joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b51d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x54aba1
call fcn.0054565c
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x25
ja 0x50b739
adc dword [eax + 0x453585a2], ecx
daa
push edx
fcom dword [esi - 2]
mov word [eax + 0xb19ed3c], es
inc edx
and ah, ch
cmpsd dword [esi], dword es:[edi]
mov al, 0x56
adc al, 0xf6
outsd dx, dword [esi]
pop ecx
mov dword [eax + 0x13], esp
add eax, dword [edi]
lodsd eax, dword [esi]
sbb dword [esi - 0x6a], ebp
shr dword [edx + 0x29], cl
or al, 0x2e
adc dword [ebp + 0x2c], edi
mov dh, 5
inc esp
xor dl, ch
push esi
sbb dword [0x139205e], 0xffffffe5
xor al, 0x41
pop ecx
invalid
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.0050a43e
test al, al
je 0x50b752
mov al, 1
jmp 0x50b7a1
cmp dword [esi], 0
jne 0x50b75b
xor al, al
jmp 0x50b7a1
push ebx
push 0xc
call fcn.0041beb3
pop ecx
mov dword [ebp + 0xc], eax
and dword [ebp - 4], 0
test eax, eax
je 0x50b77e
lea ecx, [esi + 4]
push ecx
mov ecx, eax
call fcn.0040eba9
mov ebx, eax
jmp 0x50b780
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
push 0
mov ecx, edi
call fcn.004e5e65
push dword [ebp + 0x10]
mov eax, dword [edi + 0xc]
push edi
push dword [ebp + 8]
mov dword [eax], ebx
mov ecx, dword [esi]
call fcn.0050b51d
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x50d8b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push dword [ebp + 8]
mov edi, ecx
push edx
push esi
push esi
call fcn.00436655
add esp, 0x18
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x68
ja 0x50dae1
add bl, al
and al, 0x77
invalid
cmp dword [edi], esi
jne 0x50daec
call fcn.0050d693
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x50e4ed
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x41
ja 0x50e701
adc eax, dword [ebx - 0x1423467a]
dec ebx
mov ah, 0x4e
test eax, 0x35c9b00e
mov ecx, 0x1eb91802
inc esi
cmp eax, ebp
fisubr dword [esi - 0x6580bb97]
push ebp
scasd eax, dword es:[edi]
imul esi, dword [ecx - 0xf70ee80], 0x51e899ea
mov dword [edi + 0x4d], 0x643ed219
pop ds
push ss
test eax, 0xa1a68ebc
sbb edi, esp
invalid
test edi, edi
jle 0x50e737
push edi
push 8
push esi
call fcn.0041b930
add esp, 0xc
add esi, edi
test edi, edi
jle 0x50e737
push edi
push 0x20
push esi
call fcn.0041b930
add esp, 0xc
add esi, edi
test edi, edi
jle 0x50e737
push edi
push 8
push esi
call fcn.0041b930
add esp, 0xc
add esi, edi
pop edi
mov byte [esi], 0
pop esi
ret
Function at 0x50e73d
Capabilities:
Check for time delay via gettickcount

Disassembly:
xor dl, byte [edi + 0x6a]
or byte [esi - 0x18], dl
and dl, dl
lock inc dword [ebx - 0x8fcf33c]
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x38
ja 0x50e94f
jnp 0x50e7a6
or edx, dword [edi]
mov esp, cs
in al, 9
adc eax, 0x5ea1eb6d
inc edi
popal
