joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ef430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x28]
lea ecx, [ebp - 4]
add eax, 0x76c0
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0xc], esi
mov ebx, 0x21
mov dword [ebp - 0x10], eax
call fcn.008e8300
test eax, eax
jne 0x7ef468
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp + 8]
push edi
push 0x21
lea edi, [esi + 0x6c]
push edi
push edx
mov ecx, esi
call fcn.008e7020
test eax, eax
je 0x7ef51a
mov edx, dword [ebp - 4]
mov ecx, edi
movzx eax, byte [ecx]
xor eax, edx
mov byte [ecx], al
add edx, 1
add ecx, 1
sub ebx, 1
jne 0x7ef487
mov eax, dword [ebp + 8]
push 0x21
push edi
push eax
mov ecx, esi
mov dword [ebp - 4], edx
call fcn.008e7080
test eax, eax
je 0x7ef51a
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0x28]
lea ecx, [ebp - 4]
push ecx
add eax, 0x76d4
push eax
mov ecx, esi
call fcn.008e8300
test eax, eax
je 0x7ef51a
mov eax, dword [ebp - 4]
mov edx, 0x21
xor esi, esi
movzx ebx, byte [edi]
and esi, 0xffffff00
or esi, ebx
mov ecx, edx
xor esi, edx
and ecx, 0x1f
rol esi, cl
add edi, 1
add esi, eax
xor eax, esi
xor eax, dword [ebp - 4]
add eax, 1
sub edx, 1
jne 0x7ef4d3
mov edi, dword [ebp - 0xc]
mov edx, dword [edi + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x28]
lea ecx, [ebp - 8]
push ecx
add eax, 0x76d8
push eax
mov ecx, edi
call fcn.008e8300
test eax, eax
jne 0x7ef525
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [edi + 0x524]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, 0x5c00
jmp 0x7ef540
movzx ecx, byte [edi]
and edx, 0xffffff00
or edx, ecx
mov ecx, eax
add esi, edx
and ecx, 0x1f
rol esi, cl
add edi, 1
mov dword [ebp - 8], edx
xor esi, ebx
xor esi, eax
sub eax, 1
jne 0x7ef540
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebx + 0x528]
mov edx, esi
mov dword [ebp - 8], edx
mov eax, 0xef
jmp 0x7ef580
movzx ecx, byte [edi]
and esi, 0xffffff00
or esi, ecx
mov ecx, eax
add edx, esi
and ecx, 0x1f
rol edx, cl
add edi, 1
xor edx, eax
sub eax, 1
mov dword [ebp - 8], edx
jne 0x7ef580
push edx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, ebx
call fcn.008e8420
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7ef6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
push 0x10
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [ebp - 8], edi
call fcn.008e7020
test eax, eax
jne 0x7ef708
pop edi
mov esp, ebp
pop ebp
ret 4
movzx ecx, byte [edi + 0x534]
push ebx
mov ebx, dword [edi + 0x53c]
mov eax, 0x379c
jmp 0x7ef720
movzx edx, bl
xor edx, ecx
and ebx, 0xffffff00
or edx, ebx
xor edx, eax
not edx
rol edx, 4
sub eax, 1
mov ebx, edx
jne 0x7ef720
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp + 0xb]
push eax
push ecx
mov ecx, edi
call fcn.008e8240
test eax, eax
je 0x7ef764
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 1]
push edx
add eax, 2
push eax
mov ecx, edi
call fcn.008e8240
test eax, eax
jne 0x7ef76e
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebp + 0xb]
cmp al, 0x28
je 0x7ef782
test al, al
mov ecx, dword [ebp - 0x1c]
jne 0x7ef7a6
cmp byte [ebp - 1], 1
jne 0x7ef78f
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4
mov al, byte [edi + 0x535]
cmp al, 1
jne 0x7ef7bc
mov dword [edi + 0x538], ecx
mov byte [edi + 0x535], 2
push esi
mov esi, dword [ebp - 0x18]
test esi, esi
mov dword [ebp - 0xc], ecx
jne 0x7ef7e3
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
cmp al, 2
