joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb99979
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 3
pop word [esp + 6]
cld
pushal
xchg dword [esp + 0xf], edi
jmp 0xb999d9
std
pop dword [esp + 5]
xchg ebx, ecx
adc ebx, 0x23d1db98
lea ecx, [eax*4]
rol dh, 0
jmp 0xb99936
mov dl, 0x3d
popal
xchg word [esp + 0xe], bx
xchg word [esp + 0xb], cx
bswap edi
jmp 0xb9994c
sub esp, 0xe
lea ebp, [ebx + ebx]
pop dword [esp + 0x10]
cmc
neg bp
jmp 0xb999b6
add esp, 0x15
rdtsc
lea ebx, [edx*4]
neg ecx
cld
pop word [esp + 2]
jmp 0xb9998a
mov ecx, dword [esp + 8]
push word [esp + 0x12]
xchg byte [esp + 7], ch
cld
pop di
xchg byte [esp + 2], cl
jmp 0xb99a02
lea edi, [eax + 0x4853]
popal
mov edi, dword [esp]
sub esp, 0xd
pop ecx
sub esp, 0x15
jmp 0xb999a0
bts edi, ebx
mov dx, 0xe22a
mov ch, byte [esp]
mov word [esp + 0x1a], bx
jmp 0xb99a13
mov eax, dword [esp + 5]
push ebp
xchg al, bl
xchg byte [esp + 0x16], dl
neg ebp
not al
jmp 0xb999ec
lea ecx, [esp + edx]
std
lea esp, [esp + 1]
rdtsc
pop dword [esp + 3]
jmp 0xb99b08
lea esp, [esp + 4]
sub esp, 9
pushfd
mov dl, byte [esp + 2]
rdtsc
bswap edx
jmp 0xb99a8a
lea ebx, [ebp - 0xfae9]
cmc
shl cx, cl
push word [esp + 4]
mov dword [esp + 6], eax
jmp 0xb99a30
rdtsc
xchg word [esp], cx
sub esp, 0x11
mov cl, 0x9a
pop dword [esp + 0xa]
xchg cx, ax
jmp 0xb99a46
push esp
mov eax, 0x8d5ae2a0
xchg byte [esp + 6], dl
push dword [esp]
jmp 0xb99ab8
mov edx, ecx
pop si
add esp, 0
mov di, 0x25af
neg di
clc
jmp 0xb99a74
mov word [esp + 0xf], si
mov word [esp + 0x10], si
mov cl, byte [esp + 0xa]
mov byte [esp + 0x18], bh
pop dword [esp + 0xa]
jmp 0xb99ae1
jbe 0xb99b19
mov al, byte [esp + 0xe]
mov dh, 0xea
bswap ecx
lea ecx, [esp + esi]
mov edi, edx
mov byte [esp + 0x10], ch
jmp 0xb99a9b
pop dx
setne bh
mov edi, dword [esp + 0x10]
pop dword [esp + 0xf]
jmp 0xb99af0
mov ebp, edi
xchg esi, ebp
cld
mov al, 0xe3
rcr edi, cl
xchg byte [esp + 0x14], bl
jmp 0xb99acb
mov eax, 0x4ac40462
pop word [esp + 0x11]
pop dword [esp + 9]
neg bh
jmp 0xb99c04
push dword [esp + 0xb]
pop ebx
lea edi, [edx + ebx]
lea esp, [esp + 0xf]
add esp, 8
mov byte [esp], ch
jmp 0xb99a60
and al, 0xe9
inc ecx
invalid
mov ax, si
call fcn.00b99bcc
xchg esp, eax
sbb ecx, dword [ebx - 0x502e212]
jl 0xb99b42
jne 0xb99ab6
insd dword es:[edi], dx
leave
push 0x24448966
adc dword [ebp - 0x7899d5cc], ecx
mul dword [esi + 0xf]
mov word [esp + 0x11], ax
lea esi, [edx + ebp]
xchg di, si
bt di, dx
pop bp
lea esp, [esp + 9]
mov dword [0x8d5d66d7], eax
and al, 9
jmp 0xb99b1f
lea eax, [eax - 0x20]
cpuid
xchg edx, ecx
push ebx
shl si, cl
mov al, byte [esp + 0x11]
jmp 0xb99b35
Function at 0xb9a03b
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bp
mov byte [esp + 2], ah
bsf esi, esp
rdtsc
jmp 0xb9a01c
stc
dec edi
inc dl
mov word [esp + 1], dx
mov dx, bx
mov al, 7
jmp 0xb99ff6
cmp edi, 0xe4a1e2c6
mov ebp, edx
lea ecx, [esi*4]
push word [esp + 5]
pop word [esp + 1]
jmp 0xb9a053
jmp 0xb9a00c
pop word [esp + 2]
inc di
inc esi
lea ebx, [ecx*4]
std
jmp 0xb9a0c0
