joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f9cd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x43a32e
call fcn.00424f75
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [eax + 0x14], 8
jb 0x41f9e6
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push 1
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fae5
mov eax, dword [ebp + 0x10]
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x41fa0c
mov ecx, dword [eax]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fad8
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x18]
shr eax, 1
cmp dword [ecx + 0x10], eax
jbe 0x41fa35
mov eax, dword [ecx + 0x10]
inc eax
mov ecx, 0x10000
cmp eax, ecx
jb 0x41fa41
mov eax, ecx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call fcn.00401bbd
mov edi, dword [ebp - 0x28]
mov eax, edi
mov esi, dword [ebp - 0x2c]
sub eax, esi
sar eax, 1
add eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x41fa72
mov eax, dword [eax]
lea ecx, [ebp - 0x1c]
push ecx
push esi
lea ecx, [ebp - 0x20]
push ecx
push ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fac1
mov word [ebp - 0xe], ax
cmp edi, dword [ebp - 0x24]
je 0x41fa9e
mov word [edi], ax
add edi, 2
mov dword [ebp - 0x28], edi
jmp 0x41faae
lea eax, [ebp - 0xe]
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.0041eeb2
mov esi, dword [ebp - 0x2c]
push esi
call fcn.0042a4be
pop ecx
mov ecx, dword [ebp + 0x14]
push eax
push esi
call fcn.00401afc
mov bl, 1
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x41fad8
mov eax, dword [ebp - 0x24]
sub eax, esi
and eax, 0xfffffffe
push eax
push esi
call fcn.004012a7
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x41faf0
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
call fcn.004025c3
mov al, bl
call fcn.00424f43
ret 0x14
Function at 0x4233e9
Capabilities:
Hide graphical window

Disassembly:
and dword [0x45287c], 0
push 1
push dword [esp + 8]
mov byte [0x452871], 1
mov byte [0x452872], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401cc4
cmp dword [0x4486c0], 0
jne 0x423429
cmp byte [0x45287b], 0
je 0x423432
cmp dword [0x452874], 0
jne 0x423445
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x423534
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x4395ad
call fcn.00424fa8
cmp byte [0x45237c], 0
mov esi, dword [ebp + 8]
je 0x42361b
cmp dword [0x452390], 0
je 0x42361b
xor edi, edi
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
push 0x452380
call fcn.004214cb
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4235e0
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4235b2
mov ecx, dword [esi]
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
jb 0x4235be
mov edx, dword [ebp - 0x28]
mov eax, dword [esi + 0x10]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push edi
push edx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42361b
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
cmp eax, 0x1000
jb 0x423612
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004019a9
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.00424ef6
pop ecx
pop ecx
call fcn.00424f57
ret 4
Function at 0x426199
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4261d8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4261d8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4261d8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4261d8
cmp dword [ecx + 0x74], 0xe
jbe 0x4261d8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4385c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4385ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4385ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4063f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a97ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4046d4
