joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c9941
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100c98bd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100c9ab0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100c9ab0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100c9a65
jg 0x100c999d
test eax, eax
je 0x100c9a5b
push 1
push 0x1000
call fcn.100b66f2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100c99c0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100c9a52
push 0x8000
push ebx
call fcn.100c97ee
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100c99e9
jg 0x100c99e4
cmp ecx, 0x1000
jb 0x100c99e9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100bd78e
add esp, 0x10
cmp eax, 0xffffffff
je 0x100c9a2e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100c99e4
jl 0x100c9a15
test ecx, ecx
jne 0x100c99d6
push dword [ebp - 0xc]
push ebx
call fcn.100c97ee
push esi
call fcn.100b674f
add esp, 0xc
xor ebx, ebx
jmp 0x100c9abe
cmp byte [edi + 0x24], 0
je 0x100c9a45
cmp dword [edi + 0x20], 5
jne 0x100c9a45
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100c9a50
mov ebx, dword [edi + 0x18]
jmp 0x100c9a52
xor ebx, ebx
push esi
call fcn.100b674f
pop ecx
jmp 0x100c9abe
test ecx, ecx
jg 0x100c9a27
jl 0x100c9a65
test eax, eax
jae 0x100c9a27
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100bc80e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100c9a85
cmp byte [edi + 0x1c], 0
je 0x100c9a27
jmp 0x100c9ab6
push ebx
call fcn.100a9a5b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100c9a27
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100c9abe
cmp byte [edi + 0x1c], 0
je 0x100c9abb
mov ebx, dword [edi + 0x18]
jmp 0x100c9abe
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100bc80e
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100d7b90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.100d8de0
mov edi, dword [esi + 0x14]
add esp, 4
test edi, edi
je 0x100d7c11
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov ecx, dword [edx + eax*8]
mov eax, dword [edx + eax*8 + 4]
mov edx, dword [esi + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp edx, edi
jae 0x100d7c11
push ebx
mov ebx, dword [esi + 0x18]
nop dword [eax + eax]
movq xmm1, qword [esp + 0xc]
mov eax, 0x38
sub eax, edx
add edx, 8
movd xmm0, eax
psrlq xmm1, xmm0
movd eax, xmm1
movzx ecx, al
mov eax, ebx
shr eax, 8
xor ecx, eax
movzx ebx, bl
shl ebx, 8
movzx ecx, word [ecx*2 + 0x1021e2a0]
xor ebx, ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x18], ebx
cmp edx, edi
jb 0x100d7bd0
pop ebx
mov ax, word [esi + 0x18]
pop edi
pop esi
add esp, 8
ret

Function at 0x100d8ec0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
cmp edi, 8
jb 0x100d8f60
push ebx
mov ebx, edi
shr ebx, 3
nop dword [eax + eax]
movzx ecx, byte [esi]
sub edi, 8
movzx edx, byte [esi + 1]
shl ecx, 8
or edx, ecx
movzx eax, ax
xor edx, eax
movzx eax, byte [esi + 6]
mov ecx, edx
shr ecx, 8
mov cx, word [ecx*2 + 0x1021f0a0]
xor cx, word [eax*2 + 0x1021e4a0]
movzx eax, byte [esi + 5]
xor cx, word [eax*2 + 0x1021e6a0]
movzx eax, byte [esi + 4]
xor cx, word [eax*2 + 0x1021e8a0]
movzx eax, byte [esi + 3]
xor cx, word [eax*2 + 0x1021eaa0]
movzx eax, byte [esi + 7]
xor cx, word [eax*2 + 0x1021e2a0]
movzx eax, byte [esi + 2]
add esi, 8
xor cx, word [eax*2 + 0x1021eca0]
movzx eax, dl
xor cx, word [eax*2 + 0x1021eea0]
movzx eax, cx
sub ebx, 1
jne 0x100d8ee0
pop ebx
test edi, edi
je 0x100d8f85
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, ax
shr edx, 8
xor edx, ecx
shl eax, 8
xor ax, word [edx*2 + 0x1021e2a0]
movzx eax, ax
sub edi, 1
jne 0x100d8f64
pop edi
pop esi
ret

