joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x74ff3e96
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x77c1359
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x404330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f6410
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x90df34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.004042f0
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.004056a0
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x407d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x90df34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x407de3
cmp byte [esi + 0x3d], 0
je 0x407de3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x407d99
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x407dab
sub eax, 1
je 0x407daf
sub eax, 2
je 0x407de3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059a3cf
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x407dcc
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.006ae15e
add esp, 0x10
cmp edi, eax
jne 0x407d99
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059a3cf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0059a3cf
mov esp, ebp
pop ebp
ret
Function at 0x408b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push ebx
mov dword [ebp - 0x10], eax
push esi
mov eax, dword [eax]
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
add eax, 8
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
lea esi, [eax + 1]
push esi
call fcn.00468e8d
push esi
mov esi, eax
mov dword [ebp + 8], eax
push 0
push esi
call fcn.006a4bc0
mov eax, dword [edi + 0x10]
add esp, 0x10
cmp dword [edi + 0x14], 0x10
jb 0x408bdc
mov edi, dword [edi]
push eax
push edi
push esi
call fcn.006a4640
xor edi, edi
add esp, 0xc
cmp dword [ebp - 0xc], edi
jle 0x408c38
nop
mov eax, dword [ebp - 4]
inc bl
mov esi, dword [ebp - 4]
movzx ebx, bl
mov ecx, dword [eax + ebx*4]
mov eax, dword [ebp - 8]
add eax, ecx
movzx edx, al
mov eax, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [eax + edx*4]
mov dword [esi + ebx*4], eax
mov dword [esi + edx*4], ecx
add cl, al
movzx eax, cl
mov ecx, esi
mov esi, dword [ebp + 8]
movzx eax, byte [ecx + eax*4]
xor byte [edi + esi], al
mov al, byte [edi + esi]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00404e80
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x408bf0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
push esi
mov eax, dword [ecx]
mov dword [eax], ebx
mov eax, dword [ecx]
mov dword [eax + 4], edx
call fcn.00468e88
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x411160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41116b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x411227
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
sub edi, 1
jne 0x411180
pop edi
test esi, esi
je 0x41124a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
sub esi, 1
jne 0x411230
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x412840
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x4129fc
cmp dword [edi + 0x18], 0
je 0x4129fc
cmp dword [edi + 0x7c], 0
je 0x412869
call fcn.00412cf0
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.004125d0
add esp, 8
test eax, eax
je 0x41288d
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.006ae1b6
mov esi, eax
add esp, 4
test esi, esi
je 0x4128d0
push 0x4000
call fcn.006ae1b6
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x4128dc
push esi
call fcn.006adc99
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x412937
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.004114a0
test eax, eax
jne 0x412937
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x41295a
mov al, byte [edi + 0x39]
jmp 0x41295d
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x4129dd
nop dword [eax]
mov al, byte [ebx]
test al, al
je 0x4129dd
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x8d0330]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8d0330]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x412990