loop 0x50e704
invalid
push ebp
lcall 0x98a8, 0x7b2e3d53
cmp eax, 0x98a87b2e
push eax
mov esi, 0x88b5b71d
sbb bl, bh
mov ss, word [ecx + 1]
mov eax, 0x2d4a372d
and dword [eax - 0x205c4554], ebx
mov bl, 0x4d
xor dword [esi - 0x2187e184], ebx
mov esi, 0x7b3779c
cmpsb byte [esi], byte es:[edi]
loop 0x50e7e4
dec eax
inc esp
out 0x94, eax
cld
imul esp, dword [ebx + 0x25], 0xa0937b80
sub ch, byte [ebx + 0x37]
cdq
int 0x12
rcr dword [edx + 0x21], 1
cdq
cld
loopne 0x50e7a3
xchg esi, eax
jmp dword [edi]
mov edi, dword [esi]
add edi, dword [esi + 8]
mov eax, dword [esi + 4]
adc eax, dword [esi + 0xc]
mov edx, dword [esi + 0x14]

Function at 0x510e9f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x18
ja 0x5110b4
xor eax, 0xdf972a8b
subps xmm1, xmmword [ebx]
cmpsb byte [esi], byte es:[edi]
invalid
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5110d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5110d5
xor al, al
jmp 0x5110e9
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
xor ecx, ecx
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x511ccf
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3e
ja 0x511ee1
push ecx
test edx, esi
cmp eax, 0x24870f96
das
lcall 0x4057, 0x90a9db23
mov ecx, 0x23d826df
push eax
or al, 0xc0
ficom dword [0xa069e73f]
xor al, 0x7b
xchg ecx, eax
mov esp, 0xd634a165
xor al, 0xd6
push edx
imul esi, dword [edx - 0x65], 0xc91101c5
pop ebx
sub dword [edx], esp
inc eax
out 0xe1, al
push esi
cmp bh, byte [ebx - 0x22]
jae 0x511d06
xchg ebp, eax
pop edx
fisttp qword [ebp - 0x3a]
hlt
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x511eec
and dword [esi], 0
mov ecx, dword [ebp + 0x10]
xor eax, eax
inc eax
test ecx, ecx
je 0x511f22
mov eax, 0x8000
cmp ecx, eax
push 0
cmovb eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x511f22
mov ecx, dword [ebp - 4]
add dword [esi], ecx
test eax, eax
setne cl
call fcn.00511a96
pop esi
Function at 0x511f31
Capabilities:
Write file on windows

Disassembly:
add byte [ebx], bh
enter 0x6a, 0xf
inc edx
ror dword [ebp + 0x5051fc4d], 0xff
jne 0x511f16
rcl byte [eax + eax - 0x7b]
div byte [ebp + eax - 0x75]
dec ebp
cld
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x39
ja 0x512142
jl 0x511efa
loop 0x511f8b
shufps xmm0, xmmword [esi + 0x551ee10b], 0x5a
invalid
sal byte [ecx + 0x17959b6e], cl
outsb dx, byte [esi]
inc ecx
dec ebp
pop ds
jge fcn.00511f2d
cmpsd dword [esi], dword es:[edi]
invalid
mov ecx, dword [ebp + 8]
push dword [ebp + 0xc]
lea ecx, [ecx + 8]
call fcn.00510e9f
mov cl, al
call fcn.00511a96
pop ebp
ret 8

Function at 0x512dac
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov al, byte [0x82310c37]
inc ecx
and dword [ecx + 0x2262469b], ebx
inc esi
bound esp, qword [edx]
push ebx
pop ebp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x47
