joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5157a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b5d81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
xor ebx, ebx
push edi
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov edi, 0x659680
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x3c], ebx
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x51581f
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
mov esi, 0x659680
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov esi, dword [esp + 0x40]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
mov dword [esp + 0x40], 1
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x515875
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov edi, dword [ecx + 0xbc]
lea esi, [ecx + 0xb8]
mov ecx, esi
mov edx, dword [edi + 4]
push edx
push edi
call fcn.00518560
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
mov dword [ecx], eax
add eax, 8
push edx
push eax
call fcn.00518590
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add esp, 8
inc edx
mov dword [esi + 8], edx
mov esi, dword [eax + 0xc0]
dec esi
cmp ecx, ebx
je 0x5158ec
mov al, byte [ecx - 1]
cmp al, bl
je 0x5158e2
cmp al, 0xff
je 0x5158e2
dec al
mov byte [ecx - 1], al
jmp 0x5158ec
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x54ad70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b6911
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0054bc10
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], edx
je 0x54ae1b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x54ae12
cmp al, 0xff
je 0x54ae12
dec al
mov byte [ecx], al
jmp 0x54ae1b
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x54ae4c
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x54ae43
cmp al, 0xff
je 0x54ae43
dec al
mov byte [ecx], al
jmp 0x54ae4c
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x656976fa
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x60ba2b75
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40351c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x49f008], 0x8088405
inc edx
mov dword [ebx + 0x49f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4097f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40984a
test eax, edx
je 0x40984d
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40980d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x409833
add ecx, 4
js 0x409823
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x409830
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x409859
test edx, edx
jne 0x409800
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x425a80
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x425a86
ret
Function at 0x4937d0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403b24
ret
Function at 0x499ceb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x499d45
mov eax, ebx
add eax, dword [eax + 0x3c]
mov edi, dword [eax + 0x78]
add edi, ebx
xor esi, esi
jmp 0x499d40
mov eax, dword [edi + 0x20]
lea edx, [ebx + eax]
mov eax, dword [edx + esi*4]
add eax, ebx
push dword [ebp + 0xc]
push eax
call fcn.00407980
test eax, eax
jne 0x499d3f
mov edx, dword [edi + 0x24]
lea ecx, [ebx + edx]
mov ax, word [ecx + esi*2]
movzx edx, ax
mov ecx, dword [edi + 0x1c]
lea eax, [ebx + ecx]
mov eax, dword [eax + edx*4]
add eax, ebx
mov dword [ebp - 4], eax
inc esi
cmp esi, dword [edi + 0x18]
jb 0x499d0c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0xc86467
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0xc8558c
jmp 0xc86316
mov dword [esp + 0x24], eax
jmp 0xc86426
call 0xc8565a
jmp 0xc864e5
mov dword [esp + 0x24], eax
jmp 0xc86677
popal
call 0xc862fa
mov ah, 0xbf
mov eax, dword [esp]
lea esp, [esp + 4]
sub eax, 0x9db242ad
jmp 0xc86348
pushal
jmp 0xc85587
call 0xc86358
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
fcomp dword [ebp + 0xdfe9b0b]
mov ebx, 0x4522ac35
mov ah, 3
and eax, 0xbb4829b9
jge 0xc86385
pushfd
cmp dword [esp + 4], 0
jne 0xc863f8
je 0xc8632c
mov ch, byte [esp]
mov ecx, 0xdf47b12b
mov ecx, dword [esp]
lea esp, [esp + 4]
and al, 0x8d
and al, 4
jmp 0xc863b1
push ebx
jmp 0xc863e0
sub ecx, 0x100176af
jmp 0xc8639b
pushal
mov bh, byte [esp]
mov di, 0xc077
mov di, word [esp]
mov dword [esp + 0x10], ecx
jmp 0xc864b0
popfd
ret
movzx ebx, byte [eax]
add ebx, 0x1351ae0d
cmp ebx, 0x1351aed9
jmp 0xc8640f
je fcn.00c86467
push esi
jne 0xc855fd
jb 0xc86410
add dh, cl
dec ebx
push 0xe8197ee8
sub dword [ebp + reloc.WINMM.dll_midiStreamOpen], eax
popal
push ebx
lea esp, [esp + 4]
popfd
ret
xchg edx, eax
bswap edx
xchg dh, ah
pushfd
push dword [esp + 3]
mov dword [esp], esi
jmp 0xc8648b
lea eax, [edx + ebp]
xchg ah, al
not eax
mov eax, 0x32c739c
push edx
lea edx, [edi + 0xa0]
jmp 0xc8642e
push edi
mov dword [esp], esi
mov word [esp + 1], cx
mov dword [esp], eax
jmp 0xc86444
sete al
lea eax, [ebp*4]
rdtsc
rdtsc
jmp 0xc864fd
mov esi, 0x9ec7243d
xchg edx, esi
mov dh, 0x19
mov eax, dword [esp]
pop esi
setge ah
jmp 0xc86475
popal
lea ebx, reloc.WINMM.dll_midiStreamOpen
mov dword [ebx], eax
pop ebx
jmp 0xc863fa
inc dword [esp + 8]
jmp 0xc866be
mov eax, dword [esp + 0xc]
lea esp, [esp + 0x10]
push 0
pushfd
jmp 0xc86517
pop eax
sub eax, 0x9f920ee4
jmp 0xc86524
mov ax, 0x53f
mov edx, dword [esp + 4]
pushfd
xchg byte [esp], al
lea eax, reloc.WINMM.dll_midiStreamOpen
lea eax, reloc.WINMM.dll_midiStreamOpen
jmp 0xc864d5
cmp dword [esp + 4], 0
jne 0xc864bf
pushal
jmp 0xc85655
call 0xc86536
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
ja 0xc86591
salc
inc esp
and ebx, esi
imul eax, edi, 0x60
pushal
push esp
xchg dword [esp], edi
lea esp, [esp + 4]
jmp 0xc86310
mov ebp, ecx
jmp 0xc86599
lea ebp, reloc.WINMM.dll_midiStreamOpen
mov dword [ebp], eax
pop ebp
jmp 0xc865d0
je 0xc8663d
jne 0xc856b3
pop es
wait
or ebp, dword [esi - 0x63]
pop ebp
outsd dx, dword [esi]
cld
xchg edx, eax
cmc
add al, 0xb5
dec ecx
movzx ebx, byte [eax]
add ebx, 0x8d135b5
cmp ebx, 0x8d13681
jmp 0xc865b7
popfd
ret
mov dword [reloc.WINMM.dll_midiStreamOpen], eax
popal
inc dword [esp + 8]
pushal
lea esp, [esp + 0x20]
jmp 0xc8660e
popfd
ret