je 0x7ef7a6
cmp ecx, dword [edi + 0x538]
jne 0x7ef79f
mov eax, 1
pop ebx
mov dword [edi + 0x530], eax
pop edi
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 8]
mov ecx, dword [edi + 0x44]
mov ecx, dword [ecx + 0xc]
push 0x48
call fcn.0070d1c0
mov eax, 0x400
cmp esi, eax
jae 0x7ef7fc
movzx eax, si
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx edi, ax
mov eax, dword [ebp - 8]
push edi
add eax, 0x6c
push eax
push edx
call fcn.008e7020
test eax, eax
je 0x7ef7b1
test edi, edi
jbe 0x7ef836
mov eax, dword [ebp - 8]
add eax, 0x6c
mov ecx, edi
xor byte [eax], bl
xor ebx, esi
not ebx
add ebx, esi
add eax, 1
sub esi, 1
sub ecx, 1
jne 0x7ef823
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
push edi
add eax, 0x6c
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.008e7080
test eax, eax
je 0x7ef7b1
add dword [ebp - 0xc], edi
test esi, esi
jne 0x7ef7e0
lea eax, [esi + 1]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x7ef9a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx]
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
mov ecx, dword [eax + 0xc]
push 0x48
call fcn.0070d1c0
mov edi, dword [edi + 0x524]
mov edx, 0x857
mov eax, dword [edi]
xor eax, edx
add eax, esi
mov ecx, edx
and ecx, 0x1f
add edi, 4
not eax
rol eax, cl
sub edx, 1
mov esi, eax
jne 0x7ef9c5
pop edi
mov dword [ebx], esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x7ef9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ebx, dword [eax + 0x28]
push edi
lea ecx, [ebp - 5]
push ecx
lea edx, [ebx + 0x7b09]
push edx
mov ecx, esi
xor edi, edi
call fcn.008e8240
test eax, eax
je 0x7efb46
movzx eax, byte [ebp - 5]
lea ecx, [ebp - 1]
push ecx
lea eax, [ebx + eax + 0x7ad7]
push eax
mov ecx, esi
call fcn.008e8240
test eax, eax
je 0x7efb46
movzx eax, byte [ebp - 1]
cmp eax, 0x400
mov dword [ebp - 0xc], eax
ja 0x7efb46
test eax, eax
je 0x7efb46
cmp dword [esi + 0x524], edi
mov edx, dword [esi + 0xc]
mov ebx, dword [edx + 0x28]
jne 0x7efaa0
mov eax, dword [esi + 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 0x215c
call edx
test eax, eax
mov dword [esi + 0x524], eax
je 0x7efb46
push 0x215c
push eax
lea eax, [ebx + 0x3157]
push eax
mov ecx, esi
call fcn.008e7020
test eax, eax
je 0x7efb46
lea ecx, [ebp - 0x10]
push ecx
add ebx, 0x7b16
push ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.008e8300
test eax, eax
je 0x7efb46
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
push edx
lea ebx, [esi + 0x6c]
push ebx
push eax
mov ecx, esi
call fcn.008e7020
test eax, eax
je 0x7efb46
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.007ef9a0
mov dl, byte [ebp - 0x10]
xor byte [ebx + edi], dl
add edi, 1
cmp edi, dword [ebp - 0xc]
jne 0x7efad4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add eax, 1
push eax
push ebx
push ecx
mov ecx, esi
mov byte [edi + esi + 0x6c], 0
call fcn.008e7080
test eax, eax
je 0x7efb46
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push edx
push eax
mov ecx, esi
call fcn.008e8420
test eax, eax
je 0x7efb46
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x28]
add byte [ebp - 5], 1
mov edx, dword [ebp - 5]
add eax, 0x7b09
push edx
push eax
mov ecx, esi
call fcn.008e8360
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7fc470
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov esi, ecx
je 0x7fc4fa
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x40
jbe 0x7fc4fa
lea eax, [ebp + 8]
push eax