call fcn.00407051
push 4
mov dword [esp + 0x18], 0
call fcn.00407ef6
mov edi, eax
add esp, 4
test edi, edi
je 0x406464
push ebx
call fcn.00406f29
mov dword [edi], eax
call fcn.00406ce8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407012
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406458
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040703a
pop ebx
jmp 0x406466
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408961
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ac520]
jne 0x40896b
repz ret
jmp fcn.0040d0bc
Function at 0x411d02
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ac520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b061
and dword [ebp - 0x14], 0
cmp dword [0x4af374], 0
mov dword [ebp - 0x18], eax
jne 0x411db5
push 0x403944
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411e5d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403938
push ebx
call edi
test eax, eax
je 0x411e5d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403928
push ebx
mov dword [0x4af374], eax
call edi
push eax
call esi
push 0x403914
push ebx
mov dword [0x4af378], eax
call edi
push eax
call esi
push 0x4038f8
push ebx
mov dword [0x4af37c], eax
call edi
push eax
call esi
mov dword [0x4af384], eax
test eax, eax
je 0x411db5
push 0x4038e0
push ebx
call edi
push eax
call esi
mov dword [0x4af380], eax
mov eax, dword [0x4af380]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411e0e
cmp dword [0x4af384], ecx
je 0x411e0e
push eax
call esi
push dword [0x4af384]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411e0e
test ebx, ebx
je 0x411e0e
call edi
test eax, eax
je 0x411e05
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411e05
test byte [ebp - 8], 1
jne 0x411e0e
or dword [ebp + 0x10], 0x200000
jmp 0x411e41
mov eax, dword [0x4af378]
cmp eax, dword [ebp - 0x18]
je 0x411e41
push eax
call esi
test eax, eax
je 0x411e41
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411e41
mov eax, dword [0x4af37c]
cmp eax, dword [ebp - 0x18]
je 0x411e41
push eax
call esi
test eax, eax
je 0x411e41
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4af374]
call esi
test eax, eax
je 0x411e5d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411e5f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408961
leave
ret
Function at 0x4a8320
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0x80c
cmp dword [0x834100], 0x37
jne 0x4a83b8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0
lea eax, [esp + 0x410]
push eax
push 0
push 0x404218
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0x404230
push 0x404280
push 0x4042c0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0x834104]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x4b4164]
mov byte [ecx + esi], al
add esp, 0x80c
ret
Function at 0x4a85e0
Capabilities:
Enumerate files on windows
Manipulate console buffer
Move file
Read .ini file

Disassembly:
mov eax, dword [0x834100]
mov ecx, dword [0x4b4164]
sub esp, 0xc7c
push ebx
push ebp
shr eax, 3
xor ebx, ebx
push esi
push edi
cmp eax, ebx
jbe 0x4a87f4
mov edi, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
jmp 0x4a8616
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [0x834100], 0x1c
jne 0x4a862d
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ecx, dword [edi + 4]
mov edx, dword [0x4ad700]
mov eax, dword [0x4ad704]
mov esi, dword [edi]
mov ebp, dword [0x4ad708]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x4ad70c]
mov edi, 0xc6ef3720
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], 0x20
jmp 0x4a866a
xor ebx, ebx
mov eax, esi
mov edx, esi
shl eax, 4
shr edx, 5
