mov ecx, dword [esp + 0x20]
movzx edx, byte [eax + ecx - 1]
lea ebx, [eax - 1]
movzx ebp, dl
mov esi, ebx
sub ebx, ebp
cmp eax, 0x100
jge 0x53535a
mov edi, eax
mov dword [esp + 0x10], esi
mov byte [esp + 2], dl
mov dword [esp + 0xc], ebp
not ebx
sar ebx, 0x1f
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
jmp 0x535318
inc ebx
xchg ebp, ebx
not ebx
xchg ebp, ebx
sar ebp, 0x1f
mov dword [esp + 8], ebp
movzx esi, byte [ecx + esi]
and ebp, edx
mov edx, dword [esp + 8]
and esi, edx
xor ebp, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
movzx edx, byte [esp + 3]
and edx, ebp
movzx ebp, byte [esp + 2]
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0xc]
mov dword [esp + 4], ebx
mov ebx, edx
movzx edx, byte [esp + 2]
mov byte [esp + 3], bl
mov ebx, dword [esp + 4]
cmp ebx, eax
jge 0x53532e
sub ebp, ebx
sub esi, ebx
cmp esi, edi
jb 0x5352d7
jmp 0x535377
movzx eax, dl
inc eax
mov dword [esp + 0x2c], eax
movzx eax, byte [esp + 3]
mov ecx, eax
shl eax, 4
and ecx, eax
mov eax, ecx
shl ecx, 2
and ecx, eax
mov eax, ecx
shl ecx, 1
and ecx, eax
sar cl, 7
mov byte [esp + 0x30], cl
add esp, 0x1c
ret
mov edi, eax
mov eax, 0x100
jmp 0x5352b6
mov dword [esp + 0x2c], 0
mov byte [esp + 0x30], 0
add esp, 0x1c
ret
call fcn.00427150
ud2
call fcn.0044b940
jmp fcn.00535270
Function at 0x544980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x544b57
sub esp, 0x4c
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 0x38]
mov ebx, dword [ecx + 0x15c]
mov ebp, dword [ecx + 0x158]
mov esi, dword [ecx + 0x154]
mov edi, dword [eax + 0x40]
mov ecx, dword [eax + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
call fcn.00558510
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.0044d18a
lea edi, [esp + 0x34]
call fcn.0044d18a
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.0054b930
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + 0x40]
mov ecx, dword [ecx + 0x20]
mov dword [esp], edx
call ecx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.0054b930
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
mov byte [esp + 4], 0x16
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.00538fe0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x544b4b
mov eax, dword [esp + 0x2c]
lea ecx, [eax + 0x108]
mov edx, dword [esp + 0x50]
mov ebx, dword [edx + 0x38]
mov ebp, dword [edx + 0x50]
mov esi, dword [edx + 0x54]
mov edi, dword [edx + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
call fcn.00534fc0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x24]
movzx edx, byte [ecx + 0x5d]
test dl, dl
je 0x544ac8
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
add esp, 0x4c
ret
mov ecx, dword [ecx + 0x80]
test ecx, ecx
je 0x544ab4
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x44]
mov ebx, dword [eax + 0x48]
mov ebp, dword [eax + 0x4c]
mov esi, dword [eax + 0x40]
mov eax, dword [eax + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
lea ecx, [0x685b8d]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
call fcn.005580c0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov dword [ebx + 0x74], ecx
mov dword [ebx + 0x78], edx
mov ecx, dword [0x8a6100]
test ecx, ecx
jne 0x544b3e
mov dword [ebx + 0x70], eax
jmp 0x544ab4
lea edi, [ebx + 0x70]
call fcn.0044d090
jmp 0x544ab4
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
add esp, 0x4c
ret
call fcn.0044b940
jmp fcn.00544980
Function at 0x559790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x559968
sub esp, 0x40
lea eax, [0x640f20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
lea ebx, [edx + ecx]
mov dword [esp + 0x30], ebx
mov dword [esp + 8], ebx
call fcn.00438de0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x30]
cmp ecx, edx
ja 0x559935
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
mov dword [esp], eax
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
call fcn.0044d890
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp eax, ecx
ja 0x559902
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x5c]
add eax, edx
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
call fcn.0044d890
lea eax, [0x640f20]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.00438de0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
nop
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.005596b0
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], ecx
mov ecx, dword [str.master_secret]
mov ebx, dword [0x88fab4]
mov ebp, dword [0x88fab8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edx]