Function at 0xc89b01
Capabilities:
Check for trap flag exception

Disassembly:
and al, 4
call 0xc89b32
mov eax, dword [reloc.WINMM.dll_midiStreamOpen]
jmp 0xc89ad6
Function at 0xcb4e54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax + 0x7c]
jmp 0xcb4e5d
mov dword [ebp - 0x18], eax
lea esp, [esp + 4]
je 0xcb4d81
bswap eax
jmp 0xcb4e99
clc
mov ah, 0x5d
cmc
mov eax, dword [esi + 0x20]
sub esp, 0x1d
jmp 0xcb4e83

Function at 0xcb6140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
jmp 0xcb6146
jb 0xcb4cf8
mov cx, 0x8ae
bt ecx, esp
push edx
jmp 0xcb6123
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp eax, esi
jmp 0xcb6103
mov ecx, dword [ebp - 0x18]
sub esp, 0x10
add ecx, esi
jmp 0xcb617a
lea esp, [esp + 8]
jmp 0xcb6119
jne 0xcb4c51
jmp 0xcb4c3b
jb 0xcb4c6f
jae 0xcb4cf8
daa
pushfd
or dword [ebp - reloc.WINMM.dll_midiStreamOpen], 0x5e
or byte [ebp - 0x76db8bb2], al
cmp dword cs:[eax], ebx
cmp eax, ecx
push edi
mov word [esp], cx
lea esp, [esp + 0x18]
jmp 0xcb615c

Function at 0xcb625a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x10]
jmp 0xcb6282
test ebx, ebx
push eax
pop word [esp]
lea esp, [esp + 2]
jmp 0xcb6298
mov byte [esp + 2], dl
lea esp, [esp + 0x24]
jmp 0xcb6244
jl 0xcb4cb1
jge 0xcb4d54
test eax, eax
je 0xcb4cdd
clc
stc
jmp 0xcb62f7
inc esi
cmp esi, ebx
jle 0xcb4d54
jmp 0xcb4cb1

Function at 0xcb62b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop word [esp]
jmp 0xcb4ce2

