joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548aaf
Capabilities:
Encode data using xor

Disassembly:
jl 0x548af3
fdivr dword [ebx - 0xa219b32]
jl 0x548b21
xchg ecx, eax
xchg edx, eax
invalid
test al, 0x70
sub eax, edi
jo 0x548b1f
clc
sub al, 0x9f
jmp 0xfe6a7a18
retf 0x89cb
mov dword [ebx + 0x3cfa9d], ebp
outsb dx, byte [esi]
sbb dh, byte ds:[edx + 0x4a]
mov ds, word [ecx + edi*4 + 0xd]
arpl word [eax - 0x42399cae], si
pop eax
fnstsw word [esi + 0xe]
stosd dword es:[edi], eax
movhps xmm7, qword [ebp + edi*2 + 0x7f]
lea edi, [0xe1eeecd7]
lodsd eax, dword [esi]
loope 0x548af4
push 0x53
dec ebp
xor byte [ecx - 0x2a], 0xd9
jle 0x548b2c
mov gs, word [ecx + 0x2d]
sal dword [ecx - 0x26726665], 0xbd
push ds
ja 0x548bb6
dec esp
sub ah, al
les esp, [ebx + 0x76127a7f]
dec edx
sbb eax, 0x6cdbb701
jp 0x548bba
dec ebp
in eax, dx
stc
mov dword [0xede6a550], eax
jnp 0x548b95
stosd dword es:[edi], eax
out 0xd1, al
mov ebx, 0x7dc2ad69
add bh, byte [edx + ebx + 0x384da2f5]
adc al, byte [edx]
das
cmpsb byte [esi], byte es:[edi]
mov esp, 0x46b70dbe
mov dl, 0x4d
pop edx
inc eax
and al, 0xad
lodsd eax, dword [esi]
push ecx
jbe 0x548b89
or esi, dword [ebx]
cdq
or al, 0x25
pop edi
inc esi
invalid
or eax, 0x7d09adf0
sbb cl, cl
mov ecx, 0xb55fbadf
add ebx, dword [eax - 0x43]
jbe 0x548b45
sbb esi, dword [eax]
jb 0x548c34
mov dword ds:[ebx], edi
insd dword es:[edi], dx
sbb al, 0xfc
jmp 0x548bec
ficom dword [edx - 0x4e]
js 0x548c4a
push es
or byte [esi - 0x17dd5194], bh
int1
adc cl, byte [esi + ebp]
aas
lodsb al, byte [esi]
or ebx, edx
out 0xb, eax
pop ebx
lodsd eax, dword [esi]
test al, 0xe4
pop edx
cmp ebx, dword [esi]
jnp 0x548ba5
inc edx
fcmovu st(0), st(2)
loop 0x548c7e
ficomp dword [edi]
or ecx, dword [ecx + 0x3c]
adc dh, bl
xchg ecx, eax
nop
or eax, 0xef55f53a
outsb dx, byte [esi]
push esi
into
jmp 0xd406600
and al, 0x5a
invalid
test eax, 0xef36fa49
popfd
add byte [0xaa01f4c2], 0x36
fsubr qword [ebx]
fsubr qword ss:[ebx]
dec edi
jns 0x548c3e
call 0xe8ae1c74
mov byte [edx - 0x33], dl
mov dh, 6
lodsb al, byte [esi]
in al, dx
cmc
mov edi, 0xb60bc4c1
out 0x2c, al
or eax, 0xaf5f2f2b
bound edx, qword [esi + 0x1953b9f9]
or byte [eax], ch
clc
dec esi
mov eax, 0xceb6b19a
hlt
aam 0x1c
neg dword [esi]
sbb eax, 0xcc1fcfc5
jae 0x548ceb
pop ebp
ljmp 0x88fc
ret 0x41c6
add byte [ebp - 0x57], bl
mov eax, 0x6aaf5dc3
loop 0x548d19
wait
test byte [edx + eax*2 + 0x15eb0c8a], dh
jecxz 0x548d30
xor eax, 0x4aeaffda
mov ecx, dword [esi]
cmc
sbb eax, 0x5eb92e2b
jp 0x548d27
and esp, ecx
popfd
adc eax, 0x14b648b7
mov ah, 0x37
wait
das
pop ds
stosb byte es:[edi], al
jns 0x548caf
cmp byte [ebx + 0x70], bl
dec ebp
sbb dword [edx - 0x618d2704], edi
jb 0x548c8b
mov dword [0xb2e459b2], eax
pop ebx
in al, 0xde
cdq
or al, 0xf5
push 0xffffffffffffffa8
sub al, 0x64
or cl, cl
or esp, dword [ebx + 0x7f]
daa
fbstp tbyte [eax - 0x6c]
in eax, dx
mov es, word [ecx - 0x77]
fiadd word [eax + eax*2 - 0x2b6530d1]
stosd dword es:[edi], eax
into
xor eax, 0xc8fe0bde
scasb al, byte es:[edi]
jp 0x548cdd
ret
sub al, 0xf8
sti
xor ch, byte [edx + 0x55942d7b]
and ebp, dword [edi + 0x3761d330]
shl dword [ecx + 0x37], cl
invalid
test al, 0x84
invalid
Function at 0x568279
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509366
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5761c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x5468a4
call 0x63ae47
mov esi, eax
push 1
mov dword [ebp - 4], 0
call 0x639f49
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x56eba1
Capabilities:
Encode data using xor

Disassembly:
sub esp, dword [ecx + 0x4e26bcaf]
outsd dx, dword [esi]
mov ecx, 0x1eedd83d
push ecx
cdq
pop ss
mov bh, byte [edi - 0x4a246776]
pop eax
xchg ecx, eax
mov esp, 0xe9ef23af
pop edi
test dword [ebx + 0x7f182cb7], 0x6b381189
ficom word [ebx + 0x7942e354]
bound ecx, qword [eax - 0x44cc28dc]
mov byte [edx], dl
sbb bh, ch
inc edx
jns 0x56ec32
mov byte [edi + edx*8], ah
xor edi, dword [ebx - 0x10e7ed78]
adc byte [ebp + 0x37], ah
in eax, dx
xor al, 0xf9
adc bl, al
xlatb
pop edi
adc byte [eax - 0x20], 0xa9
pop eax
jo 0x56ebcd
retf
je 0x56ec80
cmp cl, dl
inc edi
cmc
or byte [eax - 0x764182a8], cl
call 0xb8988be
pop ss
pop edi
retf
mov cl, 0x5a
