joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dbb80
Capabilities:
Encode data using xor
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x7ad930]
xor eax, esp
mov dword [esp + 0x6c], eax
mov ecx, dword [0x7b8c80]
push ebx
mov bl, byte [0x7b8c84]
push esi
mov esi, dword [ebp + 8]
xor edx, edx
jmp 0x4dbbb0
xor bl, byte [esp + edx + 0x64]
lea eax, [ecx + 1]
xor byte [ecx + 0x7b8c88], bl
xor bl, byte [esp + edx + 0x65]
and eax, 0xfff
inc eax
xor byte [eax + 0x7b8c87], bl
xor bl, byte [esp + edx + 0x66]
and eax, 0xfff
inc eax
xor byte [eax + 0x7b8c87], bl
xor bl, byte [esp + edx + 0x67]
and eax, 0xfff
add edx, 4
xor byte [eax + 0x7b8c88], bl
lea ecx, [eax + 1]
and ecx, 0xfff
cmp edx, 0x10
jl 0x4dbbb0
movzx eax, byte [esp + 0x64]
and eax, 1
add eax, ecx
and eax, 0xfff
xor bl, al
xor byte [eax + 0x7b8c88], bl
inc eax
and eax, 0xfff
xor bl, ah
xor byte [eax + 0x7b8c88], bl
inc eax
and eax, 0xfff
mov dword [0x7b8c80], eax
xor bl, byte [0x7b8c82]
lea ecx, [eax + 1]
xor byte [eax + 0x7b8c88], bl
and ecx, 0xfff
mov dword [0x7b8c80], ecx
xor bl, byte [0x7b8c83]
inc ecx
xor byte [ecx + 0x7b8c87], bl
and ecx, 0xfff
movzx eax, cl
and eax, 1
add eax, ecx
and eax, 0xfff
push 0x1000
mov edx, 0x7b8c88
lea ecx, [esp + 0xc]
mov dword [0x7b8c80], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.004db7a0
add esp, 4
lea edx, [esp + 0x64]
lea ecx, [esp + 8]
call fcn.004db870
movq xmm0, qword [esp + 0x64]
movq qword [esi], xmm0
movq xmm0, qword [esp + 0x6c]
movq qword [esi + 8], xmm0
mov ecx, dword [0x7b8c80]
xor edx, edx
lea ecx, [ecx]
xor bl, byte [esp + edx + 0x64]
lea eax, [ecx + 1]
xor byte [ecx + 0x7b8c88], bl
xor bl, byte [esp + edx + 0x65]
and eax, 0xfff
inc eax
xor byte [eax + 0x7b8c87], bl
xor bl, byte [esp + edx + 0x66]
and eax, 0xfff
inc eax
xor byte [eax + 0x7b8c87], bl
xor bl, byte [esp + edx + 0x67]
and eax, 0xfff
add edx, 4
xor byte [eax + 0x7b8c88], bl
lea ecx, [eax + 1]
and ecx, 0xfff
cmp edx, 0x10
jl 0x4dbce0
movzx eax, byte [esp + 0x64]
and eax, 1
add eax, ecx
mov ecx, dword [esp + 0x74]
pop esi
mov byte [0x7b8c84], bl
and eax, 0xfff
pop ebx
xor ecx, esp
mov dword [0x7b8c80], eax
call fcn.00635147
mov esp, ebp
pop ebp
ret
Function at 0x4df090
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69ad68
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7ad930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 4
push esi
push 0x4df180
push 0
push 0
mov dword [esi], 0x776db4
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [eax], 0
mov byte [esi + 0x10], 1
call fcn.0063a808
add esp, 0x18
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x4df128
call fcn.004d6ad0
mov esi, eax
push 0x74d134
mov ecx, esi
call fcn.004180b0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [0x7c7274]
mov ecx, dword [0x7c7270]
test eax, eax
cmovne ecx, eax
push 0x25
lea edx, [ebp - 0x10]
call fcn.0044ebd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4e21d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ab66e
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x7ad930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0x774668
mov dword [ebp - 4], 0
lea eax, [ecx + 4]
mov dword [ebp - 0x14], eax
mov dword [eax], 0x7774a4
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov byte [ebp - 4], 1
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 2
mov dword [ecx], 0x777000
mov dword [eax], 0x776f8c
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5093a0
Capabilities:
Encode data using xor