Function at 0xcd0555
Capabilities:
Encode data using xor

Disassembly:
jmp 0xcd0526
mov edx, dword [esp]
neg dh
jmp 0xcd04ce
mov esi, dword [esp]
lea esi, [ecx + ebp]
jmp 0xcd04da
mov edx, dword [ecx]
cmp edx, eax
jae 0xc71e96
jb 0xcd04b8
mov esi, dword [ecx + 4]
push esi
add esi, edx
clc
jmp 0xcd04e7
cmp eax, esi
call fcn.00cd0544
std
insd dword es:[edi], dx
hlt
lea esp, [esp + 3]
jmp 0xcd056b
mov ecx, dword [ecx + 0x14]
push esp
clc
sub esp, 0x1f
mov byte [esp + 5], ah
jmp 0xcd0510
lea esp, [esp]
jmp 0xcd0576
lea esp, [esp + 0x20]
test ecx, ecx
call fcn.00cd0555
lea esp, [esp + 4]
jne 0xc71f0f
invalid
je 0xcd065a
add al, 0xa6
xor al, 0x53
scasb al, byte es:[edi]
sub dword [edi - 0x42], edx
mov dword [eax], ebp
dec ebx
loop 0xcd057c
xchg ecx, eax
invalid
mov esi, dword [esp]
lea esp, [esp + 4]
ret

Function at 0xf6d1bb
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], edx
push esi
push si
lea esp, [esp + 2]
mov dword [esp + 0x14], ebx
call int.00f6d1c6
jl 0xf6d209
salc
pop word [esp]
push word [esp + 1]
jmp 0xf6d1a5
Function at 0xf6d1e6
Capabilities:
Packed with generic packer

Disassembly:
fimul word [ebx + ebp - 0x1a]
invalid
mov si, word [esp]
mov edi, dword [esp]
call fcn.00f6cd6c
call 0xf6d14e
xor bh, byte [edx + edx*2 + 0x42ac435]
mov dword [ecx], ebx
js 0xf6d0c1
imul ebp, dword [eax - reloc.WINMM.dll_midiStreamOpen], 0xffffff8b
je 0xf6d163
sbb byte [ebp - 0x62e3db9c], cl
lea esp, [esp + 4]
call 0xf6d126
jmp 0xf6d4eb
jmp 0xf6d1dc
push word [esp + 1]
call fcn.00f6d19c
mov dword [esp + 0xa], edx
mov dword [esp + 0x20], ebp
pushfd
push word [esp + 3]
jmp 0xf6d239
push dword [esp]
lea esp, [esp + 7]
mov byte [esp], cl
lea esp, [esp + 3]
mov dword [esp + 0x1c], esi
push si
jmp 0xf6d217
iretd
mov dword [esp + 4], eax
call fcn.00f6d153
in al, dx
outsd dx, dword [esi]
call [edx - 0x7ff56197]
push ss
jno 0xf6d47f
bound esi, qword [ebp + edi - 0x1db84b53]
xchg byte [esi], cl
pushfd
sti
push ss
ret 0xa314
sub esp, 0x19
bswap edi
sub esp, 0x1d
lea esp, [esp + 0x4a]
jmp 0xf6d11a
Function at 0x4026f0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x43100c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax]
mov edi, ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x38], edi
test ebx, ebx
jne 0x40273e
push ebx
push 0x42e35b
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0xf
mov byte [edi], bl
call fcn.00413e60
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00414dac
mov esp, ebp
pop ebp
ret
mov eax, ebx
xor esi, esi
and eax, 3
jne 0x402755
cmp byte [ebx + edx - 1], 0x3d
je 0x402755
xor ecx, ecx
mov dword [ebp - 0x24], ecx
jmp 0x40276f
mov ecx, 1
mov dword [ebp - 0x24], ecx
cmp eax, 2
ja 0x40276d
cmp byte [ebx + edx - 2], 0x3d
jne 0x40276d
xor eax, eax
jmp 0x40276f
mov eax, ecx
sub ebx, ecx
mov dword [ebp - 0x30], eax
and ebx, 0xfffffffc
mov dword [ebp - 0x10], esi
mov ecx, ebx
mov dword [ebp - 0x3c], ebx
shr ecx, 2
push 0
mov dword [ebp - 0xc], 0xf
mov byte [ebp - 0x20], 0
lea eax, [eax + ecx*2]
add eax, ecx
lea ecx, [ebp - 0x20]
add eax, dword [ebp - 0x24]
push eax
call fcn.00413d20
cmp dword [ebp - 0xc], 0x10
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
test ebx, ebx
je 0x40282b
mov edx, dword [ebp - 0x28]
lea eax, [ebx - 1]
mov ebx, dword [ebp - 0x2c]
add edx, 2
shr eax, 2
inc eax
mov dword [ebp - 0x34], eax
mov edi, eax
nop word [eax + eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov ecx, dword [eax*4 + 0x42ef48]
movzx eax, byte [edx - 5]
shl ecx, 6
or ecx, dword [eax*4 + 0x42ef48]
movzx eax, byte [edx - 4]
shl ecx, 6
or ecx, dword [eax*4 + 0x42ef48]
movzx eax, byte [edx - 3]
shl ecx, 6
or ecx, dword [eax*4 + 0x42ef48]
mov eax, ecx
sar eax, 0x10
mov byte [ebx + esi], al
mov eax, ecx
sar eax, 8
mov byte [ebx + esi + 1], al
mov byte [ebx + esi + 2], cl
add esi, 3
sub edi, 1
jne 0x4027d0
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x3c]
cmp dword [ebp - 0x24], 0
je 0x40287a
add ebx, dword [ebp - 0x28]
movzx eax, byte [ebx]
movzx ecx, byte [ebx + 1]
mov edx, dword [eax*4 + 0x42ef48]
shl edx, 6
or edx, dword [ecx*4 + 0x42ef48]
mov ecx, dword [ebp - 0x2c]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
cmp dword [ebp - 0x30], 0
mov byte [ecx + esi], al
je 0x40287a
movzx eax, byte [ebx + 2]
sar edx, 8
mov eax, dword [eax*4 + 0x42ef48]
shl eax, 6
sar eax, 8
or al, dl
mov byte [ecx + esi + 1], al
movups xmm0, xmmword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov eax, edi
xor ecx, ebp
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x10]
movq qword [edi + 0x10], xmm0
pop edi
pop esi
pop ebx
call fcn.00414dac
mov esp, ebp
pop ebp
ret
Function at 0x406752
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406776
xor eax, eax
test eax, eax
je 0x406789
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406789
xor ecx, ecx
jmp 0x40678c
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4068ec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068c6
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4068c1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40691d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4068ff
pop edi
not eax
pop esi
ret 0xc