ja 0x512fbd
pushfd
cmp eax, 0x52450def
mov ebp, 0x914d55b5
sub edx, dword [edi + 0x59]
jne 0x512d72
mov edi, 0x7ed49deb
add ebx, dword [ecx - 0x31502baa]
dec ebp
shl byte gs:[edi], 1
dec esp
nop
and byte [eax], cl
jae 0x512ddf
je 0x512d69
invalid
lea ecx, [esi + 8]
call int.005110ee
mov cl, al
pop esi
jmp fcn.00511a96
Function at 0x5151e5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x54ad88
call fcn.0054565c
sub esp, 0xc
push ebx
or al, 0x53
push esi
push edi
mov dword [ebp - 0x18], ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5b
ja 0x515408
jl 0x5151f1
lodsb al, byte [esi]
inc dword [0x5c699b25]
cwde
sbb byte [eax - 0x49a3e36e], dh
dec ecx
fidivr dword [ebx + 0x291b190f]
jo 0x515254
pop ebp
invalid
lahf
iretd
insb byte es:[edi], dx
pop edx
add byte [ecx - 0x1b], dh
jno 0x51523b
mov bx, 0xece1
adc dword [edx], 0xc998f24
mov dl, 0xb1
andps xmm3, xmmword [edx]
cmc
or eax, 0x1adef73d
add ebx, dword [edi]
xor al, 0xeb
push esp
sbb eax, 0xe20e7ca9
mov esp, 0xdeb74b60
push esi
wait
jbe 0x515251
sbb al, 0x90
cli
pop esp
mov byte [eax - 0x792bec2c], al
aas
xchg esi, eax
cmp cl, dl
push edi
out 0xc0, eax
add al, byte [ebp + 0x3e395613]
adc bl, byte [esi]
iretd
xor esi, esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], esi
xor edi, edi
mov dword [ebp - 0x14], edi
cmp byte [ebp + 0x10], 0
mov byte [ebp - 4], 1
je 0x515446
push 8
call fcn.0041beb3
pop ecx
test eax, eax
je 0x515436
and dword [eax + 4], edi
mov dword [eax], vtable.CStdInFileStream.0
jmp 0x515438
xor eax, eax
push eax
lea ecx, [ebp - 0x14]
call fcn.0040ddf6
mov edi, dword [ebp - 0x14]
jmp 0x51549e
push 0x10
call fcn.0041beb3
mov esi, eax
pop ecx
test esi, esi
je 0x515472
mov dword [esi + 4], vtable.IStreamGetSize.0
and dword [esi + 8], 0
mov dword [esi], vtable.CInFileStream.0
mov dword [esi + 4], vtable.CInFileStream.1.0
or dword [esi + 0xc], 0xffffffff
jmp 0x515474
xor esi, esi
push esi
lea ecx, [ebp - 0x10]
call fcn.0040ddf6
mov eax, dword [ebp - 0x18]
mov ecx, esi
push dword [eax + 4]
call fcn.0051241e
test al, al
jne 0x515499
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x10]
jmp 0x5154b1
mov esi, dword [ebp - 0x10]
mov ebx, esi
push dword [ebp + 0x18]
mov ecx, dword [ebp - 0x18]
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005154e2
mov ebx, eax
mov byte [ebp - 4], 0
test edi, edi
je 0x5154c1
mov eax, dword [edi]
push edi
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x5154cf
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14
Function at 0x519d9f
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x519b54
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x519b54
push ebp
mov ebp, esp
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x36
ja 0x519fb3
cld
pop edi
test byte [0x310dec96], dl
pop esi
js 0x519dbb