add edx, dword [esp + 0x30]
add eax, ebp
lea ecx, [edi + esi]
xor eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [0x833084], ebx
mov eax, dword [esp + 0x18]
add dword [0x833084], eax
mov edx, dword [0x833084]
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x28]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
shl ecx, 4
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x2c]
add dword [esp + 0x10], eax
cmp dword [0x834100], 0x1be
mov eax, dword [esp + 0x14]
lea ebx, [edi + eax]
jne 0x4a8704
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x34]
cmp dword [0x834100], 0x979
mov dword [0x833088], 0xff6b3619
mov dword [0x83308c], 0xffffffff
mov dword [esp + 0x18], eax
jne 0x4a876f
push 0x404110
push 0
lea eax, [esp + 0x490]
push eax
push 0x404188
push 0x4041a8
push 0x404204
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
mov eax, dword [0x834100]
sub esi, dword [esp + 0x10]
cmp eax, 0x93
je 0x4a8791
add edi, 0x61c88647
dec dword [esp + 0x20]
jne 0x4a8668
cmp eax, 0x8d4
jne 0x4a87ad
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], eax
cmp dword [0x834100], 0x17
jne 0x4a87e3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea ecx, [esp + 0x88]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add edi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x1c], edi
jne 0x4a8610
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc7c
ret
Function at 0x44aab0
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x214
lea eax, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
push 0x104
push eax
push ecx
mov word [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x44ab72
cmp eax, 0x104
jne 0x44aaf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x44ab72
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x44ab72
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x44ab72
mov ecx, dword [esp + 0x10]
push ebx
push esi
push edi
lea edx, [esp + 0x24]
push ecx
push edx
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44ab5a
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44ab5a
mov edx, dword [esp + 0x10]
mov ebx, 1
mov ax, word [edx]
mov word [ebp], ax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x214
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x214
ret 8

Function at 0x480b7d
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xd95d9592
mov fs, word [edi - 0x70]
nop
cmpsd dword [esi], dword es:[edi]
cld
xchg esi, eax
xlatb
mov dword [ebx + esi - 0x1c8d11b7], ebx
or dword [ebx + 4], 0x3944d571
jbe 0x480ba5
cmpsd dword [esi], dword es:[edi]
retf
fild dword [ecx - 0x783e9cb]
cmpsd dword [esi], dword es:[edi]
cmp dh, byte [eax + 0x68]
in eax, dx
mov edi, 0x3d1e1720
cmp dl, byte [esi]
lodsd eax, dword [esi]
adc al, 0x56
add byte [edi - 0x457c63d9], bl
cli
or al, 0x2f
lahf
daa
pushfd
cmp dword [edx - 0x14d0f306], 0xfffffff6
jmp 0x480b75
sbb dword [di + 0x67], ebp
rol dh, cl
insb byte es:[edi], dx
jnp 0x480b42
jmp 0x480b75
pop edx
cmp dword [esi], 0xbca86c86
jne 0x480b5f
mov dword [0xb915bcc7], eax
fstp dword [eax + 0x52382dee]
aam 0xcc
aam 0x77
sub dh, byte [ecx + 0x7a0e3179]
xchg ebp, eax
mov cl, 0x79
xor dword [esi], ecx
jp 0x480b3c
call 0x5d6082b2
inc esi
imul edi, dword [ecx - 0xf], 0x50ddac38
ja 0x480ba1
adc bl, byte [esi]
pop ss
out 0x13, eax
pop ss
fstpnce st(5), st(0)
mov dword [0xb600c92a], eax
sub al, 0xf9
test byte [esi + 0xc], 0x3d
sub byte [ecx - 0x52d775b3], bh
scasb al, byte es:[edi]
or byte [eax - 0x78b68194], ch
pop ebx
push edx
cmpsb byte [esi], byte es:[edi]
mov dword [0xc3c278aa], eax
jbe 0x480c0c
pop es
xchg esi, eax
leave
wait
or byte [ecx], cl
shl dword [eax + eax*8 - 0x67], 0x61
mov al, 0x50
mov ebp, 0xa000e3cb
mov ch, dh
sahf