sub al, dh
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x17261762
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x35f000e6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x65b1c6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov dword [0x6cec84], 0xe1d
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x65b3d8
jmp 0x65b27a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x24], eax
mov word [ebp - 0x26], dx
mov word [ebp - 0x28], di
jb 0x65b23f
mov ax, word [ebp - 0x26]
mov word [ebp - 0x28], ax
mov ax, word [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2], ax
sete bl
add edx, 1
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x2c]
cmp edx, esi
setb bh
and al, bh
test al, 1
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x1c], edx
jne 0x65b20b
jmp 0x65b370
mov dword [0x6cec88], 0x9d8
mov dword [0x6cec84], 0x74a
mov ecx, dword fs:[0x18]
mov dword [0x6cec88], 0x1704
mov dword [0x6cec84], 0x1bee
mov eax, dword [ecx + 0x30]
mov dword [0x6cec88], 0x13ab
mov eax, dword [eax + 0xc]
mov ecx, eax
add ecx, 0x14
mov eax, dword [eax + 0x14]
mov dword [0x6cec84], 0xb65
cmp eax, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
je 0x65b3c9
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov byte [ebp - 0x39], cl
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
jmp 0x65b2f2
mov eax, dword [ebp - 0x40]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x39]
and bh, bl
test bh, 1
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x4c], esi
jne 0x65b323
jmp 0x65b347
mov dword [0x6cec84], 0x2594
mov dword [0x6cec88], 0x21f0
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x65b3d8
mov eax, 0x1516
xor ecx, ecx
mov edx, dword [ebp - 0x48]
mov si, word [edx]
shr si, 1
movzx edi, si
cmp si, 0
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x50], eax
je 0x65b39e
jmp 0x65b20b
mov eax, 0x1c56
mov cl, byte [ebp - 0x2d]
test cl, 1
mov dword [ebp - 0x50], eax
jne 0x65b382
jmp 0x65b39e
mov dword [0x6cec88], 0x1e9d
mov dword [0x6cec84], 0x1cd
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
jmp 0x65b3d8
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x34]
cmp edx, esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x40], edx
jne 0x65b2f2
mov eax, dword [ebp - 0x54]
mov dword [0x6cec84], eax
mov dword [0x6cec88], 0x1e9d
xor eax, eax
mov dword [0x6cec84], 0x1d37
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x65b3e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x6cec8c], 0
mov dword [0x6cec90], 0
mov dword [0x6cec9c], 0
mov dword [0x6cec88], 0x1f51
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x65b589
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x6cec84], 0xe18
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x6cec8c], edx
mov dword [0x6cec88], 0x9fe
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x6cec90], edx
mov dword [0x6cec84], 0xfffff931
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x6cec94], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x6cec88], 0x26b8
mov cl, byte [0x6cec94]
mov edx, dword [0x6cec90]
mov byte [edi + edx], cl
mov edx, dword [0x6cec88]
mov ebx, edx
add ebx, 0x2ee
mov dword [0x6cec84], ebx
mov ebx, dword [0x6cec8c]
movzx ebx, byte [edi + ebx]
mov ecx, dword [0x6cec90]
movzx ecx, byte [edi + ecx]
add ecx, ebx
mov dword [0x6cec84], 0x1bba
and ecx, 0xff
mov dword [0x6cec9c], ecx
mov cl, byte [edi + ecx]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov ch, byte [ebx + esi]
mov bl, cl
add bl, byte [0x6ceca1]
mov byte [0x6ceca0], bl
mov byte [0x6ceca1], ch
mov byte [0x6ceca2], cl
xor ch, cl
add edx, 0x1245
mov dword [0x6cec84], edx
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [0x6cec84]
add edx, 0xc87
mov dword [0x6cec84], edx
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x38], esi
je 0x65b589
mov eax, dword [0x6cec8c]
mov ecx, dword [0x6cec90]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x65b446
mov dword [0x6cec88], 0x17fb
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x65b59b
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [0x6cec84], 0x1b1e
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [0x6cec88], 0x26bb
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