or eax, 0xfb785e31
in al, dx
fadd dword [esi + 0x18]
sub eax, 0x7fcaf2ad
sbb eax, edx
pop es
jns 0x519e21
jmp 0x519d72
xchg ebx, eax
mov byte [0x2c644463], al
or ebx, eax
rcl dword [esi + 0x65], cl
popal
and esp, dword [esi]
hlt
Function at 0x51a23c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x67
ja 0x51a453
lds ecx, [ecx - 0x5c7a20df]
pop es
int 0x15
and al, byte [ecx + 0x3e]
test al, 0xfb
hlt
push dword [ebp + 8]
mov edx, esi
mov ecx, edi
call fcn.0051a46c
pop ecx
mov ecx, edi
pop edi
mov edx, esi
pop esi
pop ebp
jmp int.0051a69f

Function at 0x51c44f
Capabilities:
Check for time delay via gettickcount

Disassembly:
imul edi, dword [ebx], 0x7d8fbd97
test ecx, ebp
nop
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp eax, 0x4a
ja 0x51c666
xchg edi, eax
inc ebp
loop 0x51c4b0
fst dword [eax + 0x105c0406]
scasb al, byte es:[edi]
rcl ebp, cl
xor ah, al
mov ah, 0x11
and byte [ecx + 0x34], dh
cmp eax, esi
insb byte es:[edi], dx
inc ecx
push esp
sbb bh, byte [eax - 0xbcff2c4]
dec edi
mov dh, 0xc9
cmpsb byte [esi], byte es:[edi]
add dword [esi + 0x3f0795bf], ecx
lcall 0x96bf, 0x4bab5d73
call 0x89c3aeba
ljmp 0x1dea
sub ah, byte [ebp - 0x61]
sahf
dec edi
push ds
cmp al, 0xb5
jnp 0x51c43d
invalid
lea eax, [ebp - 0x10]
Function at 0x51fadc
Capabilities:
Authenticate hmac

Disassembly:
inc edi
or al, 0x8d
dec ebp
loopne 0x51faa8
xor al, 0xb0
mov eax, 0x54b19f
call fcn.0054565c
sub esp, 0x24
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x37
ja 0x51fcfb
lodsd eax, dword [esi]
adc dl, byte [eax]
jg 0x51fb2c
mov cl, 0x30
jno 0x51faa3
mov bh, 0x3b
xor dh, bl
xor al, 0x99
fucom st(7)
mov eax, 0x5b652927
sub al, 0x90
str word [esi + 0x46db1bb0]
int1
pushal
xor dword [ecx], edx
push 0xfb685fb0
imul ebx, dword [esi], 0x547c6b3
mov edx, 0x5c507cbe
jl 0x51fb7e
pop esp
xchg esp, eax
add ebx, edi
sbb ebp, 0x31
adc byte [edi + 0x6f], 0x8d
jae 0x51faed
push cs
loope 0x51fb62
aam 0x48
xchg ecx, eax
cmp ebx, dword [ecx - 0x63]
sub al, 0xdb
push 0x2c2641e3
jmp 0x5bd9fbc4
jmp 0xc1c90c06
inc ebp
or al, 5
pushfd
add dword [eax + 0x3c], ecx
jns 0x51fbaf
xlatb
lds esi, [ebp - 0x59]
cmp eax, 0x1865c92a
lcall 0xf9c3, 0x824a31b4
pop edx
pop ebp
dec edi
cmp al, 0x18
int3
sahf
out 0x2e, eax
test al, 0x36
invalid
xor edi, edi
cmp dword [esi + 8], edi
jle 0x51fd9a
push ebx
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x18]
mov ebx, dword [eax + edi*4]
mov edx, ebx
call fcn.0051fda8
and dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.0040ebec
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x18]
call fcn.00418a9a
cmp dword [ebx + 4], 0
pop ecx
jne 0x51fd42
mov eax, dword [esi]
push 1
push edi
mov ecx, esi
call dword [eax + 4]
jmp 0x51fd90
mov ecx, ebx
call fcn.0051fffc
test al, al
jne 0x51fd8f
push 0x5597bc
lea ecx, [ebp - 0x30]