call ecx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
lea edx, [0x640f20]
mov dword [esp], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.00438ea0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
jmp 0x559816
lea ebx, [0x640f20]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.00438ea0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x5c]
jmp 0x5597e6
call fcn.0044b940
jmp fcn.00559790
Function at 0x5ec430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ec62e
sub esp, 0x64
movzx eax, byte [esp + 0x7c]
mov byte [0x8a5e3a], al
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x70]
mov dword [esp + 8], edx
call fcn.005e95b0
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 8], edx
call fcn.005e9260
mov eax, dword [esp + 0x68]
mov dword [esp], eax
movzx ecx, byte [0x8a5e3a]
mov byte [esp + 4], cl
mov ecx, dword [esp + 0x74]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x70]
mov dword [esp + 0x14], ebx
call fcn.005e9960
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x68]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.005e9480
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x5ec5d8
nop
lea edi, [esp + 0x48]
xor eax, eax
call fcn.0044d189
lea edi, [esp + 0x48]
call fcn.0044d189
mov dword [esp + 0x48], 0x927c0
mov dword [esp + 0x4c], 2
mov ecx, dword [esp + 0x74]
mov dword [esp], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
call fcn.005f1c20
mov ecx, dword [esp + 8]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x48]
mov dword [esp], ecx
call fcn.005f47d0
mov ecx, dword [esp + 4]
nop
mov edx, dword [ecx + 8]
mov dword [esp + 0x28], edx
mov ebx, dword [ecx + 4]
mov dword [esp + 0x38], ebx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x2c], ecx
lea ebp, [0x64a020]
mov dword [esp], ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x3c]
mov dword [esp + 8], ebp
call fcn.00407610
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
call fcn.005f3150
movzx ecx, byte [esp + 0x14]
test cl, cl
je 0x5ec5cc
mov byte [esp + 0x84], 1
add esp, 0x64
ret
mov byte [esp + 0x84], 0
add esp, 0x64
ret
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
lea eax, [0x640d20]
mov dword [esp + 0x40], eax
lea eax, [0x6e2368]
mov dword [esp + 0x44], eax
mov eax, dword [0x894484]
mov dword [esp], eax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.004a6fa0
mov byte [esp + 0x84], 0
add esp, 0x64
ret
call fcn.0044b940
jmp fcn.005ec430
Function at 0x5ec640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ec854
sub esp, 0x64
movzx eax, byte [esp + 0x7c]
mov byte [0x8a5e3a], al
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x70]
mov dword [esp + 8], edx
call fcn.005e95b0
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 8], edx
call fcn.005e9260
mov eax, dword [esp + 0x68]
mov dword [esp], eax
movzx ecx, byte [0x8a5e3a]
mov byte [esp + 4], cl
mov ecx, dword [esp + 0x74]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x70]
mov dword [esp + 0x14], ebx
call fcn.005e9960
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x68]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.005e9480
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x5ec7fe
nop
lea edi, [esp + 0x48]
xor eax, eax
call fcn.0044d189
lea edi, [esp + 0x48]
call fcn.0044d189
mov dword [esp + 0x48], 0x927c2
mov dword [esp + 0x4c], 2
mov ecx, dword [esp + 0x74]
mov dword [esp], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
call fcn.005f1c20
mov ecx, dword [esp + 8]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x48]
mov dword [esp], ecx
call fcn.005f4c80
mov ecx, dword [esp + 4]
nop
mov edx, dword [ecx + 8]
mov dword [esp + 0x28], edx
mov ebx, dword [ecx + 4]
mov dword [esp + 0x38], ebx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x2c], ecx
lea ebp, [0x64a020]
mov dword [esp], ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x3c]
mov dword [esp + 8], ebp
call fcn.00407610
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
call fcn.005f3150
movzx ecx, byte [esp + 0x14]
test cl, cl
je 0x5ec7f2
mov byte [esp + 0x8c], 1
add esp, 0x64
ret
mov byte [esp + 0x8c], 0
add esp, 0x64
ret
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
lea eax, [0x640d20]
mov dword [esp + 0x40], eax
lea eax, [0x6e2370]
mov dword [esp + 0x44], eax
mov eax, dword [0x894484]
mov dword [esp], eax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.004a6fa0
mov byte [esp + 0x8c], 0
add esp, 0x64
ret
call fcn.0044b940
jmp fcn.005ec640