jmp 0x65b5f9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2], 0x61
je 0x65b65a
jmp 0x65b6dc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x65b626
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x65b5f9
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x65b6dc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x18]
mov word [ebp - 0x22], dx
mov ax, word [ebp - 0x22]
cmp ax, 0x6f
je 0x65b5db
jmp 0x65b6dc
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2], 0x64
jne 0x65b6dc
mov dword [0x6cec88], 0xcb4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x65b6dc
mov dword [0x6cec88], 0x1ac7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x65b6dc
mov dword [0x6cec84], 0xfffffca7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
cmp ax, 0x6c
jne 0x65b6dc
mov eax, 1
mov dword [0x6cec84], 0xffffe8ea
mov dword [ebp - 0x30], eax
jmp 0x65b6eb
xor eax, eax
mov dword [0x6cec88], 0x888
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add esp, 0x30
pop ebp
ret
Function at 0x65bba5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x6608ac]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x6cec84], 0xfffff9f4
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.0065c23b
mov dword [0x6cec84], 0x1613
call fcn.0065c17b
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.0065b894
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x65bcc6
mov eax, dword [ebp - 0x3c]
mov dword [0x6cec84], 0x748
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.0065c758
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov dword [0x6cec84], 0x624
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x28], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x54], ecx
mov dword [0x6cec88], 0x2425
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x65bcc6
mov eax, dword [ebp - 0x44]
add eax, 0x24b8
mov dword [0x6cec84], 0x1f4e
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
jmp 0x65bcc6
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop edi
pop ebp
ret
Function at 0x65be7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x6cec84], 0x25e3
mov dword [0x6cec88], 0x250a
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x65bf67
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x140]
lea edx, section..data
imul esi, eax, 0x110
mov edi, edx
add edi, esi
add edi, 0xa8
mov esi, dword [edi]
imul edi, eax, 0x110
mov ebx, edx
add ebx, edi
add ebx, 0x10
mov edi, dword [ebx]
imul ebx, eax, 0x110
add edx, ebx
add edx, 0xa4
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], edx
call fcn.0065ba0f
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
add eax, ecx
mov edx, dword [ebp - 0x148]
add edx, 1
cmp edx, 0x657
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], edx
je 0x65c06a
jmp 0x65bebd
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0x110
mov edi, edx
add edi, esi
add edi, 0xa8
mov esi, dword [edi]
imul edi, eax, 0x110
add edx, edi
add edx, 0xa4
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x657
mov ecx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x65bf67
lea eax, [0x6608ac]
mov ecx, 0xe
lea edx, [ebp - 0x12c]
mov dword [0x6cec84], 0x1dbf
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x15c], ecx
call fcn.0065c23b
mov dword [0x6cec84], 0x1613
call fcn.0065c17b
mov dword [esp], eax
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], eax
call fcn.0065b894
mov dword [0x6ceca4], eax
mov dword [0x6cec84], 0x1799
mov ecx, esp
mov edx, dword [ebp - 0x154]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 4
mov dword [ecx + 8], 0x1000
mov dword [ecx], 0
call eax
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x13c], ecx
jmp 0x65bebd
lea eax, [0x6608ba]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x6cec84], 0x3cc
mov dword [0x6cec88], 0x1e27
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.0065c460
mov dword [0x6cec84], 0x7b4
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x154]
mov dword [esp + 0xc], edx
call fcn.0065b3e3
xor eax, eax
mov ecx, dword [ebp - 0x144]
add ecx, 0x10d61b
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x143800
mov ecx, dword [ebp - 0x144]
add ecx, 0xe56a7