Disassembly:
cli
inc esi
cdq
jl 0x5093d3
adc dword [0xa164d2c4], ebx
nop
mov esp, 0xcd911ab
pushal
dec ecx
sub al, 0x2f
ficom word [ebp + 0x2fd585b9]
ja 0x5093b7
mov al, 0x30
pushal
je 0x50938d
push ecx
enter 0xffffffffffffbc4e, 0x25
jo 0x509419
sar byte [ebx - 0x2261b9ef], cl
invalid
aas
pop ebx
mov ah, 0x34
mov cl, 0xb6
test dword [ebp + 0x14], 0xa192bb49
fmul qword [ecx + 0x676baaca]
xchg ebx, eax
mov dword [esi + 0xd], ebp
stosd dword es:[edi], eax
push cs
mov cs, word [ebx]
clc
jge 0x509461
ja 0x509462
mov ebx, dword [edx - 0x42]
xchg esi, eax
push esp
out dx, al
out 0xc6, eax
xchg ecx, eax
sub esi, dword [edi*2 + 0xa735a]
and byte [eax - 0x146225d8], cl
mov dl, 0xfd
dec edi
sub al, 0xf3

Function at 0x50b160
Capabilities:
Encode data using xor

Disassembly:
das
cmp esp, dword [ebx - 0x6d]
insd dword es:[edi], dx
fadd st(3)
test al, 0xc6
xchg ecx, eax
test al, 0x40
lcall 0xd379, 0x5cb0d8c4
jne 0x50b1cc
sub edi, 0xe3dd0ba3
push edx
cmp dword [esp + ebx*8 - 0x19], ecx
and al, 0xa8
cmp al, 0x84
mov ebx, 0xdbb117e0
adc ebp, esp
xor byte [eax - 0x2c747eff], ah
sti
push ds
invalid
adc al, 0x3e
pop edx
lahf
invalid

Function at 0x520b50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b00f1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7ad930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0x777238
mov dword [ecx], 0x7773dc
mov dword [ecx + 4], 0x7773c8
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x54], 0
mov byte [ecx + 0x64], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
mov dword [ecx + 8], 1
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 1
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x30], 0
mov byte [ecx + 0x38], 0
mov dword [ecx + 0x78], 0
mov word [ecx + 0x68], 0x100
mov dword [ecx + 0x6c], 0xffffffff
mov dword [ecx + 0x70], 0xffffffff
mov byte [ecx + 0x75], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x566ce0
Capabilities:
Encode data using xor