push edi
call fcn.008e5e80
test eax, eax
je 0x7fc4fa
mov ax, word [ebp + 8]
cmp ax, 0x5a4d
je 0x7fc4a5
cmp ax, 0x4d5a
jne 0x7fc4fa
lea ecx, [ebp + 0xc]
push ecx
lea edx, [edi + 0x3c]
push edx
mov ecx, esi
call fcn.008e5eb0
test eax, eax
je 0x7fc4fa
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x7fc4cb
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
lea ecx, [eax + 2]
cmp ecx, ebx
ja 0x7fc4fa
lea edx, [ebp + 8]
push edx
add eax, edi
push eax
mov ecx, esi
call fcn.008e5e80
test eax, eax
je 0x7fc4fa
mov ax, word [ebp + 8]
cmp ax, 0x454e
je 0x7fc4bf
cmp ax, 0x4550
je 0x7fc4bf
cmp ax, 0x454c
je 0x7fc4bf
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x80acf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x18]
test edx, edx
mov ecx, dword [ebp + 0x10]
push ebx
push esi
je 0x80ad31
mov esi, dword [ebp + 0x14]
cmp esi, 4
jb 0x80ad31
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x80ad31
xor eax, eax
test esi, esi
jbe 0x80ad28
push edi
mov edi, dword [ebp + 0xc]
imul ecx, ebx
add ecx, edi
xor dword [eax + edx], ecx
add eax, 4
cmp eax, esi
jb 0x80ad18
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x80ad40
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x80ad51
lea eax, [esi + 1]
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x80ad60
mov eax, dword [ebp + 0x10]
pop ebx
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 0x10]
movzx ecx, di
shr edi, 0x10
test ebx, ebx
jbe 0x80ae1b
cmp ebx, 0x15b0
jbe 0x80ad84
mov edx, 0x15b0
mov dword [ebp + 0xc], edx
jmp 0x80ad89
mov edx, ebx
mov dword [ebp + 0xc], ebx
sub ebx, dword [ebp + 0xc]
mov eax, edx
shr eax, 4
and edx, 0xf
test eax, eax
mov dword [ebp + 8], ebx
jbe 0x80add5
mov dword [ebp + 0xc], eax
mov edi, edi
mov eax, 4
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 4
sub eax, 1
jne 0x80ada5
sub dword [ebp + 0xc], 1
jne 0x80ada0
mov ebx, dword [ebp + 8]
test edx, edx
jbe 0x80adef
mov eax, edx
jmp 0x80ade0
movzx edx, byte [esi]
add ecx, edx
add edi, ecx
add esi, 1
sub eax, 1
jne 0x80ade0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x80ad72
mov eax, edi
pop edi
shl eax, 0x10
pop ebx
or eax, ecx
pop esi
pop ebp
ret
Function at 0x811ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6d7a68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0xff
mov dword [ebp - 0x118], ecx
lea ecx, [ebp - 0x103]
push 0
push ecx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x11c], edi
mov byte [ebp - 0x104], 0
call fcn.0067e0a0
movzx ebx, word [edi]
mov eax, dword [ebp + 0x14]
add esp, 0xc
test esi, esi
jne 0x811f3b
mov edi, pe_nt_image_headers32
lea esi, [ebp - 0x104]
mov dword [ebp - 0x114], edi
jmp 0x811f43
mov edi, eax
mov dword [ebp - 0x114], eax
test eax, eax
mov dword [ebp - 0x108], eax
je 0x811fdb
jmp 0x811f59
mov edi, dword [ebp - 0x114]
cmp eax, edi
jge 0x811f5f
mov edi, eax
mov edx, dword [ebp - 0x110]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx + 0x194]
mov dword [ebp - 0x10c], edi
movzx edi, di
push edi
push esi
xor edx, edx
push edx
push eax
call fcn.008d5400
test eax, eax
jle 0x811fdb
mov ecx, dword [ebp - 0x110]
add dword [ecx], eax
xor ecx, ecx
test eax, eax
jle 0x811fbd
lea esp, [esp]
movzx edx, byte [esi + ecx]
movzx edi, bl
xor edx, edi
movzx edx, word [edx*2 + 0x6e5e08]
shr ebx, 8
add ecx, 1
xor ebx, edx
cmp ecx, eax
jl 0x811fa0
mov ecx, dword [ebp - 0x10c]
cmp eax, ecx
jl 0x811fdb
mov eax, dword [ebp - 0x108]