Function at 0x438c8c
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
add edi, 0xe9fef646
mov edx, 0xde1b48c
sub edx, 0xfc5a392d
call fcn.00438cd4
mov edi, 0xdd8ad952
add edx, edx
dec edx
xor dword [eax], esi
sub edi, 1
add eax, 1
mov edi, 0x4f7285a1
cmp eax, ebx
jne fcn.00438c8c
sub edi, edx
ret
Function at 0x80968a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07faa44
jmp 0x80963c
jmp 0x80966d
mov edi, dword [esp + 0x30]
not ch
cpuid
rdtsc
jmp 0x8096e0
push cx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
pushfd
jmp 0x809550
pushfd
mov word [esp + 1], dx
setb bl
jmp 0x80963e
push edi
mov word [esp], bx
pop word [esp]
jmp 0x809659
lea eax, [esi*4]
jmp fcn.008096be
mov esi, esp
rcl edx, cl
jb 0x809695
lea eax, [esi*4]
jmp fcn.008096be
lea ebp, [esp + 4]
mov cx, word [esp]
pushfd
sub esp, 0xb8
jmp 0x8096ab

Function at 0x80975c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, eax
xchg dh, bl
add esp, 2
sub esp, 8
push dword [esp]
jmp fcn.0080978a
push dword [esp + 2]
jo 0x809746
xchg edx, eax
jmp 0x8097a0
push dword [esp]
call fcn.008097aa
xor eax, 0xb24720b2
add byte [0xb14227b7], dh
or ch, byte [edx]
inc ebp
hlt
xchg dh, bl
add esp, 2
sub esp, 8
jmp 0x809766