call fcn.0040e479
push ebx
mov edx, eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 1
call fcn.00410f71
pop ecx
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0040ebec
push dword [ebp - 0x24]
call fcn.00418a9a
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x30]
call fcn.00418a9a
pop ecx
pop ecx
inc edi
cmp edi, dword [esi + 8]
jl 0x51fd07
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x52029e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 1
ja 0x5202cb
dec ecx
loope 0x52032d
aad 0xd3
aaa
sbb dword [esi - 0x27ae41c1], ebx
xor dword [ecx - 0x39], ecx
insd dword es:[edi], dx
invalid
xor eax, eax
mov esi, eax
cmp word [ebx], ax
je 0x5202db
inc esi
cmp word [ebx + esi*2], ax
jne 0x5202d4
cmp dword [edi + 4], esi
jle 0x520322
push esi
lea eax, [ebp - 0xc]
push eax
mov ecx, edi
call fcn.00410b39
mov ecx, dword [eax]
mov edx, ebx
call fcn.004c4983
push dword [ebp - 0xc]
test eax, eax
setne bl
call fcn.00418a9a
pop ecx
test bl, bl
jne 0x520322
mov eax, dword [edi]
movzx eax, word [eax + esi*2]
add eax, 0xffffffd0
cmp ax, 9
ja 0x520322
lea edx, [esi + 1]
mov ecx, edi
call fcn.00520329
jmp 0x520324
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
add al, ch
sub dword [ebx + 2], edx
add byte [ebx + 0x57560cec], al
Function at 0x5249b6
Capabilities:
Check for time delay via gettickcount

Disassembly:
inc dword [ecx + 0x14]
inc dword [ecx]
inc dword [ecx + 4]
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je fcn.005252ec
ret

Function at 0x5252ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x1c
ja 0x5254fd
mov eax, dword [ebp + 0x2a]
hlt
cmp dword [esi + 4], 0xffffffff
jne 0x52550a
mov ecx, esi
call int.00525536
cmp dword [esi + 0x38], 0
jne 0x525522
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp dword [esi + 0x44], eax
jne 0x525522
mov ecx, esi
call fcn.00526513
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x52552e
and dword [esi + 0x14], 0
mov ecx, esi
pop esi
jmp 0x525e14
push ebx
push esi
mov esi, ecx
push edi
mov ebx, dword [esi + 0x18]
sub ebx, dword [esi + 0x14]
or edi, 0xffffffff
sub edi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x31
ja 0x526033
sbb dword [ecx + edx*2 - 0x2e], ecx
dec esi
into
movsd dword es:[edi], dword [esi]
xchg edx, eax
and al, 0x51
dec ebp
cmp dword [esi - 0x33ce3ba0], eax
inc edx
cmp al, 0xad
in eax, dx
jnp 0x525e7a
invalid
invalid
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0xc]
cmp ebx, edi
cmovb edi, ebx
sub ecx, edx
mov eax, ecx
cmp eax, dword [esi + 0x44]
ja 0x526050
test eax, eax
je 0x526053
xor eax, eax
inc eax
jmp 0x526053
sub eax, dword [esi + 0x44]
cmp eax, edi
cmovb edi, eax
cmp ecx, dword [esi + 0x1c]
lea eax, [edx + edi]
cmova ecx, dword [esi + 0x1c]
pop edi
mov dword [esi + 0x10], ecx
mov dword [esi + 8], eax