sub eax, ecx
mov dword [ebp - 0x108], eax
jne 0x811f53
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 4]
mov word [eax], bx
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp - 0x108]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0067de1d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x81ebe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
jne 0x81ec01
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
pop edi
xor al, al
pop esi
pop ebp
ret 0xc
mov al, byte [esi]
push ebx
mov ebx, dword [ebp + 0xc]
xor al, byte [ebx]
test al, 1
jne 0x81ecba
movzx eax, word [esi + 0x20]
cmp ax, word [ebx + 0x20]
jne 0x81ecba
mov ecx, dword [ebx + 0x1c]
mov edx, dword [esi + 0x1c]
movzx eax, ax
cmp eax, 4
jb 0x81ec44
lea ecx, [ecx]
mov edi, dword [edx]
cmp edi, dword [ecx]
jne 0x81ec48
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x81ec30
test eax, eax
je 0x81ecab
movzx esi, byte [ecx]
movzx edi, byte [edx]
sub edi, esi
jne 0x81ec97
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x81eca8
movzx esi, byte [ecx]
movzx edi, byte [edx]
sub edi, esi
jne 0x81ec97
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x81eca8
movzx esi, byte [ecx]
movzx edi, byte [edx]
sub edi, esi
jne 0x81ec97
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x81eca8
movzx ecx, byte [ecx]
movzx edi, byte [edx]
sub edi, ecx
je 0x81eca8
test edi, edi
mov esi, dword [ebp + 8]
mov eax, 1
jg 0x81ecad
or eax, 0xffffffff
jmp 0x81ecad
mov esi, dword [ebp + 8]
xor eax, eax
test eax, eax
jne 0x81ecba
pop ebx
pop edi
mov al, 1
pop esi
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov edi, eax
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 0x1c]
mov dword [eax + 0x1c], edx
mov cx, word [ebx + 0x20]
mov word [eax], 0
mov word [eax + 0x20], cx
movzx edx, byte [ebx]
pop ebx
and edx, 1
pop edi
mov word [eax], dx
xor al, al
pop esi
pop ebp
ret 0xc

Function at 0x82f070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov ecx, edi
xor ecx, 0xce4b
movzx edx, cx
xor ebx, ebx
test edi, edi
mov dword [ebp + 8], edx
jle 0x82f0bc
push esi
nop
movzx cx, byte [eax + ebx + 0x2c]
lea esi, [ebx + 1]
movzx edx, cx
mov cl, 0xe
sub cl, bl
mov ebx, edx
shr bx, cl
mov ecx, esi
shl edx, cl
or bx, dx
and bx, 0x7fff
xor word [ebp + 8], bx
mov ebx, esi
cmp ebx, edi
jl 0x82f090
pop esi
mov ax, word [ebp + 8]
pop edi
pop ebx
pop ebp
ret 4
Function at 0x8357f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx ebx, word [edi + 2]
mov eax, ecx
movzx ecx, bl
sub cl, byte [eax + 0xe3e]
movzx esi, bx
sub cl, byte [eax + 0xe3a]
mov dword [ebp + 0xc], 0
add cl, byte [ebp + 8]
and ecx, 0xf
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0x10]
cmp ecx, esi
jge 0x835876
mov edx, dword [ebp + 0x14]
sub edx, ecx
mov dword [ebp + 0x14], edx
cmp ecx, 0x820
jge 0x8358ca
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp + 0x18]
jge 0x835873
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
movsx ebx, byte [ebx + ecx]
add edx, ecx
and edx, 0xf
mov dl, byte [edx + eax + 0xe28]
xor dl, byte [ecx + edi + 4]
rol dl, 3
movzx edx, dl
cmp ebx, edx
jne 0x8358ca
add dword [ebp + 0xc], 1
add ecx, 1
cmp ecx, esi
jl 0x835830
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
cmp ecx, esi
mov edx, ecx
jge 0x8358a9
mov edi, edi
cmp ebx, dword [ebp + 0x18]
jge 0x8358a9
mov ecx, dword [ebp + 8]
add ecx, edx
and ecx, 0xf
mov esi, 1
shl esi, cl
add edx, 1
add ebx, 1