Function at 0x17d7058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.017d71a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x17d707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17d706a
add dl, dl
jne 0x17d7089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17d70dc
xor eax, eax
add dl, dl
jne 0x17d7096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17d717d
add dl, dl
jne 0x17d70a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17d70b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17d70bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17d70c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x17d70d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x17d7075
mov eax, 1
add dl, dl
jne 0x17d70ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17d70f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17d70e1
sub eax, ebx
mov ebx, 1
jne 0x17d7128
mov ecx, 1
add dl, dl
jne 0x17d710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17d7119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17d7105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17d7075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x17d713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17d714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17d7136
cmp eax, 0x7d00
jae 0x17d716d
cmp eax, 0x500
jb 0x17d7168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17d7075
cmp eax, 0x7f
ja 0x17d7170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17d7075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x17d719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x17d7075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xdcbdde
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xdcbde4
pop ebp
sub ebp, 0x10
sub ebp, 0x9cbdd4
jmp 0xdcbdfa
mov eax, 0x9cbdd4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d2
mov edx, 0x8cc22709
xor byte [eax], dl
inc eax
dec ecx
jne 0xdcbe11
jmp 0xdcbe24
add ah, 0x82
xor byte [0x88090909], 0xc8
int1
or dword [ecx], ecx
or dword [edx], ecx
les esi, [ecx + 0x909090c]
mov bl, 0x21
or dword [ecx], ecx
or esi, edi
jmp 0xdcbe4b
insd dword es:[edi], dx
sub eax, 0x2d0d80f5
test byte [ebp + 0x2d], ch
cmc
or byte [0x2ccd612d], 0x28
or dword [ecx + 0x19], esp
xchg ecx, eax
jb 0xdcbe6b
or byte [0x3bb0612d], ah
jg 0xdcbe81
loope 0xdcbe78
or al, 9
or dword [ecx], ecx
loopne 0xdcbeaa
or dword [ecx], ecx
or eax, esp
cmp dword [ecx], ecx
or dword [ecx], ecx
pop esp
test byte [ebp + 0x2d], ah
or dword [ecx], ecx
or dword [esp + eax*4 + 0x65], ebx
sub eax, 0x18c8209
or dword [ecx], ecx
or dword [edx + 0x909018c], eax
or dword [edx + 0x909059c], eax
or dword [edx + 0x9091984], eax
add eax, 0x82090909
test byte [ecx], bl
or dword [ecx], ecx
or eax, ecx
loopne 0xdcbe99
cmp byte [ebx], cl
mov cl, bl
or eax, 0xfd8c0640
div dh
test byte [edx + 0x6d842d25], 0x2d
or eax, 0x820905cb
test dword [0x909090d], ebp
popal
int 0x2c
sub byte [ecx], cl
popal
sbb dword [ecx + 0x25080972], edx
sub eax, 0xf52d6d84
or dword [ecx - 0x33], esp
sub al, 0x28
or dword [ecx + 0x19], esp
xchg ecx, eax
jb 0xdcbebe
or byte [0x2d6d842d], ah
cmc
add byte [0x90ce12d], 9
sub eax, 0x9090ce1
or eax, esp
inc edx
or ecx, dword [ecx]
or dword [ebp + ebp*2 + 0x2580f52d], eax
sub eax, 0x7cf6e582
add eax, 0xe1017cf6
jno 0xdcbee4
or dword [ecx], ecx
xor byte [ecx + eax - 0x77f6f6f7], 0xf8
clc
scasb al, byte es:[edi]
push es
nop
push esi
mov al, bh
clc
scasb al, byte es:[edi]
push es
nop
push esi
cmp al, al
cmp bl, bl
mov ah, cl
or al, 0x41
push es
lea eax, [edi + 9]
or dword [ecx], ecx
push es
add dword [ecx + 9], 0x826f0909
adc eax, 0xe1f28930
push es
lea edx, [ebx]
or dword [ecx], ecx
or dword [ecx - 0x72f91f0e], ecx
sbb byte [ecx], cl
or dword [ecx], ecx
outsd dx, dword [esi]
mov dl, dh
imul byte [esi + eax]
lea ebx, [ecx + ecx]
or dword [ecx], ecx
dec eax
loopne 0xdcbeec
div dh
mul byte [eax]
inc ebp
xor byte [eax], cl
mov cl, al
or al, 0x8a
loope 0xdcbf41
loopne 0xdcbeea
div dh
mul byte [eax]
pop ebp
xor byte [ebx], cl
mov cl, al
jp 0xe266cd28
jecxz 0xdcbf50
mov ah, cl
or al, 0xe0
mov byte [0x82f6f6f6], al
and eax, 0x2d6d842d
or eax, 0x5c0905cb
sub eax, 0x905cb0d
pop esp
and ch, 0x5f
pop esi
pop esp
cmp byte [ebp + eax - 0x7e], 0x74
add ebp, esi
mov ebx, 0x880f8389
iretd

Function at 0x40892e
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ecx
push esi
pop esi
mov esi, ebx
call fcn.0040895b
sub esi, 0xf3f02c72
add esi, esi
xor dword [edi], ecx
sub esp, 4
mov dword [esp], esi
pop esi
sub esi, esi
add edi, 1
cmp edi, eax
jne fcn.0040892e
ret