shr ebx, 0xc
std
bswap ebp
xchg ebp, eax
mov ax, 0x72db
mov di, word [esp + 3]
jmp 0xb9a03d
pushfd
push dword [esp]
pop edx
lea edi, [ebx*4]
sub esp, 2
call fcn.00b9a07c
pop word [esp + 3]
mov ebp, ecx
cld
xchg dword [esp], eax
mov ah, 0x35
bswap edi
jmp 0xb9a0d4
pop bx
xchg word [esp], di
mov word [esp], bx
rdtsc
lea esp, [esp + 2]
cpuid
jmp 0xb9a092
dec cl
mov ecx, edx
bsr ecx, ebx
mov ebx, 0xaa24a5ec
neg bx
cpuid
jmp 0xb9a1be
Function at 0xb9a293
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, 0x9b93
setg dl
mov ecx, dword [esp + 1]
xchg dword [esp + 4], edx
xchg esi, eax
jmp 0xb9a2b6
rcl ah, cl
mov edx, esp
xchg ecx, eax
rcr ebp, 2
bsr edx, eax
jmp 0xb9a27d
xchg ch, dh
xchg di, dx
lea esp, [esp + 7]
xchg ebp, eax
bsf ax, cx
jmp 0xb9a2e5
xchg byte [esp + 0xd], bl
bsf di, dx
pop word [esp + 7]
pop esi
mov dword [esp + 2], esp
add esp, 5
jmp 0xb9a2a0
btc cx, si
shr bp, 8
neg esi
xchg al, bl
mov di, sp
xchg byte [esp], bh
jmp 0xb9a31f
mov ch, dl
std
inc dx
mov bl, 0xb9
mov byte [esp], al
and edi, ecx
jmp 0xb9a2cd
mov ah, 0x98
mov eax, 0xe47abfda
mov cx, 0x7121
std
bsf edi, esi
lea ebx, [0x36781e53]
jmp 0xb9a347
mov cx, 0x4955
neg al
mov eax, dword [esp]
neg ah
lea esp, [esp]
mov ch, 0x34
jmp 0xb9a2f3
mov ax, word [esp]
sub esp, 0x1a
pop dx
stc
pop dx
lea eax, [eax + eax]
jmp 0xb9a356
cmc
lea edx, [0xfebd0da6]
cmc
xchg bh, ch
xchg dl, ch
std
jmp 0xb9a331
xchg esi, ebp
push word [esp + 5]
pop word [esp + 0xc]
cpuid
push dword [esp + 2]
sub esp, 0xf
jmp 0xb9a4c8
xchg cl, ch
lea ebp, [ebx + 0x92]
mov dword [esp], esp
stc
std
bsf edi, ecx
jmp 0xb9a458
bsf si, si
rdtsc
pop si
lea edx, [0x3eaee61d]
std
popal
jmp 0xb9a399
push word [esp + 1]
xchg ebx, eax
pop word [esp]
not edi
jmp 0xb9a3f2
lea ebx, [esi*4]
mov ebp, dword [esp]
lea eax, [ecx*4]
lea edx, [esi + ebp]
xchg edi, eax
mov ax, word [esp]
jmp 0xb9a3c1
mov di, word [esp + 1]
mov word [esp], si
lea edx, [edi + 0x555efee9]
lea esp, [esp + 2]
lea eax, [eax + eax]
jmp 0xb9a436
xchg ecx, edi
seto ch
mov byte [esp + 5], ch
mov ebp, edx
mov di, sp
pop esi
jmp 0xb9a3d7
xchg dx, si
lea ebp, [esp + edx]
mov byte [esp], dh
mov cl, 0x5c
cld
mov dh, ch
jmp 0xb9a488
shl dl, 2
lea ecx, [edx + ebx]
setg dl
rdtsc
xchg cl, bh
mov dl, byte [esp]
jmp 0xb9a420
cpuid
lea eax, [eax*4]
mov ch, 0x1f
lea esp, [esp + 3]
push word [esp + 2]
mov bx, 0x808a
jmp 0xb9a40f
mov word [esp + 0xe], si
rdtsc
mov esi, esp
rdtsc
xchg byte [esp + 0xb], al
jmp 0xb9a4b0
add esp, 0
mov edi, eax
pushfd
pop word [esp]
sub esp, 0x18
and bp, si
jmp 0xb9a472
mov byte [esp + 0xa], dl
sub esp, 0x1c
push word [esp + 0x27]
mov eax, ebx
cpuid
jmp 0xb9a4e2
lea esi, [eax + edi]
bts ebp, eax
xchg dh, al
inc eax
cpuid
lea ecx, [0xdaca5edc]
jmp 0xb9a49a
bswap edx
lea eax, [ebx*4]
mov ebp, edi
mov si, 0xee7
neg edx
mov dword [esp + 0x1b], ebx
jmp 0xb9a3af
bsr eax, eax
pop word [esp + 6]
xchg word [esp + 0x12], bx
sub esp, 0x17
lea esp, [esp + 0x4e]
bswap edi
jmp 0xb9a685
neg di
not ah
sub esp, 0x15
cpuid
neg ebx
xchg ebp, eax
call fcn.00b9a63b