Function at 0x100d8f90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x100d9031
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x10]
add ecx, 2
push ebx
nop dword [eax]
mov edx, dword [ecx + 2]
lea ecx, [ecx + 8]
shr edx, 0x10
movzx eax, ax
xor edx, eax
mov ebx, dword [ecx - 0xa]
movzx eax, byte [ecx - 9]
mov dword [esp + 0x14], edx
shr edx, 8
mov dx, word [edx*2 + 0x1021f0a0]
xor dx, word [eax*2 + 0x1021e4a0]
movzx eax, byte [ecx - 7]
xor dx, word [eax*2 + 0x1021e8a0]
movzx eax, byte [ecx - 6]
xor dx, word [eax*2 + 0x1021eaa0]
movzx eax, byte [ecx - 5]
xor dx, word [eax*2 + 0x1021eca0]
movzx eax, bl
xor dx, word [eax*2 + 0x1021e2a0]
mov eax, dword [esp + 0x14]
movzx eax, al
xor dx, word [eax*2 + 0x1021eea0]
movzx eax, byte [ecx - 8]
xor dx, word [eax*2 + 0x1021e6a0]
movzx eax, dx
sub esi, 1
jne 0x100d8fb0
pop ebx
pop esi
ret
mov ax, word [esp + 0x10]
pop esi
ret
Function at 0x100d9040
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor al, al
test edx, edx
je 0x100d9067
push esi
mov esi, dword [esp + 8]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx eax, al
xor ecx, eax
mov al, byte [ecx + 0x1021f2a0]
sub edx, 1
jne 0x100d9050
pop esi
ret
Function at 0x100eef30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x100eef66
push esi
mov esi, dword [ebp + 8]
movzx edx, word [esi]
movzx ecx, byte [ebx + eax]
inc eax
xor ecx, edx
shr dx, 8
movzx ecx, cl
xor dx, word [ecx*4 + 0x10220ff0]
mov word [esi], dx
cmp eax, edi
jl 0x100eef45
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100f0a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push 0xffff
movzx eax, byte [esi + 2]
push eax
call fcn.100f0970
push eax
movzx eax, byte [esi + 3]
push eax
call fcn.100f0970
mov ecx, dword [ebp + 8]
mov edx, eax
add esp, 0x10
mov eax, dword [ecx + 0x1c]
mov ecx, 6
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
cmp eax, ecx
jle 0x100f0b57
push ebx
push edi
movzx ebx, byte [esi + ecx]
lea ecx, [edx + edx]
shl ebx, 9
mov edx, ecx
xor edx, 0x8005
mov eax, ebx
xor eax, ecx
add ebx, ebx
test eax, 0x10000
mov eax, ebx
cmove edx, ecx
add ebx, ebx
add edx, edx
xor eax, edx
mov ecx, edx
xor ecx, 0x8005
test eax, 0x10000
mov eax, ebx
cmove ecx, edx
add ebx, ebx
add ecx, ecx
xor eax, ecx
mov edx, ecx
xor edx, 0x8005
test eax, 0x10000
mov eax, ebx
cmove edx, ecx
add ebx, ebx
add edx, edx
xor eax, edx
mov ecx, edx
xor ecx, 0x8005
test eax, 0x10000
mov eax, ebx
cmove ecx, edx
add ebx, ebx
add ecx, ecx
xor eax, ecx
mov edi, ecx
xor edi, 0x8005
test eax, 0x10000
mov eax, ebx
cmove edi, ecx
add ebx, ebx
add edi, edi
xor eax, edi
mov edx, edi
xor edx, 0x8005
test eax, 0x10000
mov eax, ebx
cmove edx, edi
add edx, edx
xor eax, edx
mov ecx, edx
xor ecx, 0x8005
test eax, 0x10000
cmove ecx, edx
lea eax, [ecx + ecx]
xor ecx, ebx
mov edx, eax
xor edx, 0x8005
test ecx, 0x8000
mov ecx, dword [ebp + 0xc]
cmove edx, eax
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebp + 8]
jl 0x100f0a81
pop edi
pop ebx
mov eax, edx
mov byte [esi + 5], dl
sar eax, 8
mov byte [esi + 4], al
pop esi
pop ebp
ret
Function at 0x1012e200
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
jl 0x1012e2b5
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [esp + 0x10]
movzx ecx, byte [esi]
movzx edx, byte [esi + 1]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x10241b90]
xor edx, dword [ecx*4 + 0x10241790]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x10240790]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x10240b90]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x10240390]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x10240f90]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x10241f90]
xor edx, dword [eax*4 + 0x10241390]
mov eax, edx
sub ebx, 1
jne 0x1012e224
pop ebx
jmp 0x1012e2b9
mov eax, dword [esp + 0xc]
test edi, edi
je 0x1012e2dc
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x10240390]
sub edi, 1
jne 0x1012e2c0
pop edi
pop esi
ret
Function at 0x1014faa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
xorps xmm5, xmm5
cdq
sub eax, edx
movss dword [esp + 0x10], xmm5
sar eax, 1
xor edx, edx
push edi
mov edi, dword [esp + 0x10]
test eax, eax
jle 0x1014fb74
mov ecx, dword [esp + 8]
movss xmm7, dword [0x1017ea10]
movss xmm6, dword [0x10248f6c]
push esi
mov esi, dword [esp + 0x10]
nop word [eax + eax]
movss xmm0, dword [edi + edx*8]
movss xmm4, dword [ecx]
movss xmm3, dword [ecx + 4]
subss xmm0, xmm4
movss xmm1, dword [ecx + 8]
mulss xmm0, dword [0x10248f88]
addss xmm4, xmm0
addss xmm0, dword [edi + edx*8]
movss dword [ecx], xmm0
