joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebp
push edi
mov ebp, ecx
xor edi, edi
mov eax, dword [eax]
and eax, 7
mov dword [esp + 0x10], ebp
cmp edx, 5
jae 0x453083
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ebp
push esi
mov dword [esp + 0x10], edx
lea esi, [edi + ebp]
cmp esi, edx
jae 0x4530a7
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4530a7
inc esi
cmp esi, edx
jb 0x453098
mov edi, esi
sub edi, ebp
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x4531b2
cmp ecx, 3
jbe 0x4530e5
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [esp + 0x14], ebx
test cl, cl
je 0x453121
cmp cl, 0xff
je 0x453121
mov edx, dword [esp + 0x10]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
jmp 0x453091
dec ecx
shl eax, cl
and eax, 7
je 0x4530be
cmp byte [eax + 0x4707a0], 0
je 0x453111
movzx ecx, byte [eax + 0x4707a8]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x45310d
cmp cl, 0xff
jne 0x4530be
mov edx, dword [esp + 0x10]
and eax, 3
mov ebx, edi
add eax, eax
or eax, 1
inc edi
jmp 0x453091
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
nop
lea ebx, [edx + 5]
add ebx, edi
test eax, eax
je 0x45317a
movzx ebp, byte [eax + 0x4707a8]
mov ecx, 0x18
shl ebp, 3
mov edx, ebx
sub ecx, ebp
shr edx, cl
test dl, dl
je 0x453167
cmp dl, 0xff
jne 0x45317a
mov ecx, 0x20
mov edx, 1
sub ecx, ebp
shl edx, cl
dec edx
xor edx, ebx
jmp 0x453140
mov ebp, dword [esp + 0x18]
mov ecx, ebx
mov edx, dword [esp + 0x10]
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
neg cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [esp + 0x14]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
jmp 0x453091
pop esi
pop ebx
cmp ecx, 3
jbe 0x4531c9
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
pop ebp
add esp, 0xc
ret
dec ecx
shl eax, cl
mov ecx, dword [esp + 0x1c]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x45ca40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x484150], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x483e50], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x484050], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x483f50], al
inc esi
cmp esi, 0x100
jl 0x45cb50
pop esi
add esp, 0x80
ret
Function at 0x40150b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x416008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, edx
mov dword [ebp - 0x214], eax
push edi
mov edi, dword [0x4174c4]
test esi, esi
je 0x40162e
xor eax, eax
cmp word [esi], ax
je 0x40162e
push 4
push 0x41403c
push esi
call fcn.004059d4
add esp, 0xc
test eax, eax
jne 0x40155f
add esi, 8
push 2
push 0x414048
push esi
call fcn.004059d4
add esp, 0xc
test eax, eax
jne 0x401576
add esi, 4
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004037f0
push 0x104
push esi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00405adc
lea eax, [ebp - 0x210]
push 0x2e
push eax
call fcn.0040356b
mov esi, eax
add esp, 0x24
test esi, esi
je 0x4015e7
xor eax, eax
mov word [esi], ax
inc esi
add esi, 1
je 0x4015e7
push str.HTML
push esi
call fcn.00405841
pop ecx
pop ecx
test eax, eax
je 0x4015e7
push 0x41405c
push esi
call fcn.00405841
pop ecx
pop ecx
test eax, eax
je 0x4015e7
push esi
jmp 0x4015e9
push 0x17
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40162e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40162e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
test eax, eax
je 0x40162e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
test eax, eax
je 0x40162e
mov al, 1
jmp 0x401630
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402258
leave
ret

Function at 0x4055e7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405626
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405626
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405626
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405626
cmp dword [ecx + 0x74], 0xe
jbe 0x405626
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407c2d
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x416008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x407c78
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00407dc8
test al, al
jne 0x407c72
sub edx, 2
cmp edx, edi
jne 0x407c58
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x407c9a
lea eax, [edi + 2]
cmp edx, eax
je 0x407c9a
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00407b79
add esp, 0x10
jmp 0x407d94
push esi
lea ecx, [ebp - 0x255]
call fcn.00407dc8
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x407cdd
push dword [ebp - 0x25c]
jmp 0x407c8a
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x407d1a
cmp word [ebp - 0x226], 0
je 0x407d3b
cmp word [ebp - 0x226], ax
jne 0x407d1a
cmp word [ebp - 0x224], 0
je 0x407d3b
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00407b79
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x407d87
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x407cf4
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x407d6f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x407d94
push 0x4079a9
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040a9c0
add esp, 0x10
jmp 0x407d64
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402258
leave
ret

