joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002dba0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002dc25
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002dbd8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x1002dc23
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002dc06
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002dc23
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10009a26
mov dword [eax], 0x421a0e57
jmp 0x1002dbfb
jmp 0x1002dc4a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.10029a84
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1002dc4e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002dc73
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 1
call fcn.1002dd30
pop ecx
pop ecx
jmp 0x1002dd2c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002dd22
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x1002dcde
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1002dcde
mov dword [ebp - 0x30], 1
jmp 0x1002dce2
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jl 0x1002dd0f
mov dword [ebp - 0xc], 1
jmp 0x1002dd13
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
add eax, 0x6b0e
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
jmp 0x1002dd2c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret
Function at 0x1002ddcd
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1002ddfc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 4], eax
push 1
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.1002de80
add esp, 0xc
jmp 0x1002de7c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002de5e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1002de7c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1002de7c
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esp, ebp
pop ebp
ret
Function at 0x100349ce
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x20]
push 3
call fcn.100099bf
xor ebx, ebx
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0xc], ebx
jmp 0x10034a00
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov dword [eax + ecx*4], 0x7ddc85f7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100349f0
mov eax, dword [ebp - 0x20]
push eax
mov dword [eax], ebx
call fcn.1004c427
pop ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
cmp byte [esi], bl
je 0x10034b91
push edi
xor edi, edi
mov dword [ebp - 8], 0x24a8c6a5
inc edi
lea ecx, [ebp - 0x2c]
push edi
call fcn.100099bf
mov dword [ebp - 0xc], 0x8364
mov dword [ebp - 0xc], ebx
jmp 0x10034a4f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x10034a43
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 8], 3
jmp 0x10034a7b
mov dword [ebp - 0x14], 0xfffffffd
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10034a75
push ebx
call esi
mov eax, dword [ebp - 0x14]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff6
jl 0x10034a63
cmp dword [ebp - 8], ebx
je 0x10034b51
mov dword [ebp - 0x14], 0x5fa31871
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], ebx
jmp 0x10034b46
mov dword [ebp - 0xc], 0xf3938425
xor ecx, ecx
mov dword [ebp - 0x10], 0xfffffff9
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10]
inc edx
cmp edx, eax
setg cl
cmp ecx, 0xd3d47825
jbe 0x10034ad1
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setne cl
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [ecx - 0x1c443818]
mov dword [ebp - 0x10], eax
imul eax, dword [ebp - 0x10], 0x55a
sub eax, 0x1078
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
je 0x10034b18
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
jmp 0x10034b3e
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10034b3b
push 0x1d5
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x10034b20
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x10034a9c
jmp 0x10034b7f
mov dword [ebp - 0x14], 8
mov dword [ebp - 0xc], ebx
jmp 0x10034b72
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10034b6f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffd
jl 0x10034b5d
mov dword [ebp - 0x14], 0xb0c3
pop edi
cmp dword [ebp - 0x2c], ebx
je 0x10034b8e
push dword [ebp - 0x2c]
call fcn.1004c427
pop ecx
push ebx
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10040390
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1004052b
push ebx
push edi
push dword [esi]
xor ebx, ebx
push ebx
push dword [esi + 4]
call fcn.10038b76
add esp, 0xc
mov dword [ebp - 8], 0x24a8c6a5
xor edi, edi
lea ecx, [ebp - 0x20]
inc edi
push edi
call fcn.100099bf
mov dword [ebp - 0xc], 0x8364
mov dword [ebp - 0xc], ebx
jmp 0x100403df
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x100403d3
mov dword [ebp - 8], 3
jmp 0x10040409
mov dword [ebp - 0x14], 0xfffffffd
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10040403
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x14]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff6
jl 0x100403ed
cmp dword [ebp - 8], ebx
je 0x100404df
mov dword [ebp - 0x14], 0x5fa31871
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], ebx
jmp 0x100404d4
mov dword [ebp - 0xc], 0xf3938425
xor ecx, ecx
mov dword [ebp - 0x10], 0xfffffff9
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10]
inc edx
cmp edx, eax
setg cl
cmp ecx, 0xd3d47825
jbe 0x1004045f
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [ecx - 0x1c443818]
mov dword [ebp - 0x10], eax
imul eax, dword [ebp - 0x10], 0x55a
sub eax, 0x1078
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
je 0x100404a6
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
jmp 0x100404cc
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x100404c9
push 0x1d5
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x100404ae
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x1004042a
jmp 0x1004050d
mov dword [ebp - 0x14], 8
mov dword [ebp - 0xc], ebx
jmp 0x10040500
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x100404fd
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffd
jl 0x100404eb
mov dword [ebp - 0x14], 0xb0c3
cmp dword [ebp - 0x20], ebx
je 0x1004051b
push dword [ebp - 0x20]
call fcn.1004c427
pop ecx
push dword [esi + 4]
call fcn.1004c427
pop ecx
pop edi
mov dword [esi + 4], ebx
mov dword [esi], ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005fd15
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10069740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10051c18
mov dword [ebp - 0x14], eax
cmp dword [0x10656328], esi
jne 0x1005fe08
push 0x800
push esi
push 0x100075f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1005fd95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1005fee8
push esi
push esi
push 0x100075f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1005fee8
push 0x10007608
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005fee8
push eax
call ebx
push 0x10007614
push edi
mov dword [0x10656328], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007624
push edi
mov dword [0x1065632c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007638
push edi
mov dword [0x10656330], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10656338], eax
test eax, eax
je 0x1005fe05
push 0x10007654
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10656334], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005fe2d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005fe20
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1005fe42
push 4
pop eax
jmp 0x1005feea
cmp dword [ebp - 0x14], esi
je 0x1005fe42
push dword [0x10656328]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1005fe27
mov eax, dword [0x10656334]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1005fea0
cmp dword [0x10656338], edi
je 0x1005fea0
push eax
call ebx
push dword [0x10656338]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1005fea0
test eax, eax
je 0x1005fea0
call ecx
test eax, eax
je 0x1005fe95
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1005fe95
test byte [ebp - 8], 1
jne 0x1005fea0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1005fed0
mov eax, dword [0x1065632c]
cmp eax, edi
je 0x1005fecd
push eax
call ebx
test eax, eax
je 0x1005fecd
call eax
mov esi, eax
test esi, esi
je 0x1005fecd
mov eax, dword [0x10656330]
cmp eax, edi
je 0x1005fecd
push eax
call ebx
test eax, eax
je 0x1005fecd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10656328]
call ebx
test eax, eax
je 0x1005fee8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005feea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004f1a1
mov esp, ebp
pop ebp
ret
Function at 0x5da4dd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5da4f8
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x1249f71d]
pop edx
test eax, eax
je 0x5da5ca
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5da5b9
test dword [ebp - 0x2a8], 1
jne 0x5da5b9
and dword [ebp - 0x2a8], 0x100
jne 0x5da5b9
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3abf]
pop edx
pop esi
test eax, eax
je 0x5da55c
jmp 0x5da5b9
cmp word [esi], 0x5a4d
jne 0x5da5b9
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5da5b9
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3d17]
pop edx
test eax, eax
je 0x5da5b9
lea eax, [ebp - 0x28c]
push eax
call fcn.005da439
test eax, eax
jne 0x5da5b2
jmp 0x5da5b9
mov eax, esi
jmp 0x5da5ca
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5da4f8
pop esi
leave
ret 4
Function at 0x402970
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4029ae
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4029a6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4029b0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x402996
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x402a80
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x402a96
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x402ab1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x338b0859
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7b641836
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x5a0c26b4
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x72424387
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x185d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0185d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x185d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x185d06a
add dl, dl
jne 0x185d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x185d0dc
xor eax, eax
add dl, dl
jne 0x185d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x185d17d
add dl, dl
jne 0x185d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x185d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x185d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x185d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x185d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x185d075
mov eax, 1
add dl, dl
jne 0x185d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x185d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x185d0e1
sub eax, ebx
mov ebx, 1
jne 0x185d128
mov ecx, 1
add dl, dl
jne 0x185d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x185d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x185d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x185d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x185d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x185d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x185d136
cmp eax, 0x7d00
jae 0x185d16d
cmp eax, 0x500
jb 0x185d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x185d075
cmp eax, 0x7f
ja 0x185d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x185d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x185d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x185d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x683da7
Capabilities:
Encode data using xor

Disassembly:
or esi, dword [edx + 0x3b]
fisubr word [ecx + edx*8 - 0x586916ce]
push edx
sub al, 0x37
or dl, byte [ecx + 0x71]
invalid
movzx esi, cx
pop esi
popal
mov eax, dword [ebp + 0x12459dfb]
jmp 0x683b96
mov dword [ebp + 0x122d2e21], eax
jmp 0x683bb0
cmp dword [ebp + 0x122d2eb9], 1
je 0x683deb
cmc
mov eax, 0x7fbaea25
push edx
mov edx, 0x7fb35f38
or edx, 0x34de48b7
neg edx
xor edx, 0x45b69a
add eax, edx
pop edx
pushal
push ebx
sub esi, 0x3a0ca5a9
pop edx
mov ax, di
popal
cmp dword [ebp + 0x12542d1a], 0
je 0x683c20
jmp 0x683c03
call dword [ebp + 0x122d335b]
jmp 0x683c20
cmp byte [edi], 0x90
je 0x683c52
pushal
clc
or dx, 0xb5af
popal
push ecx
push ebx
mov ebx, 5
mov ecx, ebx
pop ebx
add edi, ecx
pop ecx
clc
jmp 0x683ee0
cmp dword [ebp + 0x12542f1f], 0
je 0x683d06
pushal
je 0x683c68
pushal
popal
call fcn.00683c7b
push ebp
add al, 0xda
mov dword [0xaadb491a], eax
invalid
mov ebx, 0x767f7f00
sub ebx, 0x6928599f
xor ebx, 0x7fdb598f
shl ebx, 6
push ebp
mov ebp, 0xa31f3b80
sub ebx, ebp
pop ebp
je 0x683d3f
jo 0x683d3f
jmp 0x683d3f
test ebx, ebx
je 0x683d6c
jo 0x683d4e
cld
jmp 0x683deb
cmp eax, 0x50
jb 0x683deb
stc
mov al, 0x41
shl al, 7
push ecx
mov ch, 0xae
or ch, 0xaf
inc ch
add ch, 0x36
xor ch, 0x53
xor ch, 0x45
sub al, ch
pop ecx
jo 0x683d96
cld
stosb byte es:[edi], al
jo 0x683da4
jb 0x683da4
cmc
mov eax, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
stc
stosb byte es:[edi], al
cmc
jmp 0x683e86
push dword [esp]
pop eax
add esp, 4
pushal
jno 0x683dfe
adc cx, 0x699c
adc di, 0xec08
popal
stosb byte es:[edi], al
pushal
mov cl, 0x75
popal
cmp byte [edi - 1], 0xe9
jne 0x683e86
pushal
sub ax, 0x6313
popal
cmp dword [ebp + 0x12542d1a], 0
je 0x683e5b
jl 0x683e4b
jge 0x683e4b
jmp 0x683e4b
stc
call dword [ebp + 0x122d3514]
pushal
mov di, bx
mov bx, 0x8795
popal
push ecx
push esi
mov esi, 0x7ddd0465
or esi, 0x7ff837f2
xor esi, 0x7ffd37f3
mov ecx, esi
pop esi
add ecx, edi
mov byte [ecx], al
pop ecx
jmp 0x683e86
mov eax, dword [ebp + 0x12459dfb]
pushal
jle 0x683e95
mov bh, dl
jmp 0x683ea1
popal
add eax, 0x37b94394
add eax, 0x7d39edbd
sub eax, edi
sub eax, 0x7d39edbd
sub eax, 0x37b94394
clc
push 0x7bdafc09
mov dword [esp], esi
mov esi, 4
sub eax, esi
pop esi
cld
stosd dword es:[edi], eax
jmp 0x683ee0
lodsd eax, dword [esi]
pushal
jge 0x683f00
jmp 0x683f00
push edi
sbb ebx, 0x44a0a461
pop esi
popal
push eax
mov eax, 0
push eax
add dword [esp], 0x6fff2ecc
pop dword [esi - 4]
sub dword [esi - 4], 0x6fff2ecc
pop eax
jl 0x683f47
ja 0x683f47
jmp 0x683f47
jmp 0x683872