push 0xb7592165
add dword [esp], 0x4946f5f7
call fcn.00b9a6cd
mov ebp, 0x91661f8c
Function at 0xb9bb82
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, al
lea edx, [ecx + esi]
jmp 0xb9bbe8
cld
push edi
push dword [esp + 0x16]
xchg ebx, eax
mov ebp, dword [esp + 0xe]
jmp 0xb9bbf9
mov di, bx
xchg byte [esp + 0x10], dh
push sp
xchg ah, cl
rdtsc
inc cl
jmp 0xb9bbd2
mov ax, word [esp + 0x19]
mov di, word [esp + 0xb]
push eax
inc cl
lea esp, [esp + 0xb]
pushal
jmp 0xb9bfae
not ebx
mov edx, 0x26bd7538
mov eax, ecx
mov edx, ebp
ror ebp, cl
jmp 0xb9bc7f
btr ebp, esi
rdtsc
pop word [esp + 0xb]
sub esp, 0x12
lea esp, [esp + 0x4b]
neg dh
jmp 0xb9bc3e
push word [esp]
mov word [esp + 1], si
lea edx, [ecx - 0x68bed4da]
jmp 0xb9bd10
mov si, word [esp]
rdtsc
lea esi, [edx + ebp]
push sp
mov word [esp], dx
bts ebx, ebp
jmp 0xb9bc69
rcr si, 5
bsr esi, ecx
xchg byte [esp + 0x21], bl
xchg word [esp + 0x11], ax
xchg dword [esp + 0x2e], esi
setge cl
jmp 0xb9bc54
mov word [esp], di
mov edi, dword [esp]
xchg al, dh
xchg al, bl
mov ebp, 0x62db1a47
cmp edi, ecx
jmp 0xb9bcf5
mov edx, edi
cld
shl cx, 6
mov word [esp], dx
rdtsc
mov word [esp], sp
jmp 0xb9bcbf
bsr dx, bp
xchg edx, ebx
mov esi, esp
push di
mov dword [esp], esi
mov edi, 0xa9514cca
jmp 0xb9bd38
bswap edx
pop ax
mov word [esp], cx
mov si, 0x9163
bswap eax
not ebp
jmp 0xb9bce2
mov word [esp], di
pop cx
inc bl
bsr eax, edi
mov di, word [esp]
jmp 0xb9bd82
mov byte [esp], dh
shr si, 3
pop bx
lea ecx, [esi*4]
lea esp, [esp]
rdtsc
jmp 0xb9bd22
cpuid
cpuid
clc
mov di, 0x2176
call fcn.00b9bd65
cld
mov esi, ecx
xchg cl, dh
xchg byte [esp], ch
cpuid
cld
jmp 0xb9bdbc
xchg word [esp], di
mov edx, eax
mov ebx, edx
mov eax, ecx
cmp ax, ax
mov cx, word [esp + 3]
jmp 0xb9bf56
btr ebx, esp
push dword [esp + 3]
setb cl
pushfd
cmc
mov edx, ecx
jmp 0xb9bca6
mov cl, byte [esp + 1]
sub esp, 0x10
call fcn.00b9be5c
not dh
rcr edx, cl
mov dx, 0xbdad
pop word [esp + 2]
xchg bp, bx
jmp 0xb9bec0
dec dl
lea ebx, [ecx + 0x87]
xchg byte [esp + 5], al
not dx
mov eax, ebx
mov ax, 0x116
jmp 0xb9bf04
pop ebx
mov byte [esp], dl
mov byte [esp], dl
xchg edi, eax
mov si, sp
push ebx
jmp 0xb9be8b
cld
bsf si, dx
std
call fcn.00b9bf2d
cmp byte [ebp + 0x42c7342d], bh
or al, 0x9f
out 0x11, al
nop
pop word [esp + 1]
mov cl, 0xef
setge ah
cpuid
std
mov byte [esp + 4], al
jmp 0xb9beee
bsf eax, edx
cpuid
mov dl, bl
lea edx, [eax*4]
push dword [esp + 2]
add esp, 3
jmp 0xb9bee0
add esp, 3
mov dl, al
setbe ah
xchg word [esp + 6], cx
bsr eax, edx
setb ch
jmp 0xb9bdde
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x103b5270
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103b527a
pushal
call 0x103b5280
pop ebp
sub ebp, 0x10
sub ebp, 0x3b5270
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103b52a4
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103b52ad
mov eax, 0x3b5270
add eax, ebp
add eax, 0x63
mov ecx, 0x5f9
mov edx, 0x3975e875
xor byte [eax], dl
inc eax
dec ecx
jne 0x103b52c4
jmp 0x103b52d7
invalid