Disassembly:
in al, 0
cmp al, 8
and dword [ebx], esi
lock and dh, byte [ebx + 0x2538455]
Function at 0x585200
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0xca
jne 0x585251
mov eax, dword [esi + 4]
push 0x1c
mov eax, dword [eax]
push 1
push esi
call eax
mov dword [esi + 0x180], eax
add esp, 0xc
mov ecx, esi
mov dword [eax], 0x5886c0
mov dword [eax + 4], 0x588820
mov byte [eax + 8], 0
call fcn.005884d0
cmp byte [esi + 0x40], 0
je 0x58524a
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x5852d1
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x5852bf
mov eax, dword [esi + 8]
test eax, eax
je 0x585277
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x5852ba
cmp eax, 2
je 0x5852bf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x585268
cmp eax, 3
je 0x58529f
cmp eax, 1
jne 0x585268
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x585268
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x585268
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
pop edi
mov dword [esi + 0x84], eax
mov ecx, esi
pop esi
jmp 0x585300
cmp eax, 0xcc
je 0x5852f3
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
pop edi
mov ecx, esi
pop esi
jmp 0x585300
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0xcc
je 0x58532a
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x5853b2
lea ebx, [esi + 0x78]
lea esp, [esp]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x585386
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x585365
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x184]
mov edi, dword [ebx]
mov eax, dword [eax + 4]
push 0
push ebx
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x5853c8
cmp eax, dword [esi + 0x60]
jb 0x585347
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
mov eax, dword [esi + 0x180]
add esp, 8
cmp byte [eax + 8], 0
jne 0x585340
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
pop esi
mov al, 1
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x5a0270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x7ad930]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
movzx ecx, word [edi + 0x4a]
test ecx, 0x8000
jne 0x5a02ca
mov ebx, dword [ebp + 8]
cmp ebx, 3
ja 0x5a03f4
test cl, 4
je 0x5a02b9
movzx eax, word [edi + 0x48]
cmp eax, ebx
je 0x5a02b9
push str.inconsistent_rendering_intents
jmp 0x5a03f9
test cl, 0x20
je 0x5a02dd
mov edx, str.duplicate_sRGB_information_ignored
mov ecx, esi
call fcn.005a2080
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00635147
mov esp, ebp
pop ebp
ret
test cl, 2
je 0x5a0334
push 0x64
lea edx, [edi + 4]
mov ecx, 0x757860
call fcn.0059fc50
add esp, 4
test eax, eax
jne 0x5a0334
test dword [esi + 0x74], 0x8000
mov ecx, esi
je 0x5a03e0
test dword [esi + 0x78], 0x100000
je 0x5a041a
push str.cHRM_chunk_does_not_match_sRGB
lea edx, [ebp - 0xe0]
call fcn.005a20c0
add esp, 4
lea edx, [ebp - 0xe0]
mov ecx, esi
call fcn.005a1ea0
push 2
push 0xb18f
mov edx, edi
mov ecx, esi
call fcn.0059f3c0
movq xmm0, qword [0x757860]
mov eax, dword [0x7578a0]
movq qword [edi + 4], xmm0
movq xmm0, qword [0x757868]
movq qword [edi + 0xc], xmm0
movq xmm0, qword [0x757870]
movq qword [edi + 0x14], xmm0
movq xmm0, qword [0x757878]
movq qword [edi + 0x1c], xmm0
movq xmm0, qword [0x757880]
movq qword [edi + 0x24], xmm0
movq xmm0, qword [0x757888]
movq qword [edi + 0x2c], xmm0
movq xmm0, qword [0x757890]
movq qword [edi + 0x34], xmm0
movq xmm0, qword [0x757898]
movq qword [edi + 0x3c], xmm0
mov dword [edi + 0x44], eax
mov eax, 0xe7
add esp, 8
or word [edi + 0x4a], ax
mov word [edi + 0x48], bx
mov dword [edi], 0xb18f
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00635147
mov esp, ebp
pop ebp
ret
test dword [esi + 0x78], 0x400000
mov edx, str.cHRM_chunk_does_not_match_sRGB
jne 0x5a032f
jmp 0x5a0424
push str.invalid_sRGB_rendering_intent
push ebx
push str.sRGB
mov ecx, esi
call fcn.005a0080
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00635147
mov esp, ebp
pop ebp
ret
mov edx, str.cHRM_chunk_does_not_match_sRGB
call fcn.005a21d0
call fcn.005a1d10
int3

Function at 0x5b6ab0
Capabilities:
Encode data using xor

Disassembly:
sbb esp, ebp
ror byte [ebx - 0x6e], cl
cdq
sbb byte [ebp + 0x20fe4bdb], ch
pushal
fiadd word [edi + 0x26]
insb byte es:[edi], dx
test dword [eax], esp
std
mov dh, 0xd5
dec ebp
mov byte [edi], cl
out dx, eax
mov al, byte [0xedd5e6ef]
Function at 0x5be620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x5be645
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x5be65d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x5be68c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x5be6ce
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x5be7a2
sub edx, 0x10000
js 0x5be7a2
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x5be6b4
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x5be6b4
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x5be725
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x5be722
add edx, 8
jne 0x5be709
jmp 0x5be793
add edx, 4
test eax, 0xffff
jne 0x5be732
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x5be793
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x5be766
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x5be6b4
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x5be7a2
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x5be6b4
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x5be7b3
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5cd360
Capabilities:
Encode data using xor