orps xmm5, xmmword [ebx - 0x499f7c4b]
nop
jnp 0x480c28
je 0x480c05
inc ebp
mov dword [0x59d61f28], eax
sti
jl 0x480c63
push esi
std
jnp 0x480c26
or eax, 0xada4adf9
invalid
out 0x59, eax
invalid
imul esi, dword [ebp - 0x893661f], 0xfffffff8
mov dword [ebx + 0x6d], ebx
fsub st(7), st(0)
lds ebx, [esi]
pop edi
ror dword [ebx + 0x2a1260ed], 1
hlt
Function at 0x4e992a
Capabilities:
Encode data using xor

Disassembly:
fsubr st(7)
sub eax, 0xc50f4998
inc esp
retf
or eax, 0xcd180416
sahf
test al, 0xc7
lea eax, [edi + 0x14a3ccec]
movsd dword es:[edi], dword [esi]
ja 0x4e99b9
les ecx, [eax]
outsb dx, byte [esi]
mov eax, es
rcl dword [0xd62b46b3]
jno 0x4e991f
movsb byte es:[edi], byte [esi]
pushfd
inc edx
inc ebp
mov cl, bh
adc dword [edx + eax*2 - 0x7d88923d], edi
popfd
pop esi
xchg edx, ecx
sub al, 0xf2
pushal
in eax, 0x6e
fadd dword [esi]
pop ebx
pop ecx
test eax, 0xb2f33951
sbb al, 0x4e
add eax, 0xc6b66f3
xor byte [esi + 0x29], ch
enter 0x126f, 0x10
outsd dx, dword [esi]
adc dl, byte [eax]
push edx
dec edi
pop edx
and edi, ebp
popfd
push ss
js 0x4e9993
pop esi
or eax, 0x56963cb8
out dx, eax
xor bh, byte [ebx]
fisttp word [eax + 0x5a]
scasb al, byte es:[edi]
hlt
add ecx, dword [ebp + 0x6e734786]
xor esi, dword [eax]
cdq
cmc
lodsb al, byte [esi]
loopne 0x4e99db
sub ebp, ecx
aas
xchg byte [ebp + 0x78], dh
pop ebx
inc ebx
or eax, 0x4f32dcc0
cmc
movsb byte es:[edi], byte [esi]
jo 0x4e9973
salc
jb 0x4e99ca
cmp al, 0xb1
fsubr dword [eax + 0x77]
test byte [ebx - 0x7ec85359], ah
ja 0x4e993f
mov dword [0x8137aca7], eax
push edx
mov dh, 0x71
mov al, byte [0xd22b800e]
xchg ebp, eax
jp 0x4e99de
adc esi, dword [esi + 0x7b480697]
js 0x4e9a3e
mov dh, 0x97
push es
dec eax
jnp 0x4e9a49
insb byte es:[edi], dx
clc
or al, 0xd4
add dword [ebp + 0x25], esi
dec eax
pop eax
jmp 0xf6bd6ff7
sbb dh, dl
outsb dx, byte [esi]
mul bh
mov dh, 0xd6
or al, 0xab
sbb cl, ch
cmp al, 0x2d
jmp 0x4e9a4e
salc
add cl, byte [ebx - 0x5d]
mov eax, dword [0xad5f5849]
pop eax
pop edi
lodsd eax, dword [esi]
mov ah, 0x60
lodsd eax, dword [esi]
and bl, 0x42
scasb al, byte es:[edi]
in al, dx
loopne 0x4e9a09
rcr dword [ebp - 0xbf3c87f], 1
push esp
sbb bh, dl
fcmovnb st(0), st(6)
jecxz 0x4e9a69
xchg byte [edi + 0xf1fda0], dh
invalid
add dh, al
mov bl, ah
dec esp
movsd dword es:[edi], dword [esi]
retf
xlatb
fisub word [ebx]
nop
xor esi, dword [esi + 0x5d739841]
cwde
jae 0x4e9a9e
insd dword es:[edi], dx
dec edi
lahf
and al, 0xd3
push edi
add eax, 0x8cb00630
push es
mov al, 0x8c
mov cl, 0xc8
push esp
imul eax, dword [esi], 0x3b
push es
pop esi
xchg eax, edi
test al, 0xdd
and al, 0x3e
clc
inc ebx
sti
jne 0x4e9a37
test dword [ecx], ecx
xchg cl, ah
in al, dx
or bl, ch
les esi, [eax - 0x22]
and al, 0xc8
fisub word [eax + ecx*8]
jne 0x4e9a02
dec edx
sub dword [esi], ebx
pop es
inc esi
sbb al, 0x19
pop edx
wait
stosb byte es:[edi], al
or eax, 0xb9b8b3b3
or ecx, 0xffffff92
sub eax, ebp
cwde
neg edx
fsubr qword [esi + edx*8 - 0x5d5325e4]
jp 0x4e9a78
rcr byte [ecx + 0x67ed8ca1], 1
loope 0x4e9a28
aam 0xb8
adc cl, byte [edx - 0x5b5e140b]
fild dword [esi]
pop ds
test eax, 0x6706ddc3
test al, 0xbc
hlt
Function at 0x4ebfd9
Capabilities:
Encode data using xor

Disassembly:
adc al, byte [edi - 0x3ec4825]
int 0xb8
mov eax, dword [0xfd168897]
mov eax, 0x168897a1
std
dec esp
stosb byte es:[edi], al
pop es
inc edi
aam 0x81
in al, 0x56
fcom dword [ecx + 0x76]
out 0x49, eax
mov al, 0xa4
jp 0x4ebf24
push es
popal
outsd dx, dword [esi]
clc
invalid
inc esp
sub dword [edx - 0x6af679f1], ebx
pop eax
aam 2
push ebp
mov ebp, 0x86d99446
rcl dword [edi], 0x1f
out dx, al
xchg esp, eax
fld dword [esi - 0x11e0e83f]
dec ebp
push esi
jae 0x4ebf8b
mov byte [esi - 0x62], dh
add al, 0x49
loopne 0x4ebf2c