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x40894f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
pop ebx
call fcn.0040897a
dec edx
xor dword [edi], ebx
add edi, 1
cmp edi, esi
jne fcn.0040894f
mov edx, 0x60b12206
add ecx, ecx
ret

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x406070
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x1c]
push 0x2f9
push edi
push str.Echo:_t_t_To_Adapter___s__LINE___d
call fcn.00403cd0
add esp, 0xc
mov word [esp + 8], 2
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x2af9
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 2
push 2
mov word [esp + 0x16], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4060e1
push 0x304
push str.Error:_t_t_::socket____LINE___d
call fcn.00403cd0
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret 8
mov ecx, dword [esp + 0x20]
lea eax, [esp + 8]
push 0x10
push eax
push 0
push ecx
push edi
push esi
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x406118
push 0x30a
push str.Error:_t_t_::sendto____LINE___d
call fcn.00403cd0
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret 8
Function at 0x100be85
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1002ae0
call fcn.0100c180
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x100bec2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100bec2
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100beda
cmp eax, 0x20b
je 0x100bec7
mov dword [ebp - 0x1c], ebx
jmp 0x100beee
cmp dword [ecx + 0x84], 0xe
jbe 0x100bec2
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x100bee8
cmp dword [ecx + 0x74], 0xe
jbe 0x100bec2
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1017860], 0xffffffff
or dword [0x1017864], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1017858]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1017854]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x101785c], eax
call fcn.0100c178
cmp dword [0x100eb60], ebx
jne 0x100bf49
push fcn.0100c178
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100c161
push 0x100e018
push 0x100e014
call sub.msvcrt.dll__initterm
mov eax, dword [0x1017850]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x101784c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x100e010
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x100bfdf
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x100bfb3
cmp al, 0x22
jne 0x100bfa5
cmp byte [esi], 0x22
jne 0x100bfbc
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x100bfc6
cmp al, 0x20
jbe 0x100bfb8
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x100bfea
movzx eax, word [ebp - 0x50]
jmp 0x100bfed
cmp byte [esi], 0x20
jbe 0x100bfbc
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100bfdf
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x100c00a
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100c03f
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100c1bb
ret
Function at 0x443529
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00443480