Function at 0x819ee8
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], edi
lea ebp, [ecx + ebp]
mov di, 0x65da
lea edi, reloc.WINMM.dll_waveOutUnprepareHeader
Function at 0x8f18c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc cl
mov byte [esp], ch
rdtsc
push ebp
xchg dl, cl
std
jmp 0x8f18cb
not ax
lea esp, [esp + 3]
jmp 0x8f18a9
mov dx, word [esp + 1]
cld
mov al, 0x97
mov dx, sp
btc edx, esp
mov cl, 0xc1
jmp 0x8f191f
stc
setp dl
shr edx, 0xe
bswap eax
mov ax, dx
bsr dx, bx
jmp 0x8f1909
adc edx, esp
xchg dx, cx
mov dh, 2
xchg edx, eax
sub esp, 0x17
push esi
jmp 0x8f195d
push word [esp + 3]
mov dword [esp], esi
mov dh, ah
pop dx
mov cl, dl
lea esp, [esp + 4]
jmp 0x8f18dd
rdtsc
cld
xchg ch, dh
bts edx, esi
mov ecx, dword [esp + 9]
pop edx
jmp 0x8f1979
mov ax, bx
rol edx, 0x10
lea ecx, [esi*4]
inc ch
mov byte [esp + 0x1a], ah
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x8f1947
lea edx, [edx + ebx]
mov ecx, dword [esp + 0xc]
push dword [esp + 7]
sub esp, 0x10
xchg word [esp + 5], ax
mov byte [esp + 4], ch
jmp 0x8f1bb2
inc eax
mov dword [esp + 0x12], edi
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
call 0x8f19bc
dec ecx
add esp, 0x26
mov edx, 0xa6bf7188
mov al, byte [esp + 0xc]
jmp 0x8f19fd
shr dh, cl
bsr ax, cx
mov ecx, esp
rdtsc
mov cx, 0x2a5
lea ecx, [edx + ebp]
jmp 0x8f19ab
not edx
cld
mov ax, word [esp]
add esp, 3
call fcn.008f19e7
mov ax, 0x250e
not eax
push word [esp + 7]
mov edx, esi
mov edx, ecx
jmp 0x8f1a8d
mov cl, byte [esp + 0x28]
bswap eax
mov word [esp + 0x26], bx
push word [esp + 0x29]
neg ah
mov byte [esp + 0x21], ah
jmp 0x8f19d4
xchg ecx, eax
cmc
mov edx, edi
or ecx, 0x41ef6470
xor ah, ch
mov eax, ecx
jmp 0x8f1ae9
pop eax
mov dl, byte [esp + 2]
pop dx
clc
lea eax, [ecx + ecx]
sub ax, ax
jmp 0x8f1a59
mov word [esp + 8], sp
mov dx, bp
xchg word [esp + 2], cx
btr ax, di
add esp, 9
lea ecx, [eax*4]
jmp 0x8f1a6f
rdtsc
call 0x8f1aaa
add al, 0x97
mov dl, byte [esp + 2]
not ecx
mov dword [esp], esi
add esp, 2
clc
jmp 0x8f1afe
not eax
bsf ecx, esp
adc dx, bx
adc eax, 0x27193f1
not ax
sub esp, 2
jmp 0x8f1ac0
setb dl
mov word [esp], di
pop dx
mov dl, byte [esp]
sub esp, 0x1e
rdtsc
jmp 0x8f1b62
sub esp, 0x1c
rdtsc
mov cx, word [esp + 0x21]
lea edx, [esi + 0xce]
jmp 0x8f1b39
mov dx, bp
inc ecx
mov al, 0x89
cld
xchg dword [esp + 0xb], ecx
inc ax
jmp 0x8f1a3e
xchg dword [esp + 0x14], eax
mov dword [esp + 0x33], eax
xchg dx, cx
mov cx, dx
not edx
add esp, 0xf
jmp 0x8f1b94
xchg cl, ch
xchg byte [esp + 0x10], dh
lea ecx, [ebx*4]
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
xchg dh, dl
mov word [esp + 0x1c], dx
jmp 0x8f1b11
mov ecx, dword [esp + 6]
mov edx, edi
not cx
mov dword [esp + 0x1e], eax
neg dx
jmp 0x8f1c4c
mov dh, byte [esp + 0xa]
inc ah
mov byte [esp + 0x1a], bh
push dword [esp + 0x13]
mov dword [esp + 0x1f], ecx
dec eax
jmp 0x8f1b7e
pushfd
pop dx
bsr cx, sp
xchg byte [esp + 2], dl
clc
not dl
jmp 0x8f1b27
btc eax, ebp
xchg dx, cx
bsr eax, ebx
call fcn.008f1bf2
mov ah, 0x2a
dec ebp
mov esp, 0x8360210b
in al, dx
sbb eax, 0x1d24548a
sub esp, 0x1d
mov dl, byte [esp + 0x1d]
sub esp, 9
mov edx, 0xa6da09d8
add dx, di
sub esp, 0
jmp 0x8f1bc5
not ecx
xchg cx, ax
mov edx, 0x4f58ba8
mov word [esp + 0x21], di
setae al
add esp, 0x2a
jmp 0x8f1bdb
bsr ecx, ecx
xor edx, 0x626e3645
xchg cx, dx
mov cl, 0x29
pop eax
push word [esp + 0x1f]
jmp 0x8f1c0f