pop esi
pop ebx
ret

Function at 0x525536
Capabilities:
Check for time delay via gettickcount

Disassembly:
inc esi
inc esp
push esi
push edi
mov esi, ecx
call fcn.005259a4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x11
ja 0x52574f
jno 0x525517
sahf
add eax, 0x2ec71eaa
mov byte [edx + 0x62e21f95], bh
xchg ebp, eax
pop ds
loop 0x5255c0
mov esp, 0x82042e8c
ja 0x52555a
pop eax
iretd
shr byte [eax], cl
out 0xd5, eax
cmp dh, byte [eax - 0x30]
sbb byte [ebp - 0x4c483c92], dh
daa
ret
mov ecx, dword [esi + 0x68]
add ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x20]
push ecx
mov ecx, edi
call fcn.0052576c
pop ecx
mov edx, edi
pop edi
mov ecx, esi
pop esi
jmp fcn.00527059

Function at 0x525bc3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
in al, dx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x4e
ja 0x525dd4
jmp 0x525bc5
push esi
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, edx
cmp dword [esi + 0x64], edx
jbe 0x525ded
mov eax, dword [esi + 0x20]
mov dword [eax + ecx*4], edx
inc ecx
cmp ecx, dword [esi + 0x64]
jb 0x525de1
mov eax, dword [esi + 0x30]
mov dword [esi], eax
mov eax, dword [esi + 0x18]
mov ecx, esi
mov dword [esi + 0x14], edx
mov dword [esi + 0xc], eax
mov dword [esi + 4], eax
mov dword [esi + 0x6c], edx
mov dword [esi + 0x38], edx
call fcn.00526dcb
mov ecx, esi
pop esi
pop ebp
jmp 0x525e14
Function at 0x526513
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x64
ja 0x526724
sbb eax, 0xbfc63bae
jae 0x526559
insd dword es:[edi], dx
xchg ebp, eax
aam 0x9f
xchg esp, eax
in eax, 0xd0
sub ebp, eax
daa
rcl dword [0x13781471]
xlatb
call [ebp - 0x6d97d8d2]
invalid
invalid
sti
jns 0x526549
mov bl, 0x2b
fadd dword [edx - 0x61]
jmp 0x5265b2
mov cl, 0x36
mov dword [0x88966228], ebx
jbe 0x5265ca
adc esp, edx
cdq
into
xchg ebx, eax
dec eax
lea eax, [edx - 0x77]
lodsb al, byte [esi]
retf 0xdb8d
wbinvd
int3
mov ecx, esi
call fcn.0052696a
test eax, eax
je 0x526736
mov ecx, esi
call int.00526b95
mov ecx, esi
pop esi
jmp fcn.00526dcb

Function at 0x52673e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x57
ja 0x52694f
adc byte gs:[esi + 0x33a2a852], bh
mov ch, 0x7b
jb 0x526781
shl esi, 0x35
ret 0x96a3
mov word [eax - 6], fs
wait
pop ebp
pop ebp
test dword [eax], 0xb485f229
pop edi
jmp 0x526798
test dword [edi + ebx*2 + 0x55ef11eb], esi
dec ebp
pop ecx
pop es
ja 0x526778
mov esp, 0xb432a477
pop edx
aad 0x4c
mov eax, dword [0xc8660026]
add byte [esi - 0x38], ah
xchg esi, eax
cmp al, 0x49
wait
call 0x498d97c9
sbb dl, 0x3b
mov fs, word [0x1324a7de]
aas
inc esp
dec edx
in eax, 0x40
sbb bh, byte [ebp + 0x6e]
jns 0x5267e7
xor al, 0x9e
sub edx, dword [edi - 0x562e5932]
leave
pop ebp
not dword [ebx + 0x114fe334]
test byte [bp + si], al
jns 0x5267bd
shr dword [ecx - 0x6c08a237], 1
xor al, 0xe3