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x443558
mov eax, 0xea61
jmp 0x4435d6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x3c], 0
jne 0x443568
mov eax, 0xea62
jmp 0x4435d6
push 0xf8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00443480
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
je 0x443595
mov eax, 0xea62
jmp 0x4435d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x4435ad
mov eax, 0xea65
jmp 0x4435d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
test ch, 0x10
je 0x4435c2
mov eax, 0xea66
jmp 0x4435d6
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x74], 0x10
jbe 0x4435d2
mov eax, 0xea67
jmp 0x4435d6
xor eax, eax
jmp 0x4435d6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x534674
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.005346f3
jae 0x534680
xor ecx, ecx
call fcn.005346f3
jae 0x5346aa
xor eax, eax
call fcn.005346f3
jae 0x5346bb
mov al, 0x10
call fcn.005346f3
adc al, al
jae 0x53469c
jne 0x5346e8
stosb byte es:[edi], al
jmp 0x534681
call fcn.005346ff
dec ecx
loop 0x5346c7
mov eax, ebp
call fcn.005346fd
jmp 0x5346e9
lodsb al, byte [esi]
shr eax, 1
je 0x53470f
adc ecx, 2
mov ebp, eax
jmp 0x5346e9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.005346fd
cmp eax, 0x7d00
jae 0x5346e7
cmp eax, 0x500
jae 0x5346e8
cmp eax, 0x7f
ja 0x5346e9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x534681
pop ebp
ret 8
Function at 0x408610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40861f
pop dword [ebp - 0x1c]
mov eax, 0x40861f
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x8bb2ac39
add dword [ebp - 0x2c], 0xc29f9912
mov dword [ebp - 0x28], 0x3ef46d5d
sub dword [ebp - 0x28], 0xcc12118
mov dword [ebp - 0x24], 0x7c153eed
sub dword [ebp - 0x24], 0x2fc8fabf
mov dword [ebp - 0x20], 0x15cc3e4c
sub dword [ebp - 0x20], 0x15cc3e4c
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x1ad03adf
add dword [ebp - 0x2c], 0x59a22e77
mov dword [ebp - 0x28], 0x393f1cfc
add dword [ebp - 0x28], 0x82d4479
mov dword [ebp - 0x24], 0x468bcf1
sub dword [ebp - 0x24], 0xa0f95085
mov dword [ebp - 0x20], 0xe4f89251
sub dword [ebp - 0x20], 0xe4f89251
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xa8289074
sub eax, 0xa7e74028
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x397ed
push 0
call eax
mov ecx, 0x9af98a46
sub ecx, 0x9af9458e
mov edx, eax
mov ebx, 0xe68f1046
sub ebx, 0xe64d1c46
add ebx, dword [ebp - 0x1c]
mov edi, 0xdcfe69a4
add edi, 0x55ff1c41
mov dword [ebp - 0x18], 0xb81f41e8
mov esi, dword [ebx]
xor dword [ebp - 0x10], edi
sub esi, edi
xor dword [ebp - 8], 0x94646868
mov dword [edx], esi
sub dword [ebp - 0x18], 0x5823bca4
add edx, 0x74eecd64
add edx, 0x8b1132a0
add ebx, 4
loop 0x408737
add eax, 0xa96b9b9b
add eax, 0x56956a18
mov ebx, eax
add eax, 0x43c673f0
add eax, 0xbc398c15
mov ecx, 0x4961bcb1
add ecx, 0xb6de434f
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x100019b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100f7380
mov eax, 0x14
call fcn.100011c0