movss xmm2, dword [edi + edx*8 + 4]
inc edx
movaps xmm0, xmm2
subss xmm0, xmm3
addss xmm3, xmm4
mulss xmm0, xmm6
addss xmm3, xmm0
addss xmm0, xmm2
xorps xmm2, xmm7
mulss xmm3, dword [0x1017d760]
movss dword [ecx + 4], xmm0
movaps xmm0, xmm2
subss xmm0, xmm1
addss xmm1, xmm4
mulss xmm0, xmm6
addss xmm1, xmm0
addss xmm2, xmm0
mulss xmm1, xmm1
movss dword [ecx + 8], xmm2
movss dword [esi], xmm3
add esi, 4
addss xmm5, xmm1
cmp edx, eax
jl 0x1014fae0
pop esi
movss dword [esp + 0x14], xmm5
fld dword [esp + 0x14]
pop edi
ret
Function at 0x1016cbd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x14
test al, 1
je 0x1016cbf3
push 0x31
push str.F:_vcpkg_2024.05.24_buildtreesopus_src_v1.5.1_cfcae413d5.clean_silkNLSF_VQ.c
push str.assertion_failed:___LPC_order__1____0
call fcn.1012fae0
mov eax, dword [esp + 0x38]
add esp, 0xc
push ebx
xor ebx, ebx
mov dword [esp + 8], ebx
cmp dword [esp + 0x2c], ebx
jle 0x1016cce2
mov edx, dword [esp + 0x28]
lea ecx, [eax + eax]
push ebp
push esi
lea esi, [eax - 2]
mov dword [esp + 0x18], ecx
neg eax
mov dword [esp + 0x14], esi
add eax, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
sub eax, edx
push edi
mov dword [esp + 0x10], eax
nop dword [eax + eax]
mov ecx, esi
xor edi, edi
xor ebp, ebp
test ecx, ecx
js 0x1016ccb1
lea ebx, [ecx + 1]
lea ebx, [edx + ebx*2]
movzx eax, word [eax + ebx]
lea ebx, [ebx - 4]
mov edx, dword [esp + 0x30]
sar ebp, 1
movzx edx, byte [edx + ecx + 1]
shl dx, 7
sub ax, dx
movsx esi, ax
movsx eax, word [ebx + 4]
imul esi, eax
mov eax, esi
sar esi, 1
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + ecx]
mov eax, dword [esp + 0x2c]
shl dx, 7
movzx eax, word [eax + ecx*2]
sub ax, dx
movsx ebp, ax
movsx eax, word [ebx + 2]
imul ebp, eax
mov eax, ebp
sub eax, esi
cdq
xor eax, edx
sub eax, edx
add edi, eax
sub ecx, 2
mov eax, dword [esp + 0x10]
jns 0x1016cc40
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
add edx, dword [esp + 0x1c]
add eax, dword [esp + 0x20]
mov dword [esp + 0x34], edx
mov dword [ecx + ebx*4], edi
inc ebx
mov ecx, dword [esp + 0x3c]
add dword [esp + 0x30], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
cmp ebx, dword [esp + 0x38]
jl 0x1016cc30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x1016d3a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1016d3cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1016d3cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x89b4f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x432000]
push edi
jmp 0x89b50a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x89b511
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x89b500
mov eax, 1
add ebx, ebx
jne 0x89b523
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x89b534
jne 0x89b553
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x89b553
dec eax
add ebx, ebx
jne 0x89b540
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x89b518
add ebx, ebx
jne 0x89b54f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x89b5a5
xor ecx, ecx
sub eax, 3
jb 0x89b56b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x89b5da
sar eax, 1
mov ebp, eax
jmp 0x89b576
add ebx, ebx
jne 0x89b576
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x89b544
inc ecx
add ebx, ebx
jne 0x89b584
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x89b544
add ebx, ebx
jne 0x89b591
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x89b586
jne 0x89b5a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x89b586
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x89b5c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x89b5b6
jmp 0x89b506
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x89b5c4
add edi, ecx
jmp 0x89b506
pop esi
mov edi, esi
mov ecx, 0x3323
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x89b5e2
cmp byte [edi], 0x12
jne 0x89b5e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x89b5e7
lea edi, [esi + 0x498000]
mov eax, dword [edi]
or eax, eax
je 0x89b656
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x49b000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x49b0ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x89b614
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x49b0b4]
or eax, eax
je 0x89b650
mov dword [ebx], eax
add ebx, 4
jmp 0x89b631
call dword [esi + 0x49b0b0]
mov ebp, dword [esi + 0x49b0b8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x36b]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x89b68a
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x4665e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4665ea
ret

Function at 0x53de4a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
mov dword [esp + 4], ecx
mov dword [esp], 0xecc544e7
pushal
mov byte [esp + 8], bl
pushal
mov dword [esp + 0x40], esi
push dword [esp]
mov dword [esp + 0x40], edx
push dword [esp]
pushfd
jmp 0xe3908f
pop ds
call fcn.00549ef6
dec ebp
rol ah, cl
mov al, 0xf5
insb byte es:[edi], dx
sbb eax, dword [eax + 0x58]
and byte [ebx], 0xff
jne 0x53ecce
dec ebx
push edi
xchg ebp, eax
and dword [ebx + 0x1c24d0d], edx
mov al, byte [0x2a75a8b9]
test dword [ebx], edi
adc esi, dword [esi]
sub edi, dword [0xe517861c]
inc ebp
invalid
mov dword [esp + 0x44], 0x51b240
jmp 0x53ecf8

Function at 0xe0dbba
Capabilities:
Encode data using xor

Disassembly:
call fcn.004e9250
pushal
mov word [esp + 8], 0xd9cb
lea esp, [esp + 0x24]
call fcn.005524b1
push ebp
not bx
mov dword [esp], esi
not bl
call fcn.00534ebf
pushal
lea esp, [esp + 0x2c]
jne 0xe1e231
cmp bl, dh
bt ax, 4
clc
cmp ah, 0x5b
cmp word [ebp + 8], bx
push 0x8516817d
lea esp, [esp + 4]
jne 0x4e9d03
shrd ax, si, 8
bt si, 1
daa
sbb ah, dh
mov eax, dword [ebp + 0x10]
test ah, dl
cmp dl, cl
and eax, 0xfc00
test ch, 0xf9
bt bp, bx
jmp 0x565229

Function at 0xe259c5
Capabilities:
Encode data using xor

Disassembly:
mov word [esp], 0xb297
lea esp, [esp + 8]
jne 0xe1e231
pushal
mov dword [esp + 0x1c], 0
jmp 0xdfef61
mov ebx, eax
call fcn.005412bc
inc esp
sbb ebp, dword [ebp + ecx - 0x68]
outsb dx, byte [esi]
sbb ebx, dword [ebp + 0x1445585f]
adc byte [ebx], cl
invalid
push 0x1b2aaca3
lea esp, [esp + 0x20]
call fcn.005524b1
mov bl, 0x41
not bx
push esi
jmp 0x5248ff
pushfd
lea esp, [esp + 0x4c]
call fcn.0053d8f7
pushfd
mov word [esp], ax
pushfd
test eax, eax
jmp 0x4ee025
Function at 0xe2812a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
call fcn.00e0e4a8
push 0x26ff1226
lea esp, [esp + 4]
ja 0x50e44d
pushfd
mov dword [esp], edx
jmp 0xdfe215
jmp fcn.00537f4a
lcall 0x4371, 0x9cb8e140
add al, 0xab
dec edx
adc dword cs:[ecx], esi
mov al, 0x82
lahf
and byte [eax], al
mov esi, 0x776003de
sbb byte [eax], ah
add byte [esi - 0x58], bl
outsd dx, dword [esi]
pushal
push ds
xor ebp, dword [edi]
sub ch, bh
xchg esp, eax
jae 0xdfe1bf
sub eax, 0xc4436ffc
sbb eax, 0x49170f15
mov cl, 0xc9
xchg edx, eax
or dword [edi + 0x7f], ebx
mov eax, dword [0xd058c1c1]
xor eax, ecx
push 0x35
loopne 0xdfe255
inc eax
lodsd eax, dword [esi]
fist word [ebx - 0x6096bc7d]
js 0xdfe223
sub dl, byte [esi + 0x582f6837]
call fcn.00e2ed79
jns 0xe2e45d
pushfd
mov dword [esp], eax
call fcn.00535f57
mov edx, 0xe0ffa170
sbb bh, al
jns 0xdfe294
jmp dword [esi]
jo 0xdfe1c9
jmp eax
pop ebp
test byte [ecx], ah
or ecx, 0x2da57d19
jae 0xdfe226
outsb dx, byte [esi]
inc edx
jae 0xdfe285
push edx
call [edx + 0xd]
cwde
cmp edx, dword [esi + ecx*8 + 0x19]
mov word [eax], ds
xchg dword [edi + edx*8], ebp
and cl, cl
sub al, 0xe1
jne 0xdfe25e
iretd
mov eax, 0xfe46e668
test al, 0x4e
shl dword [ebx + edi*4 + 0x44], 1
sbb al, 0xf7
mov al, 0xe7
test al, 0x71
xchg ebp, eax
mov ebx, 0xb0f71c44
out 0xa8, eax
jno 0xdfe1fc
push ebp
mul byte [ecx + 0x7ed04983]
sahf
ret 0x14f7
mov dl, 0x91
cmp ebx, dword [edx + 0x79e6de13]
dec edi
movsd dword es:[edi], dword [esi]
lds ebx, [ebx - 0x33]
xor al, 0x4e
test eax, 0xff41737a
mov ebp, 0xaa80d6d8
salc
das
sub al, bh
test al, 0xc8
fcomp dword [0xd2401f17]
cmc
enter 0x1dd8, 0x17
pop ds
inc eax
sal ch, cl
mov byte [edi], dl
mov esi, 0xfe6303eb
xchg ebp, eax
salc
inc esp
add dword [ebx + 0x29], ebx
in eax, 0x52
inc ecx
fisubr dword [edx + ecx - 0x33]
jo 0xdfe2fa
mov al, byte [0xcc5ce7b2]
xchg ebp, eax
sbb dl, 1
xchg esi, eax
test eax, 0x41d64140
adc al, 0x6d
sub dl, byte [0xf99b556]
pop ebp
lahf
insd dword es:[edi], dx
jge 0xdfe2f5
aad 0xf9
adc ecx, esi
dec ebx
cli
aaa
adc al, 0xc4
jecxz 0xdfe2eb
popfd
sub ecx, eax
push ecx
sbb ah, cl
pop esp
test dword [esi + 0x1ae0ffc7], edx
push edi
ja 0xdfe2a3
pop ds
cmp dword [edx], eax
push ds
add bl, byte [esi]
retf 0xa9ce
jmp 0xe32485
mov byte [esp], 0x80
mov dword [esp + 0x20], 0
lea esp, [esp + 0x20]
jle 0x51a4ba
pushal
push edx
mov dword [esp + 0x20], edx
pushal
pushfd
push ebp
mov dword [esp + 0x44], eax
movsx ax, dl
pushfd
mov byte [esp], 0x3f
mov eax, dword [ebp + 8]
mov byte [esp + 4], 0xfd
lea esp, [esp + 0x48]
call fcn.00e014ee
je 0x54b67d
movzx bp, cl
pop ebp
push eax
pushal
push dword [esp + 0x24]
ret 0x34

Function at 0xe4320e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
bswap ax
mov dword [esp], ebx
jmp 0xe58b54
lea eax, sym.imp.KERNEL32.DLL_LocalFree
pushal
mov dword [esp + 0x1c], 0xe4d0b2
mov word [esp], 0x7876
jmp 0xe5c823
Function at 0xe46738
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 4], 0xf0
pushal
lea esp, [esp + 0x28]
call fcn.00e6046e
pushfd
lea esp, [esp + 4]
jne 0xe441dc
movsx ax, cl
mov al, ah
bswap ax
mov eax, dword [edx + 8]
pushfd
pushfd
mov byte [esp + 4], dh
mov byte [esp + 4], 0xb0
lea esp, [esp + 8]
jmp 0xe55922
jmp 0xe450aa

Function at 0xe4b905
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
jne 0xe441dc
movsx ax, dl
lahf
mov eax, dword [edx + 8]
push edi
lea esp, [esp + 4]
jmp 0xe55922

Function at 0xe4c1a1
Capabilities:
Packed with generic packer

Disassembly:
jmp 0xe5592d
bt sp, di
test edx, edx
jmp 0xe41b01

Function at 0xe5a996
Capabilities:
Packed with generic packer

Disassembly:
shr edi, 0x66
bswap ecx
bswap cx
stc
cmc
mov ecx, edi
pushal
mov al, byte [ecx]
pushal
mov byte [esp + 8], 0xac
cmc
clc
mov ah, al
stc
ror al, 7
call fcn.00e61552
in eax, dx
cmp esp, dword cs:[edi]
jo 0xe57136
sbb dh, byte [edi + 0x346d47c9]
and eax, 0x57c6cbbd
mov bl, byte [ebx]
invalid
lea esp, [esp + 0x48]
je 0xe5ad71
bt sp, 4
push 0x3d5d845b
sub al, 0x30
test dh, 0xa4
call fcn.00e630a7
call fcn.00e52693
movsx bx, bl
cmc
mov ebx, eax
cmp di, 0xb716
cmp al, 0x47
cmp bh, 1
cmp byte [edi], 0x23
call fcn.00e45e7b
setg al
rcr di, 1
xchg di, cx
rcr di, cl
mov edi, edx
ror cl, 2
bts cx, 4
setne cl
jnp 0xe57138
mov ecx, edi
not al
push ebx
pushal
call fcn.00e60b69
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0xe5ae0e
push eax
jb 0xe5ae0d
outsb dx, byte [esi]
je 0xe5ae0c
jb 0xe5ae1c
push edi
add byte [eax], bh
cmp ch, al
pushal
add edx, eax
push ebx
pushfd
cmc
in al, 0xb7
mov ebx, 0x42043802
mov bh, 0xbb
add bh, byte [eax]
add al, 0x42
call 0x733501fc
ror byte [edi - 0x11fb6d7a], cl
xchg edx, eax
add al, 0xee
jmp dword [esi + 0x7c76b91]