or word [eax + 0xe38], si
movzx ecx, word [edi + 2]
cmp edx, ecx
jl 0x835880
cmp word [eax + 0xe38], 0xffff
jne 0x8358ca
pop edi
pop esi
mov dword [eax + 0xe24], 1
mov eax, 1
pop ebx
pop ebp
ret 0x14
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x14
Function at 0x84f0d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x6d7a68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x2b0]
push 0x120
lea esi, [edi + 0x1d]
push esi
xor ebx, ebx
push ebx
push 0x2000
call fcn.008d5400
cmp eax, 0x120
jne 0x84f151
mov ecx, 0x6bf2d0
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x84f132
test dl, dl
je 0x84f12e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x84f132
add eax, 2
add ecx, 2
test dl, dl
jne 0x84f112
xor eax, eax
jmp 0x84f137
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x84f151
pop edi
pop esi
mov eax, 0x2000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x2b0]
push 0x40
lea eax, [ebp - 0x46c]
push eax
push ebx
push ebx
call fcn.008d5400
cmp eax, 0x40
jb 0x84f2b6
mov ax, word [ebp - 0x46c]
cmp ax, 0x5a4d
je 0x84f187
cmp ax, 0x4d5a
jne 0x84f2b6
mov eax, dword [ebp - 0x430]
mov ecx, dword [edi + 0x2b0]
push 0x18
lea esi, [ebp - 0x48c]
push esi
xor edx, edx
push edx
push eax
call fcn.008d5400
cmp eax, 0x18
jb 0x84f2b6
cmp dword [ebp - 0x48c], 0x4550
jne 0x84f2b6
test dword [ebp - 0x476], 0x2000
jne 0x84f2b6
cmp word [ebp - 0x486], bx
movzx ecx, word [ebp - 0x478]
mov edx, dword [ebp - 0x430]
lea esi, [ecx + edx + 0x18]
mov dword [ebp - 0x470], ebx
jbe 0x84f23d
mov edi, edi
mov ecx, dword [edi + 0x2b0]
push 0x28
lea eax, [ebp - 0x42c]
push eax
push 0
push esi
call fcn.008d5400
cmp eax, 0x28
jne 0x84f2b6
mov ecx, dword [ebp - 0x418]
mov edx, dword [ebp - 0x41c]
add esi, eax
lea eax, [edx + ecx]
cmp eax, dword [ebp - 0x470]
jbe 0x84f22f
mov dword [ebp - 0x470], eax
movzx eax, word [ebp - 0x486]
add ebx, 1
cmp ebx, eax
jb 0x84f1f0
mov eax, dword [ebp - 0x470]
mov ecx, dword [edi + 0x2b0]
push 0x400
lea edx, [ebp - 0x404]
push edx
push 0
push eax
call fcn.008d5400
cmp eax, 0xa
jb 0x84f2b6
lea edi, [eax - 0xa]
xor esi, esi
test edi, edi
jbe 0x84f2b6
jmp 0x84f270
cmp byte [ebp + esi - 0x404], 0x5f
lea eax, [ebp + esi - 0x404]
jne 0x84f2af
mov ecx, 0x6bf2d0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x84f2a6
test dl, dl
je 0x84f2a2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x84f2a6
add eax, 2
add ecx, 2
test dl, dl
jne 0x84f286
xor eax, eax
jmp 0x84f2ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x84f2c9
add esi, 1
cmp esi, edi
jb 0x84f270
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x470]
lea eax, [esi + ecx]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
Function at 0x85d5c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x6d7a68]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov edi, ecx
mov ecx, dword [edi + 0x198]
push 0
push 0
call fcn.008d5400
cmp eax, 0x40
jae 0x85d601
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov ax, word [ebp - 0x4c]
cmp ax, 0x5a4d
je 0x85d611
cmp ax, 0x4d5a
jne 0x85d5f0
mov ax, word [ebp - 0x4a]
test ax, ax
push ebx
je 0x85d62e
movzx ecx, word [ebp - 0x48]
movzx edx, ax
shl ecx, 9
lea ebx, [ecx + edx - 0x200]
jmp 0x85d635
movzx ebx, word [ebp - 0x48]
shl ebx, 9
mov ecx, dword [edi + 0x198]
push 7
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
mov dword [ebp - 0x50], ebx
call fcn.008d5400
cmp eax, 7
je 0x85d663