Disassembly:
pop eax
mul dword [0xa4d50d6c]
pop edi
xlatb
dec ebp
invalid
jno 0x5cd32f
out dx, eax
inc esi
pop ebp
out 0xf7, al
adc eax, 0x27a91d29
scasd eax, dword es:[edi]
das
sub dword [0x2faf27a9], ebx
adc esi, dword [esi - 9]
xchg byte [edx], bl
pop eax
iretd
fiadd dword [ebp + eax*8 + 6]
dec edx
mov edi, 0x493a938f
mov bl, 0x5c
cmp edi, ebx
mov dword [esi - 0x4a], ebx
cmc
mov edx, 0x93ac7c6e
lodsb al, byte [esi]
inc esi
out dx, al
loop 0x5cd34e
jge 0x5cd3ef
sub eax, dword [esi - 0x3c]
idiv ebp
or al, 0xd6
xchg esp, eax
pop ss
push edx
sbb byte [edx + 0x1d], dl
pop ecx
xchg esp, eax
jl 0x5cd346
stc
les edi, [edi + 0xe]
cmc
xchg byte [eax + 0x6c8a6171], dh
mov bl, 0xb5
mov esp, dword [ebp + 0xfaa19f4]
mov edx, 0x34a52751
invalid
mov ch, 0x9b
or dl, bl
adc dword [ebx], esp
out dx, eax
leave
in eax, 0x89
fadd st(6), st(0)
push cs
pushal
pop esi
pop ss
and al, 0x17
xor byte [eax], dl
pop esp
popfd
sub eax, 0x1a2a3056
jne 0x5cd402
adc byte [ebp + ebx*4 + 0x2d], bl
push esi
xor byte [edx], ch
sbb ch, byte [esi]
jne 0x5cd402
dec esi
or byte [ebp + edx + 0x34a559ef], bh
lea edx, [edx - 0x7c01b857]
in eax, 0x85
popal
not byte [edx + 0x68259fab]
add al, bh
invalid
Function at 0x5f8100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
movzx edx, word [eax]
mov ebx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
cmp ebx, eax
jb 0x5f8123
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebp + 0x14]
sub eax, ebx
cmp edi, eax
cmova edi, eax
xor esi, esi
mov dword [ebp + 0x14], edi
test edi, edi
je 0x5f8170
mov esi, dword [ebp + 0x10]
sub ebx, esi
lea ecx, [ecx]
movzx eax, byte [ebx + esi]
mov ecx, edx
shr ecx, 8
xor ecx, eax
add eax, edx
imul eax, eax, 0x3193
mov edx, 0x58bf
sub edx, eax
and edx, 0xffff
mov byte [esi], cl
lea esi, [esi + 1]
dec edi
jne 0x5f8140
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp - 4]
mov esi, edi
mov eax, dword [ebp + 8]
lea ecx, [ebx + edi]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
pop edi
mov word [eax], dx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x635e5a
Capabilities:
Encode data using xor

Disassembly:
inc ebp
test eax, 0x395f6db2
neg dword [eax + 0x609c7a1f]
sti
add al, 0xf5
push ebp
or byte [0x56ac87cd], 0xe5
pop esp
and ebx, dword [esi]
call 0x49194722
adc eax, 0xe74abdf2
neg dword [edx + 0x59]
cli
rol byte [esi + 0x6e], cl