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f7696
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x90df34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xb8]
mov dword [ebp - 0x144], eax
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], 0
xor esi, esi
movups xmm0, xmmword [0x8d2aa0]
mov cx, word [0x8d2ab0]
mov word [ebp - 0x24], cx
movups xmmword [ebp - 0x34], xmm0
mov eax, 0x8d3dcb09
mov ecx, esi
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x3a
sub ecx, eax
add ecx, 0x33
xor word [ebp + esi*2 - 0x34], cx
inc esi
cmp esi, 9
jl 0x41d071
mov ecx, dword [ebp - 0x148]
lea eax, [ebp - 0x34]
push eax
call fcn.005ba1a5
lea ecx, [ebp - 0xb8]
mov byte [ebp - 0x13d], al
mov dword [ebp - 4], 0xffffffff
call fcn.005ba0df
cmp byte [ebp - 0x13d], 0
je 0x41d156
lea ecx, [edi + 0x7f0]
call fcn.00452310
test eax, eax
je 0x41d20b
mov eax, dword [0x1808d24]
cmp dword [eax + 0x5ec], 4
jne 0x41d100
push 1
lea ecx, [edi + 0x7f0]
call fcn.004526f0
mov eax, dword [0x1808d24]
mov ecx, dword [eax + 0x84c]
cmp ecx, 1
jne 0x41d11c
push 0x2bc
mov ecx, edi
call fcn.005c046b
jmp 0x41d20b
cmp ecx, 2
mov ecx, edi
jne 0x41d132
push 0x320
call fcn.005c046b
jmp 0x41d20b
cmp dword [eax + 0x5ec], 4
jne 0x41d147
push 0x64
call fcn.005c046b
jmp 0x41d20b
push 0x384
call fcn.005c046b
jmp 0x41d20b
mov ecx, dword [ebp - 0x144]
lea edx, [ebp - 0x13c]
push edx
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 4], 1
xor esi, esi
mov ecx, dword [0x8d2a98]
movq xmm0, qword [0x8d2a90]
mov dword [ebp - 0x18], ecx
mov cx, word [0x8d2a9c]
movq qword [ebp - 0x20], xmm0
mov word [ebp - 0x14], cx
mov eax, 0x8d3dcb09
mov ecx, esi
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x3a
sub ecx, eax
add ecx, 0x33
xor word [ebp + esi*2 - 0x20], cx
inc esi
cmp esi, 7
jl 0x41d1a0
mov ecx, dword [ebp - 0x144]
lea eax, [ebp - 0x20]
push eax
call fcn.005ba1a5
lea ecx, [ebp - 0x13c]
mov byte [ebp - 0x13d], al
mov dword [ebp - 4], 0xffffffff
call fcn.005ba0df
cmp byte [ebp - 0x13d], 0
je 0x41d20b
push 0
push 0xf020
push 0x112
mov ecx, edi
call fcn.005c074b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059a3cf
mov esp, ebp
pop ebp
ret 4
Function at 0x421c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x90df34]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [0x8d331c]
mov eax, dword [0x8d3334]
xor ecx, ecx
cmp dword [0x18021f4], 2
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0xc], eax
movq xmm0, qword [0x8d332c]
mov ax, word [0x8d3338]
movq qword [ebp - 0x14], xmm0
mov word [ebp - 8], ax
jl 0x421d83
movaps xmm2, xmmword [0x8d6c60]
mov eax, 5
movaps xmm4, xmmword [0x8d6d00]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm5
mov eax, 0x1f
movaps xmm0, xmm1
movd xmm6, eax
mov eax, 0x8d331c
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x8d6c90]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x8d6c70]
paddd xmm2, xmmword [0x8d6c60]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
paddw xmm1, xmmword [0x8d6cb0]
movq xmm0, qword [eax]
pxor xmm1, xmm0
movaps xmm0, xmm2
movq qword [ebp - 0x24], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x8d6c90]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, qword [ebp - 0x1c]
paddw xmm1, xmmword [0x8d6cb0]
pxor xmm1, xmm0
movq qword [ebp - 0x1c], xmm1
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul eax, eax, 0x3a
sub edx, eax
add edx, 0x33
xor word [ebp + ecx*2 - 0x24], dx
inc ecx
cmp ecx, 0xf
jl 0x421d83
cmp dword [0x1808e5c], 8
lea eax, [ebp - 0x24]
mov edx, 0x1808e48
mov ecx, 0x80000001
cmovae edx, dword [0x1808e48]
push 0x17f59a0
push eax
call fcn.00414c90
mov ecx, dword [ebp - 4]
xor eax, eax
add esp, 8
cmp dword [0x17f59b0], eax
setne al
xor ecx, ebp
call fcn.0059a3cf
mov esp, ebp
pop ebp
ret
Function at 0x425350
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.0041b670
push 0
push 0
push esi
push 0x422e60
push 0
push 0
call fcn.006b34d4