popal
test byte [ebx + 0x48], ah
push ebx
in eax, 0x4a
invalid
loope 0x4ebf98
mov eax, 0x935204c9
sti
xor ebp, dword [edx]
and edx, dword [esi]
pop ds
jnp 0x4ec04a
out 0x34, al
movsd dword es:[edi], dword [esi]
xor eax, 0x4890f828
cli
jg 0x4ec073
xor ebx, ebx
xchg esi, eax
pop ebx
imul ebx, dword gs:[esi], 0xffffffb8
ret
iretd
daa
dec eax
test al, 0xa3
jae 0x4ec0ce
invalid
rol byte [ebx + 0x5d3964a0], 1
push ebp
test al, 0xb7
xor cl, bl
dec edx
push 0x7d1ded71
sub al, 0xbd
add eax, 0xc1d4e2f2
mov eax, 0x55a58de5
iretd
push ss
or byte [esi + 0x42], 0xa4
mov ebx, 0xba5e313e
in al, 0x85
jns 0x4ec08a
pop ebx
jge 0x4ec11a
insd dword es:[edi], dx
mov fs, word [ecx]
fnstenv [esi - 0x7a87ecf7]
sti
jecxz 0x4ec0e8
iretd
pop es
cli
push ds
fstp xword [esi + 0x43]
stc
out dx, eax
call 0xaa254d19
fisub word [ecx + 0x6a1277b7]
mov dh, 0xaa
aam 0xb4
iretd

Function at 0x5cc289
Capabilities:
Encode data using xor

Disassembly:
aaa
not byte [esi + 0x7b88e539]
pushal
cmp ch, byte [edx]
dec esi
stc
test ebp, 0xbbb49816
xchg edi, eax
inc edx
hlt
outsb dx, byte [esi]
lcall 0x5b6d, 0x1665c362
pop esi
cld
push esi
ror dword [edi], 0x38
mov ecx, 0x36b936bb
cmp byte [edi + edx], dl
rcl byte [0xed772951]
pop ds
push esi
pop es
jnp 0x5cc243
sbb cl, bh
sbb byte [esi - 0x68], al
lodsb al, byte [esi]
xchg byte [ebp + 0x45a2ae55], ah
div byte [edi - 0x76e2562e]
mov ebx, 0x3b240a3c
cmp al, 0xa
and al, 0x3b
scasw ax, word es:[edi]
movsd dword es:[edi], dword [esi]
xor al, 0x51
pop edx
inc ecx
push cs
push ss
xchg ebx, eax
jb 0x5cc2bf
xchg dword fs:[esi - 0x614d7c87], esi
and eax, 0xc48495f0
invalid
Function at 0x818058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8181a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x81807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81806a
add dl, dl
jne 0x818089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8180dc
xor eax, eax
add dl, dl
jne 0x818096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81817d
add dl, dl
jne 0x8180a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8180d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x818075
mov eax, 1
add dl, dl
jne 0x8180ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8180e1
sub eax, ebx
mov ebx, 1
jne 0x818128
mov ecx, 1
add dl, dl
jne 0x81810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x818119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x818105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x818075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x81813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x81814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x818136
cmp eax, 0x7d00
jae 0x81816d
cmp eax, 0x500
jb 0x818168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x818075
cmp eax, 0x7f
ja 0x818170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x818075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x81819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x818075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x484cda
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x484a08
or edi, eax
add edi, 0xada852d3
call fcn.00484d16
dec eax
add edi, eax
add eax, 0x7ea0daf4
xor dword [ebx], edx
or edi, edi
add eax, 0x37e53fae
add ebx, 2
mov eax, eax
cmp ebx, esi
jl fcn.00484cda
inc eax
add edi, eax
ret
Function at 0x7cf370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x7cf38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x7f8074
push ecx
mov edi, eax
call fcn.007e3198
mov esi, eax
add esp, 8
test esi, esi
jne 0x7cf3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.007e302e
push esi
call fcn.007e2fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret