joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004045da
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040458f
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.004045da
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040458f
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004045ca
sbb al, 0xec
lodsb al, byte [esi]
and byte cs:[ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], pe_nt_image_headers32
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.004045da
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040458f
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.004045ca
sub bl, cl
shr dword [eax + eax*4], 0xa5
pushfd
stc
invalid

Function at 0x407668
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412018]
jne 0x407672
repz ret
jmp fcn.00407bfa
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x99f3608
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x13b4c47
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10002a50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], edi
call sym._WindowsGetStringRawBuffer_8
sub esp, 8
mov ebx, eax
test byte [0x10004020], 8
jne 0x10002ad0
mov dword [esi], 0
mov dword [esp + 4], str.Windows.Devices.Geolocation.Geolocator
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
jne 0x10002ab5
mov eax, dword [0x10004018]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x10006b6c
mov dword [esp], 0x10004018
call dword [eax]
sub esp, 0xc
cmp dword [esi], 1
sbb eax, eax
lea esp, [ebp - 0xc]
pop ebx
and eax, 0x80040111
pop esi
pop edi
pop ebp
ret 8
lea eax, [ebp - 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._WindowsGetStringRawBuffer_8
mov edx, dword [ebp - 0x10]
sub esp, 8
call sym._wine_dbgstr_wn
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.classid__s__factory__p._n
mov dword [esp + 8], str.DllGetActivationFactory
mov dword [esp + 4], 0x10004020
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10002a7d

Function at 0x10002b80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10002bd8
cmp byte [esi + ebx - 1], 0xa
je 0x10002bac
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10009084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10003200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x100033d8
mov edi, dword [0x10009084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x100032e7
test byte [0x10004038], 8
jne 0x10003380
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10004048], 8
jne 0x10003340
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10003289
cmp esi, 3
jbe 0x100032f8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000329a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10007448]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10003289
mov dword [esp], 0x10004048
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10003260
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10003260
mov dword [esp], 0x10004038
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000324b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10003253
mov eax, 0xffffffff
jmp 0x100032e7
Function at 0x1500058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.015001a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x150007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x150006a
add dl, dl
jne 0x1500089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15000dc
xor eax, eax
add dl, dl
jne 0x1500096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x150017d
add dl, dl
jne 0x15000a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15000b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15000bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15000c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x15000d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1500075
mov eax, 1
add dl, dl
jne 0x15000ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15000f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15000e1
sub eax, ebx
mov ebx, 1
jne 0x1500128
mov ecx, 1
add dl, dl
jne 0x150010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1500119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1500105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1500075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x150013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x150014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1500136
cmp eax, 0x7d00
jae 0x150016d
cmp eax, 0x500
jb 0x1500168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1500075
cmp eax, 0x7f
ja 0x1500170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1500075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x150019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1500075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x411428
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4114d1
test eax, edx
je 0x4114d4
push 0
push 0
cmp word [eax - 0xa], 2
je 0x411451
push edx
mov edx, eax
mov eax, esp
call fcn.00407584
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x411467
push eax
lea eax, [esp + 8]
call fcn.00407584
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x411476
movzx eax, word [eax]
sub eax, ecx
jmp 0x41149d
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4114b7
add ecx, 4
js 0x41148e
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x4114b4
push eax
mov eax, ecx
mov edx, 2
call fcn.00406410
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41149b
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41149d
xor eax, eax
ret
test eax, eax
je 0x4114e4
test edx, edx
jne 0x411438
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x448e88
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x448e8e
ret
Function at 0x4538c4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x453a81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x453a5d
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x453a5d
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x453890]
call fcn.00408f8c
add esp, 4
lea eax, [ebp - 4]
call fcn.0040a4d8
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x5d76e0]
push eax
call fcn.004452c4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00408dc4
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.00404938
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x448994]
call fcn.00450420
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x453a3b
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.00452004
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.00450d40
call fcn.0044bc04
push eax
call fcn.0040c8a4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.00451098
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x453a5d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453a88
lea eax, [ebp - 8]
mov edx, dword [0x453890]
call fcn.004090ac
lea eax, [ebp - 4]
call fcn.0040a4d8
ret
Function at 0x4e72f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x144]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4e7314
cmp eax, 0
jbe 0x4e741d
jmp 0x4e731a
jle 0x4e741d
mov eax, dword [ebp + 8]
add eax, 0xffffff08
xor ecx, ecx
mov edx, 0xf8
call fcn.00404938
mov eax, dword [ebp + 8]
lea edx, [eax - 0x138]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x144]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x40
jne 0x4e741d
mov eax, dword [ebp + 8]
cmp word [eax - 0x138], 0x5a4d
jne 0x4e741d
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xfc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x144]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0xfc]
jne 0x4e741d
mov eax, dword [ebp + 8]
lea edx, [eax - 0xf8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x144]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 4
jne 0x4e741d
mov eax, dword [ebp + 8]
cmp dword [eax - 0xf8], 0x4550
jne 0x4e741d
mov eax, dword [ebp + 8]
lea edx, [eax - 0xf4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x144]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x14
jne 0x4e741d
mov eax, dword [ebp + 8]
cmp word [eax - 0xf4], 0x14c
jne 0x4e741d
mov eax, dword [ebp + 8]
movzx ecx, word [eax - 0xe4]
mov eax, dword [ebp + 8]
lea edx, [eax - 0xe0]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x144]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp + 8]
movzx edx, word [edx - 0xe4]
cmp eax, edx
jne 0x4e741d
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x4e7abc
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor edx, edx
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xf2]
test ax, ax
jbe 0x4e7ba5
mov edx, dword [ebp + 8]
movzx eax, ax
dec eax
test eax, eax
jl 0x4e7ba3
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 0xc]
xor edx, edx
test eax, 0x20000000
je 0x4e7b35
test eax, 0x40000000
je 0x4e7b21
test eax, 0x80000000
je 0x4e7b1c
or edx, 0x40
jmp 0x4e7b5c
or edx, 0x20
jmp 0x4e7b5c
test eax, 0x80000000
je 0x4e7b30
or edx, 0x80
jmp 0x4e7b5c
or edx, 0x10
jmp 0x4e7b5c
test eax, 0x40000000
je 0x4e7b4d
test eax, 0x80000000
je 0x4e7b48
or edx, 4
jmp 0x4e7b5c
or edx, 2
jmp 0x4e7b5c
test eax, 0x80000000
je 0x4e7b59
or edx, 8
jmp 0x4e7b5c
or edx, 1
test eax, 0x4000000
je 0x4e7b69
or edx, 0x200
mov eax, dword [ebp + 8]
add eax, 0xfffffec4
push eax
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8]
push eax
call fcn.0040c4e4
inc ebx
dec dword [ebp - 4]
jne 0x4e7aec
mov dl, 1
mov eax, edx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4eaf00
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00404938
ret
Function at 0x516024
Capabilities:
Packed with generic packer

Disassembly:
call fcn.007a5899
call 0x963a20a9
call 0x87f7b6
inc edi
mov eax, eax
push esi
call 0x85b038

Function at 0x51e464
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b00
xor eax, eax
push ebp
push 0x51e526
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004063ec
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406618
call fcn.004067b0
test eax, eax
jle 0x51e503
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.00407584
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dl, byte [edx + ecx - 1]
xor dl, 0x10
and edx, 0xff
sub edx, 0xf
call fcn.004074d4
mov edx, dword [ebp - 0x18]
pop eax
call fcn.0040777c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, 0
call fcn.004075ac
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x51e4b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51e52d
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00407350
lea eax, [ebp - 4]
call fcn.004063ec
ret
Function at 0x526d68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x526e40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
dec eax
test eax, eax
jb 0x526e40
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add eax, dword [edx + 0x20]
mov edx, dword [ebp - 0x20]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0040c524
test eax, eax
jne 0x526e38
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add eax, dword [edx + 0x24]
mov edx, dword [ebp - 0x20]
add edx, edx
add eax, edx
mov ax, word [eax]
mov word [ebp - 0x2e], ax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
movzx edx, word [ebp - 0x2e]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
jmp 0x526e40
inc dword [ebp - 0x20]
dec dword [ebp - 0x38]
jne 0x526dcf
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x5608b4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5fe040
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x5608d6
shr eax, 1
xor eax, 0xedb88320
jmp 0x5608d8
shr eax, 1
dec edx
jne 0x5608c4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5608bd
mov byte [0x5fe440], 1
pop esi
pop ebx
ret

Function at 0x5608f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5fe440], 0
jne 0x56090b
call fcn.005608b4
mov eax, edi
dec eax
test eax, eax
jl 0x560933
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5fe040]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x560915
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x563334
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5633ce.0
jmp dword [ecx*4 + 0x563367]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x563399
sub dl, 8
je 0x5633a8
jmp case.0x5633ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x562fdc
jmp case.0x5633ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x563034
jmp case.0x5633ce.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5633ce.0
movzx ecx, byte [ecx + 0x5633d5]
jmp dword [ecx*4 + 0x5633e6]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5630e0
jmp case.0x5633ce.0
cmp dl, 3
jne 0x563413
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x563138
jmp case.0x5633ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5630f4
jmp case.0x5633ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x56317c
jmp case.0x5633ce.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x56343e
sub dl, 8
je 0x56344a
jmp case.0x5633ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5631a8
jmp case.0x5633ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x563214
jmp case.0x5633ce.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x563469
sub dl, 8
je 0x563475
jmp case.0x5633ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5632d0
jmp case.0x5633ce.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5632f8
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x563517
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005624e0
test eax, eax
je 0x563517
mov eax, ebx
call fcn.00563520
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x5634b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8