add esp, 0x18
pop esi
ret

Function at 0x42ca30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
cmp edi, 5
jne 0x42ca79
cmp dword [ebx + 0x84], 0x10
push esi
lea esi, [ebx + 0x70]
mov eax, esi
jb 0x42ca50
mov eax, dword [esi]
push eax
call dword [0x8116c8]
test eax, eax
jne 0x42ca78
cmp dword [esi + 0x14], 0x10
jb 0x42ca63
mov esi, dword [esi]
cmp dword [ebx + 0x6c], 0x10
lea eax, [ebx + 0x58]
jb 0x42ca6e
mov eax, dword [eax]
push esi
push eax
call fcn.006b37eb
add esp, 8
pop esi
mov eax, dword [0x1808d20]
mov dword [ebx + 0x18], edi
test eax, eax
je 0x42cad4
cmp edi, 5
jne 0x42caa6
push 0x1808d1c
push 0x81f7
push 0x81f4
push eax
call dword [0x811a50]
pop edi
pop ebx
pop ebp
ret 8
push 4
call fcn.00468e50
add esp, 4
test eax, eax
je 0x42cabb
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x42cabd
xor eax, eax
push eax
push 0x81f8
push 0x81f4
push dword [0x1808d20]
call dword [0x811a50]
pop edi
pop ebx
pop ebp
ret 8
Function at 0x42f140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x90df34]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x8d5216], 0
movups xmm0, xmmword [0x8d5204]
mov eax, dword [0x8d5214]
push edi
mov edi, dword [ecx + 0x858]
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], eax
je 0x42f1a0
push esi
xor esi, esi
mov eax, 0x8d3dcb09
mov ecx, esi
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x3a
sub ecx, eax
add ecx, 0x33
xor word [ebp + esi*2 - 0x18], cx
inc esi
cmp esi, 0xa
jl 0x42f177
pop esi
cmp dword [0x1808e74], 8
lea ecx, [ebp - 0x1c]
push 4
push ecx
push 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], edi
mov eax, 0x1808e60
cmovae eax, dword [0x1808e60]
push ecx
push eax
push 0x80000001
call dword [0x8116b0]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop edi
call fcn.0059a3cf
mov esp, ebp
pop ebp
ret
Function at 0x442510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x90df34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x8d4354]
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov ax, word [0x8d4358]
mov word [ebp - 8], ax
mov al, byte [0x8d435a]
mov byte [ebp - 6], al
nop dword [eax]
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x3a
sub dl, al
add dl, 0x33
xor byte [ebp + ecx - 0xc], dl
inc ecx
cmp ecx, 7
jl 0x442540
push 0xf
lea eax, [ebp - 0xc]
push eax
call fcn.00444d90
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0059a3cf
mov esp, ebp
pop ebp
ret
Function at 0x5d1ce9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x5d1d17
cmp eax, edi
jge 0x5d1d0b
push esi
call fcn.005cd35b
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x5d1d3a
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x5d1d20
mov dword [esi + 8], edx
jmp 0x5d1d4f
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x5d1d45
xor dl, dl
jmp 0x5d1d4a
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x5d1d3a
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x5d1d87
push str.zlib_corrupt
call fcn.005cd280
pop ecx
jmp 0x5d1dc7
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x5d1d97
push str.read_past_buffer
jmp 0x5d1d7f
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x5d1db1
push edi
push ecx
push esi
call fcn.005d4fba
add esp, 0xc
test eax, eax
je 0x5d1dc7
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.006a4640
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x603649
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x1802bfb], 0
jne 0x6036f8
push esi
push 0x84ac80
call fcn.0060db5b
mov dword [esp], 0x84aafc
call fcn.0060db5b
mov dword [esp], 0x84ad78
call fcn.0060db5b
mov dword [esp], 0x84ad9c
call fcn.0060db5b
mov dword [esp], 0x84aca4
call fcn.0060db5b
mov esi, 0x84ab60
push esi
call fcn.00617cfd
push esi
call fcn.00617cfd
push 0x84ab80
call fcn.00617cfd
push 0x84aba0
call fcn.00617cfd
push 0x84acc8
call fcn.00617cfd
push 0x84ab20
call fcn.00617cfd
push 0x84ab40
call fcn.00617cfd
push 0x84ad20
call fcn.00617cfd
push 0x84ad40
call fcn.00617cfd
add esp, 0x28
mov byte [0x1802bfb], 1
pop esi
jmp 0x62004d
ret
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x620055
mov dword [edx*4 + 0x1809140], ecx
inc edx
cmp edx, 0x100
jb 0x620050
mov esi, 0x800
jmp 0x62009d
mov ecx, dword [edx*4 + 0x1808d40]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x1809140]
mov dword [edx*4 + 0x1809140], ecx
inc edx
cmp edx, esi
jb 0x620081
mov eax, 0x7f62c0
mov esi, 0x7f61e0
mov dword [0x1809124], eax
mov dword [0x180911c], eax
mov dword [0x1809120], esi
call fcn.00637a59
mov ecx, dword [0x180911c]
test eax, eax
cmove ecx, esi
mov dword [0x180911c], ecx
pop esi
ret
Function at 0x613986
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7fbc60
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x90df34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x30]
mov dword [esi], 0x84c1f0
push 0x90e074
push eax
mov dword [esi + 4], 0x84c208
mov dword [esi + 8], 0x84c21c
mov dword [esi + 0xc], 0x84c230
mov dword [esi + 0x10], 0x84c248
mov dword [esi + 0x14], 0x84c260
mov dword [esi + 0x18], 0x84c274
call fcn.00630f42
push dword [esi + 0x24]
call fcn.00468e88
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x613a05
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x61a8cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
and dword [edi + 0x2cb0], 0
cmp dword [edi + 0x2cb8], 2
jne 0x61a915
push 1
lea ecx, [edi + 0x38]
call fcn.0061a849
test eax, eax
je 0x61a90e
push dword [edi + 0x80]
mov ecx, edi
push dword [edi + 0x7c]
call fcn.0061a0bc
jmp 0x61aad3
and dword [edi + 0x2cb8], 0
mov edx, dword [edi + 0x38]
mov eax, dword [edi + 0x3c]
push ebx
push 8
pop ecx
sub ecx, edx
mov dword [ebp - 0x10], edx
shr eax, cl
shr eax, 0x10
cmp dword [edi + 0x2ca0], 0x25
movzx eax, al
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x2cac]
jae 0x61a951
test eax, eax
mov ebx, 0x84c628
mov ecx, 0x84c618
mov eax, 0x84c658
jmp 0x61a962
test eax, eax
mov ebx, 0x84c648
mov ecx, 0x84c638
mov eax, 0x84c694
cmove ebx, ecx
mov dword [ebp - 4], eax
mov eax, dword [eax]
mov edx, 0xff
xor eax, dword [ebp - 8]
push esi
mov cl, byte [ebx]
xor esi, esi
sar edx, cl
not edx
test eax, edx
je 0x61a99c
mov edi, dword [ebp - 4]
inc esi
mov edx, 0xff
mov cl, byte [esi + ebx]
mov eax, dword [edi + esi*4]
xor eax, dword [ebp - 8]
sar edx, cl
not edx
test eax, edx
jne 0x61a982
mov edi, dword [ebp - 0xc]
movzx eax, byte [esi + ebx]
lea ebx, [edi + 0x38]
add eax, dword [ebp - 0x10]
mov ecx, ebx
mov dword [ebx], eax
call fcn.0061a7be
cmp esi, 9
jb 0x61aa52
jne 0x61a9ce
push dword [edi + 0x80]
inc dword [edi + 0x2cb8]
push dword [edi + 0x7c]
jmp 0x61aaca
and dword [edi + 0x2cb8], 0
mov ecx, edi
cmp esi, 0xe
jne 0x61aa01
push 0x84c4d4
call fcn.0061a154
push 0xf
mov ecx, ebx
lea esi, [eax + 5]
call fcn.0061a849
add eax, 0x7fff
push esi
mov dword [edi + 0x7c], eax
push eax
jmp 0x61aac4
mov eax, dword [edi + 0x78]
sub eax, esi
inc eax
and eax, 3
push 0x84c49c
mov ebx, dword [edi + eax*4 + 0x68]
call fcn.0061a154
add eax, 2
cmp eax, 0x101
jne 0x61aa35
cmp esi, 0xa
jne 0x61aa35
xor dword [edi + 0x2cac], 1
xor eax, eax
jmp 0x61aad1
cmp ebx, 0x100
lea ecx, [eax + 1]
cmovb ecx, eax
mov eax, dword [edi + 0x2cc8]
dec eax
cmp ebx, eax
lea esi, [ecx + 1]
cmovb esi, ecx
jmp 0x61aaae
mov ecx, dword [edi + 0x2ca0]
and dword [edi + 0x2cb8], 0
add ecx, esi
mov eax, ecx
shr eax, 4
sub ecx, eax
mov dword [edi + 0x2ca0], ecx
mov ecx, edi
push 0x84c57c
call fcn.0061a154
movzx ecx, al
mov ebx, dword [edi + ecx*4 + 0x494]
test al, al
je 0x61aaab
dec dword [edi + ebx*4 + 0x1494]
mov eax, dword [edi + ecx*4 + 0x490]
inc dword [edi + eax*4 + 0x1494]
mov dword [edi + ecx*4 + 0x494], eax
mov dword [edi + ecx*4 + 0x490], ebx
add esi, 2
mov eax, dword [edi + 0x78]
push esi
push ebx
mov dword [edi + eax*4 + 0x68], ebx
mov eax, dword [edi + 0x78]
inc eax
mov dword [edi + 0x7c], ebx
and eax, 3
mov dword [edi + 0x78], eax
mov dword [edi + 0x80], esi
mov ecx, edi
call fcn.0061a0bc
pop esi
pop ebx
pop edi
leave
ret