Function at 0x63af03
Capabilities:
Parse pe header

Disassembly:
call int.0064d2f6
jmp 0x63af0d
push 0x14
push 0x788f48
call fcn.00642f50
call fcn.00640a99
movzx esi, ax
push 2
call int.0064d2a9
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x63af3b
xor ebx, ebx
jmp 0x63af6e
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x63af37
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x63af37
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x63af6e
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.00635d3a
test eax, eax
jne 0x63af82
push 0x1c
call fcn.0063b05d
pop ecx
call int.00646c41
test eax, eax
jne 0x63af93
push 0x10
call fcn.0063b05d
pop ecx
call fcn.006447a3
and dword [ebp - 4], 0
call fcn.006483d7
test eax, eax
jns 0x63afad
push 0x1b
call fcn.0063b05d
pop ecx
call dword [0x6c0254]
mov dword [0x7d52f4], eax
call 0x64d390
mov dword [0x7b7704], eax
call fcn.0064cf9b
test eax, eax
jns 0x63afd3
push 8
call fcn.0063685f
pop ecx
call fcn.0064d1c8
test eax, eax
jns 0x63afe4
push 9
call fcn.0063685f
pop ecx
push 1
call fcn.00636899
pop ecx
test eax, eax
je 0x63aff7
push eax
call fcn.0063685f
pop ecx
call fcn.0064d41b
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x63b019
push esi
call fcn.00636af5
call fcn.0063688a
jmp 0x63b04e
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00642f95
ret
Function at 0x6951d0
Capabilities:
Encode data using xor

Disassembly:
rcr byte [ecx], 5
scasb al, byte es:[edi]
and edi, dword [ebp + 0x69]
wait
jmp 0x6951c0
sub dword [edx + 0x7fd66fd5], ebx
mov dword [0x7ec6d5a3], eax
stosb byte es:[edi], al
or eax, 0xd1a6b9a1
cld
mov eax, dword [0xfcd1a6b9]
fcmovnu st(0), st(6)
insb byte es:[edi], dx
ljmp 0xa2b9
dec ecx
insb byte es:[edi], dx
sbb eax, dword [ecx + 0x74]
pop eax
jns 0x6951bb
cwde
test al, 0x16
imul ecx, dword [ecx + 0x5726e482], 0x8837ed9c
inc esp
xchg esi, eax
pushfd
mov dword [ebp + 0x78b6c6cc], ebx
fistp qword [esi + ecx*2 - 0x6b]
jns 0x6951d8
jecxz 0x69525b
jecxz 0x695261
js 0x69518c
call 0xcff5802a
cmp eax, 0x999fb3fa
clc
loope 0x6951ae
arpl word [ecx + 0x70], sp
popfd
retf 0x79c0
call dword [eax - 0x3d]
jmp 0x31dc7446
outsd dx, dword [esi]
cli
push esp
lahf
je 0x695226
xor edx, edi
jno 0x6952c6
arpl word [bx + di], ax
sub eax, 0xf21a8439
imul ebx, dword [ecx], 0xcd44392e
dec eax
jae 0x69527a
nop
inc esp
out 0x91, al
iretd
inc ebx
xor ecx, dword es:[ebx]
or bh, byte gs:[ecx + 0x5f]
pop edi
xor byte [eax], al
and dword [edx - 0x60], ebp
test eax, 0xeb840180
xchg esi, eax
mov al, al
rol dword [ecx], 1
mov dword [0xac3c5594], eax
sahf
test esp, ebp
std
pop ds
jno 0x6952bf
cli
clc
pop es
or ah, ah
mov edx, 0x422c7cd9
pop ebx
invalid
Function at 0x175c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0175c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x175c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x175c06a
add dl, dl
jne 0x175c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x175c0dc
xor eax, eax
add dl, dl
jne 0x175c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x175c17d
add dl, dl
jne 0x175c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x175c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x175c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x175c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x175c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x175c075
mov eax, 1
add dl, dl
jne 0x175c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x175c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x175c0e1
sub eax, ebx
mov ebx, 1
jne 0x175c128
mov ecx, 1
add dl, dl
jne 0x175c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x175c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x175c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x175c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x175c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x175c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x175c136
cmp eax, 0x7d00
jae 0x175c16d
cmp eax, 0x500
jb 0x175c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x175c075
cmp eax, 0x7f
ja 0x175c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x175c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x175c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x175c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219