Function at 0x409909
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4112bc
push 0x4112b4
push str.FlsAlloc
push 0x1f
call fcn.00409844
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40993d
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f180]
call esi
jmp 0x409943
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409987
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4112cc
push 0x4112c4
push str.FlsGetValue
push 0x21
call fcn.00409844
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4099be
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f180]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4099c6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4112d4
push 0x4112cc
push str.FlsSetValue
push 0x22
call fcn.00409844
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409a00
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f180]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x44a410
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 4]
push 0
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 4]
test eax, eax
je 0x44a4e2
lea ecx, [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
loopne 0x44a4ba
add byte [ebp + 0x51142454], cl
push edx
push 0
push 0
push str.FeatureSettings
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 4
call esi
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
mov edi, eax
mov eax, dword [esp + 0x10]
push 0
push 0
push str.FeatureSettingsOverride
push eax
call esi
test edi, edi
pop esi
je 0x44a4c0
mov ecx, dword [0x651d84]
push 0x651ab8
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
or eax, edi
pop edi
xor eax, 0x11
neg eax
sbb eax, eax
inc eax
add esp, 0x14
ret
xor eax, eax
pop edi
add esp, 0x14
ret

Function at 0x48f5d0
Capabilities:
Packed with generic packer

Disassembly:
neg byte [ecx - 0x575235a1]
mov esp, 0xa49fb8e2
mov cl, 0xe7
or eax, 0x18e0d324
btc dword [0x3d9c7654], esi
mov dword gs:[ebx], ebx
dec ebx
shl eax, cl
sbb byte [edi], cl
mov ebx, 0x9c765435
cmp eax, 0x4b1b8965
jo 0x48f51d
mov bh, 0xbf
and eax, 0xc88a75e2
lea esp, [edi]
invalid
jo 0x48f59b
mov cl, 0x26
sub al, 0x2d
sub al, 0x2d
sub ah, byte [edi - 0x4a]
into
fistp word [edx - 0x1066c858]
mov ebx, ebx
loopne 0x48f52d
add dh, byte [ebx - 0x6c7e5a71]
push ecx
out 0x18, eax
fistp dword [ecx + 0x2d]
pushal
mov dword [edx], esp
mov ecx, 0x96531fce
loope 0x48f5d5
mov ch, 0x63
sahf
cmc
mov ebp, 0x1f49a5c6
mov ah, 0x4c
cmc
nop
lodsb al, byte [esi]
test ch, al
push ds
adc cl, byte fs:[ebx - 0x69]
dec ebx
xchg edi, eax
invalid

Function at 0x6016b4
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
aas
wait
jl 0x6016c8
int 0xad
xor eax, 0x378b0de0
push eax
push cs
invalid
ror ebp, 1
std
lahf
enter 0xffffffffffffec23, 0xffffffffffffff9b
loopne 0x60169f
fdiv dword fs:[eax + edx*2]
lahf
js 0x601690
sub eax, 0xb6456d73
pop edi
inc ebp
mov dh, 0x5f
mov ecx, 0xe048bd9d
inc ebx
cmp byte [ecx - 0x724c7375], 0xcd
mov eax, dword [ebp - 0x33255ca1]
je 0x60174d
or byte [eax + 0x33], dl
imul ebx, dword [eax], 0x1bb2baff
Function at 0x601700
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
wait
dec ecx
inc ecx
fstp qword [ecx + 0x24]
pop ebx
out dx, al
wait
iretd
mov dl, 0x1b
jnp 0x601688
das
cli
scasb al, byte es:[edi]
mov dword [0x89c333ba], eax
aad 0xe4
inc byte [ebp + 0x2d]
xor al, 0x24
loop 0x601748
xor cl, byte [edx - 0x75]
pop esi
push ebp
jl 0x6016e7
mov ebp, 0x134d5c37
inc esi
push esi
dec eax
sti
ret 0xba53
mov esp, 0xd72b561d
popfd
push es
dec ebx
sub bl, cl
jnp 0x6017c0
fstp qword [edi]
test esp, eax
ftst
in eax, dx
invalid
and eax, 0x5b0bbc28
int3
jmp 0x60175d

Function at 0x6017e4
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
aas
invalid
inc esp
insb byte es:[edi], dx
aam 0x12
in eax, 0xdb
test al, 0xf3
stosb byte es:[edi], al
jecxz 0x6017b0
cmpsb byte [esi], byte es:[edi]
nop
cmp al, byte [edi - 0xc]
test byte [ebx], bl
mov ebp, 0x36ee34f
sub al, 0x2a
push esi
ja 0x6017ee
inc ebx
mov ebx, 0x615d8a02
cmc
xchg ecx, eax
xor dword ds:[edi - 0x5d], edi
jp 0x6017ca
mov gs, word [ecx + 0x74]
sal dword [eax + 0x5db89896], cl
cld
and al, 0xb5
cwde
sub al, 0xf2
pop ebx
push 0xcee1299b
push esi
enter 0x4284, 0xffffffffffffff8a
mov ebx, 0x83dae1f8
jl 0x6017cc
and al, 0x3c
ud1
sub byte [ebx - 0x45], ch
and al, 0x9d
add bl, byte [esi + 0x1b1c8b53]
aaa
popal
imul eax, dword [ebx], 0x6d
mov ebx, 0x3beddde6
mov edx, 0x98ee6481
mov esp, 0x2deebcc6
enter 0x3849, 0xffffffffffffff8e
jmp ebp

Function at 0x604478
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
test eax, eax
je 0x60448c
push eax
push 0
call fcn.005ff9f0
test eax, eax
je 0x604470
ret

Function at 0x604648
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
mov al, 1
jmp fcn.00601700
test ecx, ecx
je fcn.006044d8
push eax
push ecx
push edx
call fcn.005ff9f0
test eax, eax
pop edx
je 0x604470
push dword [edx]
mov dword [edx], eax
call fcn.005ffa00
ret

Function at 0x6048e4
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
cmp dword [eax], edx
je 0x60490b
test edx, edx
je fcn.006044d8
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.006044d8
push ecx
push edx
push eax
call fcn.005ff9f8
test eax, eax
je 0x604470
ret

Function at 0x6052c8
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
xor ecx, ecx
test edx, edx
je 0x6052d1
mov ecx, dword [edx - 4]
jmp fcn.00604648
Function at 0x605b34
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
cmp ecx, 0
je 0x605c42
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x605b7f
cmp al, 0x12
je 0x605bb9
cmp al, 0xb
je 0x605b9c
cmp al, 0xc
je 0x605bd0
cmp al, 0xd
je 0x605bdf
cmp al, 0xe
je 0x605bfd
cmp al, 0xf
je 0x605c13
cmp al, 0x11
je 0x605c22
jmp 0x605c33
cmp ecx, 1
mov eax, ebx
jg 0x605b90
call fcn.006044b4
jmp 0x605c3e
mov edx, ecx
call fcn.00604520
jmp 0x605c3e
cmp ecx, 1
mov eax, ebx
jg 0x605bad
call fcn.006044d8
jmp 0x605c3e
mov edx, ecx
call fcn.00604550
jmp 0x605c3e
cmp ecx, 1
mov eax, ebx
jg 0x605bc7
call fcn.00604490
jmp 0x605c3e
mov edx, ecx
call fcn.006044f0
jmp 0x605c3e
mov eax, ebx
add ebx, 0x10
call fcn.00605b1c
dec edi
jg 0x605bd0
jmp 0x605c3e
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00605b34
dec edi
jg 0x605be2
pop ebp
jmp 0x605c3e
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00605ae4
dec edi
jg 0x605c00
pop ebp
jmp 0x605c3e
mov eax, ebx
add ebx, 4
call fcn.00607e10
dec edi
jg 0x605c13
jmp 0x605c3e
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00606898
dec edi
jg 0x605c22
jmp 0x605c3e
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00601700
pop edi
pop esi
pop ebx
pop eax
ret
Function at 0x605d78
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
push ebx
push esi
push edi
push ebp
push 0
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [eax + ecx + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
test ebp, ebp
je 0x605ea3
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x605dae
mov edx, eax
add eax, esi
add edx, ebx
call fcn.006017e4
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xf
je 0x605e73
cmp cl, 0xa
je 0x605df3
cmp cl, 0xb
je 0x605e18
cmp cl, 0x12
je 0x605e07
cmp cl, 0xc
je 0x605e29
cmp cl, 0xd
je 0x605e3a
cmp cl, 0xe
je 0x605e5a
cmp cl, 0x11
je 0x605e84
mov al, 2
pop ecx
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00601700
mov edx, dword [eax + esi]
add eax, ebx
call fcn.0060490c
mov eax, 4
jmp 0x605e95
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00604870
mov eax, 4
jmp 0x605e95
mov edx, dword [eax + esi]
add eax, ebx
call fcn.006048e4
mov eax, 4
jmp 0x605e95
lea edx, [eax + esi]
add eax, ebx
call fcn.00605d60
mov eax, 0x10
jmp 0x605e95
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [ecx + edx + 2]
push dword [ecx + edx + 6]
mov ecx, dword [ecx + edx + 0xa]
mov ecx, dword [ecx]
lea edx, [eax + esi]
add eax, ebx
call fcn.00605ebc
pop eax
jmp 0x605e95
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [ecx + edx + 2]
push ecx
mov ecx, edx
lea edx, [eax + esi]
add eax, ebx
call fcn.00605d78
pop eax
jmp 0x605e95
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00607e28
mov eax, 4
jmp 0x605e95
mov ecx, edx
mov edx, dword [eax + esi]
add eax, ebx
call fcn.006068d4
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x605d9c
pop ecx
sub ecx, eax
jle 0x605eb1
lea edx, [eax + ebx]
add eax, esi
call fcn.006017e4
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x605ebc
Capabilities:
Check for software breakpoints
Check for vm using instruction vpcext

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x605f0b
cmp cl, 0xb
je 0x605f22
cmp cl, 0x12
je 0x605f39
cmp cl, 0xc
je 0x605f4d
cmp cl, 0xd
je 0x605f61
cmp cl, 0xe
je 0x605f84
cmp cl, 0xf
je 0x605fa1
cmp cl, 0x11
je 0x605fb5
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00601700
mov eax, ebx
mov edx, dword [esi]
call fcn.0060490c
add ebx, 4
add esi, 4
dec ebp
jne 0x605f0b
jmp 0x605fc9
mov eax, ebx
mov edx, dword [esi]
call fcn.006048e4
add ebx, 4
add esi, 4
dec ebp
jne 0x605f22
jmp 0x605fc9
mov eax, ebx
mov edx, dword [esi]
call fcn.00604870
add ebx, 4
add esi, 4
dec ebp
jne 0x605f39
jmp 0x605fc9
mov eax, ebx
mov edx, esi
call fcn.00605d60
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x605f4d
jmp 0x605fc9
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [ecx + edi + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
push dword [edi + 4]
call fcn.00605ebc
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x605f6a
jmp 0x605fc9
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00605d78
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [eax + edi + 2]
add esi, dword [eax + edi + 2]
dec ebp
jne 0x605f84
jmp 0x605fc9
mov eax, ebx
mov edx, dword [esi]
call fcn.00607e28
add ebx, 4
add esi, 4
dec ebp
jne 0x605fa1
jmp 0x605fc9
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.006068d4
add ebx, 4
add esi, 4
dec ebp
jne 0x605fb5
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x9b6520
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009b6670
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9b6546
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b6532
add dl, dl
jne 0x9b6551
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b65a4
xor eax, eax
add dl, dl
jne 0x9b655e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b6645
add dl, dl
jne 0x9b656d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b6578
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b6583
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b658e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9b659a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9b653d
mov eax, 1
add dl, dl
jne 0x9b65b2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b65bd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b65a9
sub eax, ebx
mov ebx, 1
jne 0x9b65f0
mov ecx, 1
add dl, dl
jne 0x9b65d6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b65e1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b65cd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b653d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9b6607
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b6612
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b65fe
cmp eax, 0x7d00
jae 0x9b6635
cmp eax, 0x500
jb 0x9b6630
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b653d
cmp eax, 0x7f
ja 0x9b6638
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b653d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9b6666
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9b653d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10