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
push esi
mov eax, 7
mov edx, 0x6e6bc0
lea esi, [ebp - 0xc]
mov ecx, dword [esi]
cmp ecx, dword [edx]
jne 0x85d689
sub eax, 4
add edx, 4
add esi, 4
cmp eax, 4
jae 0x85d671
test eax, eax
je 0x85d6ec
movzx ecx, byte [esi]
movzx ebx, byte [edx]
sub ecx, ebx
jne 0x85d6d8
sub eax, 1
add edx, 1
add esi, 1
test eax, eax
je 0x85d6e9
movzx ecx, byte [esi]
movzx ebx, byte [edx]
sub ecx, ebx
jne 0x85d6d8
sub eax, 1
add edx, 1
add esi, 1
test eax, eax
je 0x85d6e9
movzx ecx, byte [esi]
movzx ebx, byte [edx]
sub ecx, ebx
jne 0x85d6d8
sub eax, 1
add edx, 1
add esi, 1
test eax, eax
je 0x85d6e9
movzx ecx, byte [esi]
movzx edx, byte [edx]
sub ecx, edx
je 0x85d6e9
test ecx, ecx
mov ebx, dword [ebp - 0x50]
mov eax, 1
jg 0x85d6ee
or eax, 0xffffffff
jmp 0x85d6ee
mov ebx, dword [ebp - 0x50]
xor eax, eax
test eax, eax
jne 0x85d706
pop esi
lea eax, [ebx + 7]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0x198]
push 0x34
lea esi, [ebp - 0xa0]
push esi
xor edx, edx
push edx
push eax
call fcn.008d5400
cmp eax, 0x34
jb 0x85d7ae
cmp word [ebp - 0xa0], 0x454e
jne 0x85d760
test dword [ebp - 0x94], 0x8000
jne 0x85d760
mov eax, esi
push eax
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, edi
call fcn.0085bfb0
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0x198]
push 0x18
lea esi, [ebp - 0x6c]
push esi
xor edx, edx
push edx
push eax
call fcn.008d5400
cmp eax, 0x18
jb 0x85d7ae
cmp dword [ebp - 0x6c], 0x4550
jne 0x85d7ae
test dword [ebp - 0x56], 0x2000
jne 0x85d7ae
mov edx, esi
push edx
lea eax, [ebp - 0x4c]
push eax
mov ecx, edi
call fcn.0085c260
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
xor eax, eax
pop edi
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
Function at 0x864220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov eax, 1
xor cl, cl
cmp edi, eax
mov byte [ebx], 0
jbe 0x86424a
lea esp, [esp]
xor cl, byte [eax + edx]
add eax, 1
cmp eax, edi
jb 0x864240
cmp cl, byte [edx]
je 0x864256
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0xc
push esi
push edi
push edx
push 0xffffffffffffffff
call fcn.008e2050
mov esi, dword [0x6e6da0]
add esp, 0xc
xor edx, edx
test esi, esi
not eax
je 0x864291
xor ecx, ecx
cmp edi, esi
jne 0x86427f
cmp eax, dword [ecx + 0x6e6da4]
je 0x86429d
add edx, 1
mov ecx, edx
shl ecx, 4
mov esi, dword [ecx + 0x6e6da0]
test esi, esi
jne 0x864273
pop esi
pop edi
mov byte [ebx], 0
xor eax, eax
pop ebx
pop ebp
ret 0xc
shl edx, 4
mov al, byte [edx + 0x6e6da8]
pop esi
mov byte [ebx], al
pop edi
mov eax, 1
pop ebx
pop ebp
ret 0xc

Function at 0x872f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cl, byte [eax]
push esi
xor esi, esi
test cl, cl
je 0x872f83
push edi
mov edi, dword [ebp + 0xc]
mov edx, edi
sub edx, eax
xor cl, 0xaa
mov byte [edx + eax], cl
mov cl, byte [eax + 1]
add eax, 1
add esi, 1
test cl, cl
jne 0x872f67
mov byte [esi + edi], cl
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov byte [esi + eax], 0
pop esi
pop ebp
ret 8

Function at 0x8764a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
or eax, 0xffffffff
test esi, esi
je 0x8764eb
mov edi, edi
mov cl, byte [esi]
test cl, cl
je 0x8764eb
movzx edx, al
movzx ecx, cl
xor ecx, edx
and eax, 0xffffff00
or eax, ecx
mov ecx, 8
lea ebx, [ebx]
mov edx, eax
and edx, 1
shr eax, 1
cmp dl, 1
jne 0x8764e1
xor eax, 0xedb88320
sub ecx, 1
jne 0x8764d0
add esi, 1
jne 0x8764b0
pop esi
pop ebp
ret