dec edi
adc dword [edi - 0x7c], esp
add bh, byte [ecx - 0xf]
fild word [ebx + edi*8 - 0x2e]
inc edi
sub esp, dword [edi]
jmp 0x52683e
pop ebp
retf 0x1c73
jecxz 0x526823
popal
fst dword [esi + 0x22]
and ch, byte [eax + 0x77]
xchg edx, eax
pushfd
jecxz 0x52677e
push cs
dec ebx
cmpsd dword [esi], dword es:[edi]
pop es
jnp 0x52678e
pop eax
xchg edx, eax
inc eax
push esi
sub eax, 0xad4ec3a5
jle 0x526874
jecxz 0x526872
push cs
movsb byte es:[edi], byte [esi]
into
cmp esp, dword [esi]
add byte [edx], dl
lea edi, [edx]
push edi
inc ebx
movsb byte es:[edi], byte [esi]
inc eax
mov al, byte [0x5b884a9b]
out dx, al
invalid
or cl, byte [ecx + 0x67]
out dx, al
leave
jae 0x52688b
mov byte [ecx], dh
pop es
test dword [ecx - 0x7551ff], edi
jne 0x5267fd
and dh, dl
fstp xword fs:[edi + 0x26]
push 0x3f76ab2e
stosd dword es:[edi], eax
jbe 0x526880
xchg esp, eax
neg byte [ebp + 0x71]
xchg dh, al
cmp dh, byte [ebx]
jne 0x5267e3
and eax, 0x26455e8c
mov dh, 0x9f
test byte [edi + eax*8 - 0x6edf4ef7], ah
int 0x23
invalid
dec esi
sbb esp, ebx
invalid
jecxz 0x5268a4
invalid
insd dword es:[edi], dx
lodsb al, byte [esi]
retf
invalid
in eax, dx
pop ebp
in eax, dx
pop ebx
inc ecx
outsd dx, dword [esi]
in eax, dx
dec esp
fsubr dword [ebx + 0x6ff52a79]
and dword [ecx + 0x576815be], ebx
add eax, 0xd566c0fd
sal dword [ebp + 0x680e4a6e], 1
pop ebp
cmpsb byte [esi], byte es:[edi]
sar byte [edi], 0x50
mov byte [0x2b6db8d], al
hlt
cmp dword [esi + 0x38], 0
jne 0x526968
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp dword [esi + 0x44], eax
Function at 0x527589
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x13
ja 0x52779b
push cs
mov al, byte [ecx - 0x3acd33b]
sbb dword [edx], ebp
scasb al, byte es:[edi]
sub cl, byte [ecx]
mov cs, word es:[ecx - 0x4e]
pushal
mov dword [ebp + edi*8 + 0x69ad7ea6], esp
invalid
xor esi, esi
mov ecx, edi
mov dword [edi + 0x30], esi
mov dword [edi + 0x4c], esi
mov dword [edi + 0x20], esi
call fcn.005264c1
add edi, 0x70
push 8
mov ecx, esi
pop edx
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
shr ecx, 1
xor ecx, eax
dec edx
jne 0x5277b5
mov dword [edi], ecx
inc esi
add edi, 4
cmp esi, 0x100
jb 0x5277b0
pop edi
pop esi
ret
Function at 0x52eb1e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x66
ja 0x52ed33
push esp
add byte [ebx - 0x78f09908], al
inc dword [ecx]
add byte [eax], al
aad 5
cmp dword [esi], edi
jl 0x52eb87
out dx, eax
mov esi, 0x77c6b062
mov dh, 0x72
test byte [esi + 0x7f], ch
dec edi
xchg edi, edx
xor byte [ebp + 0x727c7afc], bh
push edx
pop esp
imul esp, dword [esi], 0xffffffee
pushfd
scasb al, byte es:[edi]
lcall 0x5f57, 0xd9309b21
in eax, dx
mov ebp, 0xb6073a91
adc eax, 0x63c716a6
je 0x52eb29
shr dword [esi - 0x75], 1
adc al, 0xff
cdq
out dx, al
test bh, ah
scasb al, byte es:[edi]
imul esp
mov ebp, dword [eax + 0x17]
call 0x598a5545
inc edx
invalid
dec ecx
ljmp 0x9e26
mov edx, dword [edi]
mov esi, dword [ebp + 8]
cmp esi, edx
jbe 0x52ed74
cmp edx, 0x40
jbe 0x52ed48
mov eax, edx
shr eax, 2
jmp 0x52ed55
push 8
pop eax
cmp eax, edx
sbb eax, eax
and eax, 0xc
add eax, 4
add eax, edx
cmp eax, esi
cmova esi, eax
push esi
push dword [edi + 4]
call fcn.00427414
pop ecx
pop ecx
test eax, eax
jne 0x52ed6f
xor al, al
jmp 0x52ed76
mov dword [edi + 4], eax
mov dword [edi], esi
mov al, 1
pop edi
pop esi
pop ebp
ret 4
Function at 0x5319f2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop edi
pop esi
pop ebx
pop ebp
ret
inc dword [ebx - 0x3f7aef3c]
jne 0x5318f1
mov edx, dword [edi + 0x28]
mov ecx, dword [ebx + 0x28]
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.004c4983
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x66
ja 0x531c05
jl 0x5319d7
scasb al, byte es:[edi]
cmp eax, 0x846ca5fc
loope 0x531a19
inc edi
sbb esi, ebp
rol eax, 0xc
inc eax
mov byte [eax + 5], bh
xor bl, byte [ebp + 0x39]
jge 0x531a41
add eax, 0x36395d32
jge 0x531a41
cmp cl, byte [esi + 0x309f61a4]
invalid
arpl word [ecx + 0x2f31c6b9], ax
test eax, 0x72cdd44e
inc eax
push ecx
lahf
pushal
invalid
mov al, byte [str._lzma_7z_ace_arc_arj_bz_bz2_deb_lzo_lzx_gz_pak_rpm_sit_tgz_tbz_tbz2_tgz_cab_ha_lha_lzh_rar_zoo_zip_jar_ear_war_msi_3gp_avi_mov_mpeg_mpg_mpe_wmv_aac_ape_fla_flac_la_mp3_m4a_mp4_ofr_ogg_pac_ra_rm_rka_shn_swa_tta_wv_wma_wav_swf__chm_hxi_hxs_gif_jpeg_jpg_jp2_png_tiff__bmp_ico_psd_psp_awg_ps_eps_cgm_dxf_svg_vrml_wmf_emf_ai_md_cad_dwg_pps_key_sxi_max_3ds_iso_bin_nrg_mdf_img_pdi_tar_cpio_xpi_vfd_vhd_vud_vmc_vsv_vmdk_dsk_nvram_vmem_vmsd_vmsn_vmss_vmtm_inl_inc_idl_acf_asa_h_hpp_hxx_c_cpp_cxx_rc_java_cs_pas_bas_vb_cls_ctl_frm_dlg_def_f77_f_f90_f95_asm_sql_manifest_dep__mak_clw_csproj_vcproj_sln_dsp_dsw__class__bat_cmd_xml_xsd_xsl_xslt_hxk_hxc_htm_html_xhtml_xht_mht_mhtml_htw_asp_aspx_css_cgi_jsp_shtml_awk_sed_hta_js_php_php3_php4_php5_phptml_pl_pm_py_pyo_rb_sh_tcl_vbs_text_txt_tex_ans_asc_srt_reg_ini_doc_docx_mcw_dot_rtf_hlp_xls_xlr_xlt_xlw_ppt_pdf_sxc_sxd_sxi_sxg_sxw_stc_sti_stw_stm_odt_ott_odg_otg_odp_otp_ods_ots_odf_abw_afp_cwk_lwp_wpd_wps_wpt_wrf_wri_abf_afm_bdf_fon_mgf_otf_pcf_pfa_snf_ttf_dbf_mdb_nsf_ntf_wdb_db_fdb_gdb_exe_dll_ocx_vbx_sfx_sys_tlb_awx_com_obj_lib_out_o_so__pdb_pch_idb_ncb_opt]
xor edx, edx
inc edx
mov ecx, 0x55e791
jmp 0x531c43
cmp al, 0x20
je 0x531c40
mov esi, edi
mov bl, byte [esi]
inc esi
test bl, bl
jne 0x531c29
test al, al
je 0x531c47
cmp al, 0x20
je 0x531c47
cmp al, bl
jne 0x531c32
mov al, byte [ecx]
inc ecx
jmp 0x531c1a
inc edx
test al, al
je 0x531c47
cmp al, 0x20
je 0x531c40
mov al, byte [ecx]
inc ecx
jmp 0x531c33
mov al, byte [ecx]
inc ecx
test al, al
jne 0x531c14
pop edi
pop esi
mov eax, edx
pop ebx
ret