mov ecx, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x40]
mov edi, dword [edi]
test edi, edi
je 0x100f73bd
test esi, esi
je 0x100f73bd
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
jne 0x100f73a8
mov edx, dword [esp + 0x44]
cmp esi, 0x10
jb 0x100f7466
mov eax, ebp
xor edi, edi
sub eax, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov edi, ebx
mov eax, esi
sub edi, ecx
shr eax, 4
mov dword [esp + 0x10], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x3c]
nop dword [eax]
push dword [esp + 0x34]
mov ecx, edx
push ebp
push dword [esp + 0x40]
call dword [section..00cfg]
mov eax, dword [esp + 0x50]
call eax
push dword [esp + 0x44]
call fcn.100f7750
add esp, 0x10
mov eax, ebp
mov edx, 4
nop word [eax + eax]
mov ecx, dword [ebx + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x100f7430
mov edx, dword [esp + 0x44]
sub esi, 0x10
add edi, 0x10
add ebx, 0x10
sub dword [esp + 0x10], 1
jne 0x100f7400
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x3c]
test esi, esi
je 0x100f74b2
push dword [esp + 0x34]
push ecx
push dword [esp + 0x40]
mov ecx, edx
call dword [section..00cfg]
mov eax, dword [esp + 0x50]
call eax
push dword [esp + 0x44]
call fcn.100f7750
mov eax, dword [esp + 0x4c]
add esp, 0x10
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
nop word [eax + eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub esi, 1
jne 0x100f74a0
mov eax, dword [esp + 0x40]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10001ae0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100fbe90
mov eax, 0x14
call fcn.100011c0
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x30]
mov esi, dword [esi]
test esi, esi
je 0x100fbecd
mov ecx, dword [esp + 0x38]
test edi, edi
je 0x100fbecd
mov al, byte [esi + ecx]
dec edi
xor al, byte [ebp]
inc esi
mov byte [ebx], al
inc ebp
inc ebx
and esi, 0xf
jne 0x100fbeb8
mov edx, dword [esp + 0x40]
cmp edi, 0x10
jb 0x100fbf71
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, edi
shr eax, 4
mov dword [esp + 0x10], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x18]
jmp 0x100fbf14
mov ecx, dword [esp + 0x38]
push dword [esp + 0x34]
push ecx
push ecx
mov ecx, edx
call dword [section..00cfg]
mov eax, dword [esp + 0x4c]
call eax
add esp, 0xc
cmp esi, 0x10
jae 0x100fbf53
mov eax, dword [esp + 0x38]
mov edx, 0xf
sub edx, esi
add eax, esi
shr edx, 2
inc edx
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x100fbf41
mov edx, dword [esp + 0x40]
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x100fbf10
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
test edi, edi
je 0x100fbfb2
push dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov ecx, edx
push eax
push eax
call dword [section..00cfg]
mov eax, dword [esp + 0x4c]
call eax
mov eax, dword [esp + 0x44]
add esp, 0xc
sub ebp, eax
sub ebx, eax
lea ecx, [esi + eax]
add esi, edi
nop dword [eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x100fbfa0
mov eax, dword [esp + 0x3c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret