joyce8/EMBER2024-capa huggingface dataset:
Function at 0x73ce5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x73ce51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x73ce507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x73ce506a
add dl, dl
jne 0x73ce5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x73ce50dc
xor eax, eax
add dl, dl
jne 0x73ce5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x73ce517d
add dl, dl
jne 0x73ce50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x73ce50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x73ce50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x73ce50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x73ce50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x73ce5075
mov eax, 1
add dl, dl
jne 0x73ce50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x73ce50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x73ce50e1
sub eax, ebx
mov ebx, 1
jne 0x73ce5128
mov ecx, 1
add dl, dl
jne 0x73ce510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x73ce5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x73ce5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x73ce5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x73ce513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x73ce514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x73ce5136
cmp eax, 0x7d00
jae 0x73ce516d
cmp eax, 0x500
jb 0x73ce5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x73ce5075
cmp eax, 0x7f
ja 0x73ce5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x73ce5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x73ce519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x73ce5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x406243
pop dword [ebp - 0x30]
mov eax, 0x406243
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x262e9e73
sub dword [ebp - 0x40], 0xd7dc5928
mov dword [ebp - 0x3c], 0x7301a880
add dword [ebp - 0x3c], 0xbf31a3c5
mov dword [ebp - 0x38], 0x2f911a71
add dword [ebp - 0x38], 0x1cbb29bd
mov dword [ebp - 0x34], 0xb9378d1f
sub dword [ebp - 0x34], 0xb9378d1f
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xdec326b7
sub dword [ebp - 0x40], 0x6a50bd61
mov dword [ebp - 0x3c], 0x5f0a30b6
add dword [ebp - 0x3c], 0xe26230bf
mov dword [ebp - 0x38], 0xb96a078
add dword [ebp - 0x38], 0x57d8cbf4
mov dword [ebp - 0x34], 0x10769417
sub dword [ebp - 0x34], 0x10769417
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3e387
push 0
call eax
mov ecx, 0x64ca
mov edx, eax
mov ebx, 0xb7408c7c
add ebx, 0x49065784
add ebx, dword [ebp - 0x30]
mov esi, 0xf9478bc4
sub dword [ebp - 0x18], 0xd6701686
mov edi, dword [ebx]
xor dword [ebp - 4], 0x1cb913d9
add edi, esi
add dword [ebp - 0x20], 0x434d8ee1
mov dword [edx], edi
add dword [ebp - 8], 0xe4b45978
add edx, 0x45dd27ea
sub edx, 0x45dd27e6
add ebx, 0xfccbf77c
add ebx, 0x3340888
loop 0x40634a
add eax, 0xa7a7f4ed
sub eax, 0xa7a66ef2
mov ebx, eax
add eax, 0xb4b1afcf
sub eax, 0xb4b1afca
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x4f49d920
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, ebx
and al, 0x10
movzx eax, al
neg eax
push esi
sbb eax, eax
and eax, 0x4e0
push edi
add eax, 0x50
push eax
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4f49dade
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0xc]
jne 0x4f49d962
mov ecx, 0x4f483e30
call fcn.4f4d3288
mov dword [esi + 0xc], eax
test eax, eax
je 0x4f49dade
mov dword [esi + 8], esi
mov dword [esi + 0x14], ebx
test bl, 5
je 0x4f49d9a3
mov eax, ebx
and al, 4
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x4f515ee0
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WINSPOOL.DRV_OpenPrinterW]
test eax, eax
je 0x4f49dade
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
test bl, 2
je 0x4f49da07
mov ecx, dword [ebp + 8]
push 2
pop edx
mov dword [ebp - 4], 0x603
call fcn.4f4e7537
mov edi, eax
test edi, edi
je 0x4f49d9eb
cmp dword [edi], 0
jne 0x4f49d9ef
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4f483e48
push dword [ebp + 8]
call dword [sym.imp.WINSPOOL.DRV_GetPrinterDataW]
test eax, eax
je 0x4f49d9ef
and dword [ebp - 4], 0
test edi, edi
je 0x4f49d9fa
push edi
call dword [sym.imp.kernel32.dll_LocalFree]
cmp dword [ebp - 4], 0x603
jne 0x4f49dade
mov ecx, dword [ebp + 8]
push 3
call fcn.4f4e7537
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x4f49dade
test bl, 8
je 0x4f49da40
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x603
push eax
push 4
push 0x4f483e48
push dword [ebp + 8]
call dword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
test bl, 0x40
je 0x4f49da65
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x4f49da65
call fcn.4f4e7537
mov edi, eax
test edi, edi
je 0x4f49da65
push edi
call dword [sym.imp.kernel32.dll_DeleteFileW]
push edi
call dword [sym.imp.kernel32.dll_LocalFree]
mov edx, dword [ebp + 0xc]
lea edi, [esi + 0x20]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push ebx
call fcn.4f4e7537
cmp dword [ebp - 4], 0
mov dword [esi + 0x18], eax
je 0x4f49da8b
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_LocalFree]
mov edx, dword [esi + 0x18]
test edx, edx
je 0x4f49dade
mov eax, dword [edi]
test eax, eax
je 0x4f49dade
mov ecx, dword [eax + 0x2c]
add eax, ecx
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x24], ecx
je 0x4f49dade
mov edx, dword [edx + 0x10]
push edx
mov edx, dword [edx + 0x14]
call fcn.4f4e7537
mov dword [esi + 0x28], eax
test eax, eax
je 0x4f49dade
mov dword [eax], esi
mov ecx, esi
mov edx, dword [esi + 0x28]
push 1
call fcn.4f4e7537
test eax, eax
je 0x4f49dade
mov dword [esi], 8
mov eax, esi
mov dword [esi + 4], 0x4f4813c8
jmp 0x4f49dae6
push esi
call fcn.4f4e7537
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f4e7537
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4f4e7546
pop dword [ebp - 0x44]
mov eax, 0xeda765cf
sub eax, 0x9e58f089
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x5e55e
push 0
mov eax, 0x73ef9cc3
sub eax, 0x249e2c73
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xd02460b4
sub ecx, 0xd024094d
mov esi, eax
mov edx, 0xee785954
add edx, 0x60dde8ac
add edx, dword [ebp - 0x44]
mov edi, 0xc5c756e2
xor dword [ebp - 4], edi
mov ebx, dword [edx]
mov dword [ebp - 0x20], 0x11f66233
sub ebx, edi
xor dword [ebp - 0x28], 0xd16d3d21
mov dword [esi], ebx
add dword [ebp - 0x10], 0x4b1c9c2d
add esi, 0x43b5bbb3
sub esi, 0x43b5bbaf
add edx, 0x84bc30a0
add edx, 0x7b43cf64
loop 0x4f4e759f
add eax, 0x777db021
sub eax, 0x777c5fb2
mov ebx, eax
add eax, 5
mov ecx, 0xec8aeb70
add ecx, 0x62bd1490
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x498190
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x61000]
push edi
jmp 0x4981aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4981b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4981a0
mov eax, 1
add ebx, ebx
jne 0x4981c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4981d4
jne 0x4981f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4981f3
dec eax
add ebx, ebx
jne 0x4981e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4981b8
add ebx, ebx
jne 0x4981ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x498245
xor ecx, ecx
sub eax, 3
jb 0x49820b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49827a
sar eax, 1
mov ebp, eax
jmp 0x498216
add ebx, ebx
jne 0x498216
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4981e4
inc ecx
add ebx, ebx
jne 0x498224
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4981e4
add ebx, ebx
jne 0x498231
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x498226
jne 0x498242
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x498226
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x498264
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x498256
jmp 0x4981a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x498264
add edi, ecx
jmp 0x4981a6
pop esi
mov edi, esi
mov ecx, 0x3021
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x498282
cmp byte [edi], 0x19
jne 0x498282
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x498287
lea edi, [esi + 0x95000]
mov eax, dword [edi]
or eax, eax
je 0x4982ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9e8f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9ea0c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4982b4
mov ecx, edi
jns 0x4982e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9ea10]
or eax, eax
je 0x4982f9
mov dword [ebx], eax
add ebx, 4
jmp 0x4982d1
call dword [esi + 0x9ea20]
mov ebp, dword [esi + 0x9ea14]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x498333
sub esp, 0xffffff80
jmp 0x45282d

Function at 0x8ada58
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8ada62
pushal
call 0x8ada68
pop ebp
sub ebp, 0x10
sub ebp, 0x4ada58
jmp 0x8ada7e
mov eax, 0x4ada58
add eax, ebp
add eax, 0x4c
mov ecx, 0x602
mov edx, 0x9a93a49
xor byte [eax], dl
inc eax
dec ecx
jne 0x8ada95
jmp 0x8adaa8
ret 0xc284
Function at 0x6d574769
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x6d574778
pop dword [ebp - 0x48]
mov eax, 0x25601717
add eax, 0x47f73061
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xd2846
sub dword [ebp - 0x58], 0xb1bae2fb
mov dword [ebp - 0x54], 0xf6009a90
sub dword [ebp - 0x54], 0xc3cd4e4b
mov dword [ebp - 0x50], 0x566b8855
sub dword [ebp - 0x50], 0xa1f4427
mov dword [ebp - 0x4c], 0x95386e53
add dword [ebp - 0x4c], 0x6ac791ad
lea eax, [ebp - 0x58]
push eax
mov eax, 0x7750441
sub eax, 0x9a1d7415
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x969186e1
add dword [ebp - 0x58], 0xdde0e275
mov dword [ebp - 0x54], 0xf283456c
sub dword [ebp - 0x54], 0xb116e3f7
mov dword [ebp - 0x50], 0x58fcc737
add dword [ebp - 0x50], 0xa72a535
mov dword [ebp - 0x4c], 0xc1e18f25
sub dword [ebp - 0x4c], 0xc1e18f25
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xea3dbc0c
add eax, 0x8319d41c
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3d7e4
push 0
call eax
mov ecx, 0xe25b0374
add ecx, 0x1da55d46
xor esi, esi
add esi, eax
mov edx, 0x6d57ee00
add edx, dword [ebp - 0x48]
mov ebx, 0x629207a
sub ebx, 0x8bc39ef6
xor dword [ebp - 0x18], 0x7ea770d2
mov edi, dword [edx]
add dword [ebp - 0x18], eax
add edi, ebx
xor dword [ebp - 0x44], ecx
mov dword [esi], edi
add dword [ebp - 0x30], edi
add esi, 4
add edx, 4
loop 0x6d574896
add eax, 0x175bb
mov ebx, eax
add eax, 0x4d1a6735
sub eax, 0x4d1a6730
mov ecx, 0x6d570000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x8a8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008a81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8a807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8a806a
add dl, dl
jne 0x8a8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8a80dc
xor eax, eax
add dl, dl
jne 0x8a8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8a817d
add dl, dl
jne 0x8a80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8a80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8a8075
mov eax, 1
add dl, dl
jne 0x8a80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8a80e1
sub eax, ebx
mov ebx, 1
jne 0x8a8128
mov ecx, 1
add dl, dl
jne 0x8a810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8a8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8a8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8a8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8a813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8a814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8a8136
cmp eax, 0x7d00
jae 0x8a816d
cmp eax, 0x500
jb 0x8a8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8a8075
cmp eax, 0x7f
ja 0x8a8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8a8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8a819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8a8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4144a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
jmp 0x4144ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4144c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4144b0
mov eax, 1
add ebx, ebx
jne 0x4144d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4144c8
jne 0x4144e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4144c8
xor ecx, ecx
sub eax, 3
jb 0x4144f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41456a
mov ebp, eax
add ebx, ebx
jne 0x414503
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414510
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414534
inc ecx
add ebx, ebx
jne 0x414520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414515
jne 0x414531
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414515
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414554
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414545
jmp 0x4144b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414554
add edi, ecx
jmp 0x4144b6
pop esi
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x4145bc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14790]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1484c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414571
mov ecx, edi
jns 0x4145a0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14854]
or eax, eax
je 0x4145b6
mov dword [ebx], eax
add ebx, 4
jmp 0x41458e
call dword [esi + 0x14850]
mov ebp, dword [esi + 0x14858]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4145f0
sub esp, 0xffffff80
jmp 0x403966

Function at 0x79d2cc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x79d2d6
pushal
call 0x79d2dc
pop ebp
sub ebp, 0x10
sub ebp, 0x39d2cc
jmp 0x79d2f2
mov eax, 0x39d2cc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f7
mov edx, 0x43bf83e9
xor byte [eax], dl
inc eax
dec ecx
jne 0x79d309
jmp 0x79d31c
bound esp, qword [edx]
pushal
aad 0xe9
jmp 0x11a23c10
Function at 0x10592058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105921a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1059207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1059206a
add dl, dl
jne 0x10592089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105920dc
xor eax, eax
add dl, dl
jne 0x10592096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1059217d
add dl, dl
jne 0x105920a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105920b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105920bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105920c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105920d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10592075
mov eax, 1
add dl, dl
jne 0x105920ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105920f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105920e1
sub eax, ebx
mov ebx, 1
jne 0x10592128
mov ecx, 1
add dl, dl
jne 0x1059210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10592119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10592105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10592075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1059213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1059214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10592136
cmp eax, 0x7d00
jae 0x1059216d
cmp eax, 0x500
jb 0x10592168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10592075
cmp eax, 0x7f
ja 0x10592170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10592075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1059219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10592075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x7a1384
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a138e
pushal
call 0x7a1394
pop ebp
sub ebp, 0x10
sub ebp, 0x3a1384
jmp 0x7a13aa
mov eax, 0x3a1384
add eax, ebp
add eax, 0x4c
mov ecx, 0x5dc
add byte [ecx + 0x5dc], bh
mov edx, 0xba2fc8dc
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a13c1
jmp 0x7a13d4
push edi
adc dword [edi + 0x55], edx
loopne 0x7a13b6
invalid
Function at 0x42a8c2
Capabilities:
Hash data with md5

Disassembly:
push esi
xor ecx, ecx
push 0x40
lea esi, [eax + 0x58]
push ecx
push esi
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
call fcn.0050ddb4
add esp, 0xc
mov byte [esi], 0x80
pop esi
ret
Function at 0x42de18
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x101a90bc]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push 0x58
xor esi, esi
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0050ddb4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], esi
push ebx
lea esi, [ebp - 0x64]
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.0042de7e
add esp, 0x10
mov edx, edi
mov ecx, esi
call fcn.0042df14
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0050dcbe
leave
ret
Function at 0x4331c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
cmp dword [ebp + 8], ecx
push esi
push edi
je 0x433218
cmp dword [ebp + 0xc], ecx
je 0x433218
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0xc], ecx
jbe 0x433218
push 0x5851f42d
push 0x4c957f2d
push ecx
push eax
call fcn.00520fa0
add eax, 1
adc edx, 0
mov ecx, edx
mov ebx, eax
mov edi, ecx
shrd ebx, edi, 0x13
mov edx, esi
and edx, 3
xor bl, byte [ebp + edx + 0x10]
shr edi, 0x13
mov edi, dword [ebp + 8]
xor byte [esi + edi], bl
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4331df
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44a654
Capabilities:
Encode data using xor

Disassembly:
push 0x278
mov eax, 0x1012599c
call fcn.0052113b
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x274], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [eax - 0xc]
xor ebx, ebx
cmp ecx, ebx
jne 0x44a681
xor eax, eax
jmp 0x44a786
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [0x101392dc]
cmp eax, 0xffffffff
je 0x44a67a
push eax
call dword [0x101392f4]
mov edi, dword [ebp - 0x240]
cmp edi, ebx
mov dword [ebp - 0x268], edi
je 0x44a67a
mov esi, dword [esi + 0x10]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [0x10139344]
cmp eax, 0xffffffff
mov dword [ebp - 0x26c], eax
je 0x44a67a
lea eax, [ebp - 0x261]
push eax
add edi, 2
lea esi, [ebp - 0x284]
mov dword [ebp - 0x270], ebx
mov byte [ebp - 0x261], bl
call fcn.00424c36
mov edi, dword [ebp - 0x268]
push ebx
lea eax, [ebp - 0x270]
push eax
push edi
push ebx
mov dword [ebp - 4], ebx
call fcn.00424ca7
push eax
push dword [ebp - 0x26c]
call dword [0x1013935c]
test eax, eax
je 0x44a769
cmp dword [ebp - 0x270], edi
jne 0x44a769
cmp edi, ebx
mov dword [ebp - 0x268], ebx
jbe 0x44a74e
push dword [ebp - 0x268]
lea esi, [ebp - 0x284]
call fcn.00424ca7
xor byte [eax], 0x4e
inc dword [ebp - 0x268]
cmp dword [ebp - 0x268], edi
jb 0x44a72c
push ebx
lea esi, [ebp - 0x284]
call fcn.00424ca7
push eax
push dword [ebp - 0x274]
call fcn.00408a40
xor ebx, ebx
inc ebx
push dword [ebp - 0x26c]
call dword [0x10139340]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x284]
call fcn.00424c84
mov eax, ebx
call fcn.005211be
ret 4