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x1f30
mov dword [0x6cec84], 0xa29
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x65c460
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x6cec90], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov byte [0x6cec94], 0
mov dword [0x6cec84], 0xd7
mov dword [0x6cec8c], 0
mov dword [ebp - 0x1c], eax
jmp 0x65c4b8
xor eax, eax
mov dword [0x6cec8c], 0
mov dword [ebp - 0x20], eax
jmp 0x65c4ef
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x6cec88]
add eax, 0xfffff809
mov dword [0x6cec84], eax
mov eax, dword [0x6cec8c]
add eax, 1
mov dword [0x6cec8c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x65c4b8
jmp 0x65c4a7
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x6cec98], 0
mov dword [0x6cec88], 0x69c
mov edx, dword [0x6cec90]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x6cec98], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x6cec90], edx
mov dword [0x6cec84], 0x1aca
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x6cec94], cl
mov dword [0x6cec84], 0x24a1
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x6cec94]
mov edx, dword [0x6cec90]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x6cec84], 0x17ba
mov edx, dword [0x6cec8c]
add edx, 1
mov dword [0x6cec8c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x65c4ef
mov dword [0x6cec84], 0x19d
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x65c5bc
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov dword [0x6cec88], 0xdcc
call fcn.00401079
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
jne 0x65c74d
lea eax, [esp + 0x40]
mov dword [0x6cec84], 0x8f5
mov ecx, dword [0x6cec88]
add ecx, 0x14ca
mov dword [0x6cec88], ecx
mov dword [esp + 0x28], eax
call fcn.0065b59b
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x65c745
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0065be7f
lea ecx, [0x65bcd0]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x88], edx
mov dword [esp + 0x40], 0x143800
mov dword [0x6cec84], 0xa58
mov edx, dword [0x6cec70]
mov dword [esp + 0x78], edx
mov edx, dword [0x6cec74]
mov dword [esp + 0x58], edx
mov edx, dword [0x6cec78]
mov dword [esp + 0x4c], edx
mov edx, dword [0x6cec7c]
mov dword [esp + 0x64], edx
mov dword [0x6cec88], 0xfffff8f0
mov edx, dword [0x6cec80]
mov dword [esp + 0x50], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x65c6c3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp dword [eax], 0x4550
je 0x65c6d7
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x65c697
lea eax, [esp + 0x40]
add eax, 8
mov dword [esp + 0xc], eax
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov esi, dword [esp + 0x14]
mov edi, dword [edx + esi + 0x50]
mov dword [esp + 0x8c], edi
mov dword [0x6cec84], 0x22cb
mov dword [0x6cec88], 0xa7d
mov edi, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.0065bba5
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x6cec88], 0x10cf
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x65c89c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 8]
mov dword [0x6cec84], 0xffffff8f
mov dword [ebp - 0x10], eax
call fcn.0065bd27
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x6cec88], 0x460
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x6cec84], 0x1e54
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x65ca03
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
je 0x65c98c
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], ch
mov al, byte [ebp - 0x4d]
test al, 1
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
jne 0x65c92e
jmp 0x65c98c
mov al, byte [ebp - 0x46]
test al, 1
jne 0x65c9ca
jmp 0x65c995
mov eax, dword [ebp - 0x38]
add eax, 2
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
xor eax, eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x18]
cmp ecx, edx
mov esi, dword [ebp - 0x54]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], eax
jb 0x65c914
jmp 0x65ca03
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov dword [0x6cec84], 0x1812
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
add eax, dword [ecx + edx*4]
mov dword [0x6cec88], 0xaf2
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret