joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4241b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
test byte [esi + 0x18], 1
je 0x4241d5
push 0xcda17e
push esi
call fcn.00423f30
pop ebp
pop eax
cmp dword [esp + 0x38], 0xd
je 0x4241e9
push 0xcda190
push esi
call fcn.00423f30
pop ebx
pop edi
or dword [esi + 0x18], 1
push 0xd
lea ebx, [esp + 0x10]
push ebx
push esi
call fcn.004240ad
push 0
push esi
call fcn.00424138
push ebx
push esi
call fcn.00424073
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00424073
mov dword [esp + 0x28], eax
movzx eax, byte [esp + 0x3b]
movzx ebp, byte [esp + 0x38]
movzx ecx, byte [esp + 0x39]
movzx edi, byte [esp + 0x3a]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
movzx ebx, byte [esp + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x28]
add esp, 0x24
mov byte [esi + 0xd3], bl
mov dword [esi + 0x7c], eax
mov eax, ebp
mov byte [esi + 0xd7], al
mov eax, edi
mov byte [esi + 0x12c], al
movzx eax, cl
cmp eax, 6
mov byte [esi + 0xd6], cl
ja 0x424297
jmp dword [eax*4 + 0xcda1a4]
movzx eax, byte [esi + 0xda]
mov edx, dword [esi + 0x78]
mul byte [esi + 0xd7]
cmp al, 7
mov byte [esi + 0xd9], al
jbe 0x4242bc
shr al, 3
movzx eax, al
imul eax, edx
jmp 0x4242c8
movzx eax, al
imul edx, eax
lea eax, [edx + 7]
shr eax, 3
mov dword [esi + 0x88], eax
push dword [esp]
push edi
push ebx
push ecx
push ebp
push dword [esp + 0x18]
push dword [esp + 0x20]
push dword [esp + 0x50]
push esi
call fcn.00422cc0
add esp, 0x40
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x424ea5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
push eax
push eax
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x94]
inc eax
cmp eax, dword [esi + 0x80]
mov dword [esi + 0x94], eax
jb 0x42510b
cmp byte [esi + 0xd3], 0
je 0x424fa5
mov dword [esi + 0x94], 0
mov eax, dword [esi + 0x88]
inc eax
push eax
push 0
push dword [esi + 0x98]
push esi
call fcn.00423dec
add esp, 0x10
movzx eax, byte [esi + 0xd4]
inc al
cmp al, 6
mov byte [esi + 0xd4], al
ja 0x424fa5
movzx ecx, al
mov edx, dword [ecx*4 + 0xcd9458]
mov eax, dword [esi + 0x78]
mov ebx, edx
add eax, edx
xor edx, edx
sub eax, dword [ecx*4 + 0xcd9474]
dec eax
div ebx
mov ecx, eax
mov dword [esi + 0x90], eax
movzx eax, byte [esi + 0xd9]
cmp al, 7
jbe 0x424f4b
shr al, 3
movzx eax, al
imul ecx, eax
lea eax, [ecx + 1]
jmp 0x424f58
movzx eax, al
imul ecx, eax
lea eax, [ecx + 7]
shr eax, 3
inc eax
test byte [esi + 0x20], 2
mov dword [esi + 0x8c], eax
jne 0x424f98
movzx ecx, byte [esi + 0xd4]
mov eax, dword [esi + 0x7c]
mov edx, dword [ecx*4 + 0xcd9420]
add eax, edx
sub eax, dword [ecx*4 + 0xcd943c]
mov ecx, edx
xor edx, edx
dec eax
div ecx
cmp dword [esi + 0x90], 0
mov dword [esi + 0x80], eax
je 0x424ef6
cmp byte [esi + 0xd4], 6
jbe 0x42510b
test byte [esi + 0x1c], 0x20
jne 0x4250e1
mov dword [esi + 0x34], 1
lea eax, [esp + 7]
mov dword [esi + 0x30], eax
cmp dword [esi + 0x28], 0
jne 0x425064
cmp dword [esi + 0xbc], 0
jne 0x42502d
push 0
push esi
call fcn.00424138
push 4
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.00421ae0
push ebx
lea ebx, [esi + 0xcc]
push esi
call fcn.00424073
mov dword [esi + 0xbc], eax
push esi
call fcn.00421785
add esp, 0x20
push 4
push ebx
push esi
call fcn.004240ad
push 4
push 0xcd94ef
push ebx
call fcn.00431aa0
add esp, 0x18
test eax, eax
je 0x424fc7
push 0xcda3e0
push esi
call fcn.00423f30
pop ebx
pop eax
jmp 0x424fc7
mov eax, dword [esi + 0x5c]
mov edx, dword [esi + 0x60]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0xbc]
mov dword [esi + 0x28], edx
cmp edx, eax
jbe 0x425046
mov dword [esi + 0x28], eax
push dword [esi + 0x28]
push dword [esi + 0x5c]
push esi
call fcn.004240ad
mov eax, dword [esi + 0xbc]
add esp, 0xc
sub eax, dword [esi + 0x28]
mov dword [esi + 0xbc], eax
push 1
lea eax, [esi + 0x24]
push eax
call fcn.00426c21
pop edx
cmp eax, 1
pop ecx
jne 0x4250a2
cmp dword [esi + 0x34], 0
je 0x42508b
cmp dword [esi + 0x28], 0
jne 0x42508b
cmp dword [esi + 0xbc], 0
je 0x425098
push 0xcda3f6
push esi
call fcn.00423e30
pop ecx
pop ebx
or dword [esi + 0x18], 8
or dword [esi + 0x1c], 0x20
jmp 0x4250da
test eax, eax
je 0x4250bb
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x4250b2
mov eax, 0xcda40c
push eax
push esi
call fcn.00423f30
pop eax
pop edx
cmp dword [esi + 0x34], 0
jne 0x424fbd
push 0xcda420
push esi
call fcn.00423e30
or dword [esi + 0x18], 8
or dword [esi + 0x1c], 0x20
pop ecx
pop ebx
mov dword [esi + 0x34], 0
cmp dword [esi + 0xbc], 0
jne 0x4250f0
cmp dword [esi + 0x28], 0
je 0x4250fd
push 0xcda437
push esi
call fcn.00423e30
pop eax
pop edx
lea eax, [esi + 0x24]
push eax
call fcn.00426950
or dword [esi + 0x18], 8
pop eax
pop esi
pop eax
pop ebx
pop esi
ret
Function at 0x4256d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x34], 6
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x38]
ja 0x4257bf
mov eax, dword [esp + 0x34]
jmp dword [eax*4 + 0xcda610]
push 0xcda584
push esi
call fcn.00423f30
pop ecx
pop eax
test ebp, ebp
je 0x4257df
push 0xcda5a7
xor ebp, ebp
push esi
call fcn.00423e30
pop eax
pop edx
cmp dword [esp + 0x3c], 0
je 0x4257fb
push 0xcda5ca
push esi
call fcn.00423e30
mov dword [esp + 0x44], 0
pop ecx
pop eax
cmp dword [esp + 0x40], 1
jbe 0x425817
push 0xcda5e8
push esi
call fcn.00423e30
mov dword [esp + 0x48], 1
pop eax
pop edx
mov dword [esi + 0x78], ebx
mov eax, edi
mov byte [esi + 0xd7], al
movzx ecx, byte [esp + 0x34]
movzx edx, byte [esi + 0xda]
mov byte [esi + 0xd6], cl
mov ecx, ebp
movzx eax, byte [esp + 0x40]
mov byte [esi + 0x12c], cl
mov byte [esi + 0xd3], al
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x7c], eax
movzx eax, dl
imul eax, edi
mov byte [esi + 0xd9], al
cmp al, 7
jbe 0x425869
shr al, 3
movzx eax, al
imul eax, ebx
jmp 0x425875
movzx eax, al
imul eax, ebx
add eax, 7
shr eax, 3
mov dword [esi + 0x88], eax
mov eax, dword [esi + 0x78]
mov byte [esi + 0xdb], dl
mov dword [esi + 0x84], eax
movzx eax, byte [esi + 0xd7]
mov byte [esi + 0xd8], al
push ebx
lea ebx, [esp + 4]
push ebx
call fcn.00425560
push dword [esp + 0x34]
lea eax, [esp + 0x10]
push eax
call fcn.00425560
movzx eax, byte [esp + 0x44]
mov ecx, edi
mov byte [esp + 0x18], cl
mov ecx, ebp
mov byte [esp + 0x1a], cl
mov byte [esp + 0x19], al
movzx ecx, byte [esp + 0x50]
movzx eax, byte [esp + 0x4c]
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1b], al
push 0xd
push ebx
push 0xcd94f4
push esi
call fcn.00425643
mov dword [esi + 0x44], 0x421737
add esp, 0x20
cmp byte [esi + 0xd5], 0
mov dword [esi + 0x48], fcn.00421780
mov dword [esi + 0x4c], esi
jne 0x425924
cmp byte [esi + 0xd6], 3
je 0x425914
cmp byte [esi + 0xd7], 7
ja 0x42591d
mov byte [esi + 0xd5], 8
jmp 0x425924
mov byte [esi + 0xd5], 0xf8
mov edx, dword [esi + 0x1c]
test dl, 1
jne 0x42593b
xor eax, eax
cmp byte [esi + 0xd5], 8
setne al
mov dword [esi + 0x74], eax
test dl, 2
jne 0x425947
mov dword [esi + 0x64], 0xffffffff
test dl, 4
jne 0x425953
mov dword [esi + 0x70], 8
test dl, 8
jne 0x42595f
mov dword [esi + 0x6c], 0xf
test dl, 0x10
jne 0x42596b
mov dword [esi + 0x68], 8
push 0x38
lea eax, [esi + 0x24]
push 0xcda609
push dword [esi + 0x74]
push dword [esi + 0x70]
push dword [esi + 0x6c]
push dword [esi + 0x68]
push dword [esi + 0x64]
push eax
call fcn.00429333
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x18], 1
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x34], eax
add esp, 0x30
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x425d1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0x94]
inc eax
cmp eax, dword [edi + 0x80]
mov dword [edi + 0x94], eax
jb 0x425e9d
cmp byte [edi + 0xd3], 0
je 0x425e1e
mov dword [edi + 0x94], 0
mov esi, dword [edi + 0x20]
test esi, 2
je 0x425d65
inc byte [edi + 0xd4]
jmp 0x425dd1
movzx eax, byte [edi + 0xd4]
inc al
cmp al, 6
mov byte [edi + 0xd4], al
ja 0x425e1e
movzx ecx, al
mov edx, dword [ecx*4 + 0xcd9458]
mov eax, dword [edi + 0x78]
mov ebp, edx
add eax, edx
xor edx, edx
sub eax, dword [ecx*4 + 0xcd9474]
dec eax
div ebp
mov edx, dword [ecx*4 + 0xcd9420]
mov ebx, eax
mov dword [edi + 0x84], eax
mov eax, dword [edi + 0x7c]
add eax, edx
sub eax, dword [ecx*4 + 0xcd943c]
mov ecx, edx
xor edx, edx
dec eax
div ecx
test esi, 2
mov dword [edi + 0x80], eax
jne 0x425dd1
test ebx, ebx
je 0x425d65
test eax, eax
je 0x425d65
cmp byte [edi + 0xd4], 6
ja 0x425e1e
mov ebx, dword [edi + 0x98]
test ebx, ebx
je 0x425e9d
movzx eax, byte [edi + 0xd8]
movzx edx, byte [edi + 0xdb]
imul edx, eax
mov eax, dword [edi + 0x78]
cmp edx, 7
jle 0x425e09
shr edx, 3
imul eax, edx
jmp 0x425e12
imul eax, edx
add eax, 7
shr eax, 3
cld
mov edi, ebx
lea ecx, [eax + 1]
xor eax, eax
rep stosb byte es:[edi], al
jmp 0x425e9d
push 4
lea eax, [edi + 0x24]
push eax
call fcn.004288f7
pop ecx
test eax, eax
mov ebx, eax
pop esi
jne 0x425e54
cmp dword [edi + 0x34], 0
jne 0x425e1e
push dword [edi + 0x60]
push dword [edi + 0x5c]
push edi
call fcn.00425a5a
mov eax, dword [edi + 0x5c]
add esp, 0xc
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x60]
mov dword [edi + 0x34], eax
jmp 0x425e1e
cmp eax, 1
je 0x425e73
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x425e63
push eax
jmp 0x425e68
push 0xcda6b9
push edi
call fcn.00423f30
pop eax
dec ebx
pop edx
jne 0x425e1e
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x60]
cmp edx, eax
jae 0x425e8c
sub eax, edx
push eax
push dword [edi + 0x5c]
push edi
call fcn.00425a5a
add esp, 0xc
lea eax, [edi + 0x24]
push eax
call fcn.00429203
mov dword [edi + 0x50], 0
pop ebp
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x429203
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push ebx
test edi, edi
je 0x429222
mov ebx, dword [edi + 0x1c]
test ebx, ebx
je 0x429222
cmp dword [edi + 0x20], 0
je 0x429222
cmp dword [edi + 0x24], 0
jne 0x42922c
mov eax, 0xfffffffe
jmp 0x42932c
mov dword [edi + 0x2c], 2
mov eax, dword [ebx + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], 0
mov dword [ebx + 0x14], 0
test eax, eax
jns 0x429261
neg eax
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x18]
cmp edx, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
cmp edx, 2
mov dword [ebx + 4], eax
jne 0x429284
push 0
push 0
push 0
call fcn.0042824a
jmp 0x42928f
push 0
push 0
push 0
call fcn.0042ac10
mov dword [edi + 0x30], eax
add esp, 0xc
mov dword [ebx + 0x28], 0
push ebx
call fcn.0042afcf
pop edi
cld
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x4c]
mov edi, dword [ebx + 0x44]
add eax, eax
mov dword [ebx + 0x3c], eax
xor eax, eax
mov word [edi + ecx*2 - 2], 0
lea ecx, [ecx + ecx - 2]
rep stosb byte es:[edi], al
imul edx, dword [ebx + 0x84], 0xc
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 2
movzx eax, word [edx + 0xcdd1e6]
mov dword [ebx + 0x60], 2
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x80], eax
movzx eax, word [edx + 0xcdd1e4]
mov dword [ebx + 0x8c], eax
movzx eax, word [edx + 0xcdd1e8]
mov dword [ebx + 0x90], eax
movzx eax, word [edx + 0xcdd1ea]
mov dword [ebx + 0x7c], eax
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x429956
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0xc
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x14], eax
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x74]
mov eax, dword [ebp - 0x14]
add eax, dword [esi + 0x2c]
sub edx, ecx
mov dword [ebp - 0x10], edx
mov edx, dword [esi + 0x6c]
sub eax, 0x106
sub dword [ebp - 0x10], edx
cmp edx, eax
jb 0x4299ef
mov ecx, dword [ebp - 0x14]
mov edx, dword [esi + 0x38]
push ecx
lea eax, [edx + ecx]
push eax
push edx
call fcn.004319e0
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [esi + 0x4c]
sub dword [esi + 0x70], eax
sub dword [esi + 0x6c], eax
sub dword [esi + 0x5c], eax
mov eax, dword [esi + 0x44]
lea eax, [eax + ecx*2]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x4299c2
mov ebx, edx
sub ebx, dword [ebp - 0x14]
mov word [eax], bx
dec ecx
jne 0x4299b0
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x40]
lea eax, [eax + ecx*2]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x4299e3
mov ebx, edx
sub ebx, dword [ebp - 0x14]
mov word [eax], bx
dec ecx
jne 0x4299d1
mov edx, dword [ebp - 0x14]
add dword [ebp - 0x10], edx
mov ebx, dword [esi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x429aa5
mov edx, dword [esi + 0x38]
mov edi, eax
mov ecx, dword [esi + 0x6c]
add ecx, edx
mov edx, dword [esi + 0x74]
add ecx, edx
cmp eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
jbe 0x429a16
mov edi, dword [ebp - 0x10]
xor edx, edx
test edi, edi
je 0x429a64
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x429a39
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0042ac10
jmp 0x429a49
cmp eax, 2
jne 0x429a4f
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0042824a
mov dword [ebx + 0x30], eax
add esp, 0xc
push edi
push dword [ebx]
push dword [ebp - 0x18]
call fcn.004319e0
add dword [ebx], edi
add esp, 0xc
mov edx, edi
add dword [ebx + 8], edi
mov eax, dword [esi + 0x74]
add eax, edx
cmp eax, 2
mov dword [esi + 0x74], eax
jbe 0x429a90
mov ebx, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
movzx eax, byte [ebx + edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx edx, byte [ebx + edx + 1]
xor eax, edx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp dword [esi + 0x74], 0x105
ja 0x429aa5
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x429967
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42fe50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov ecx, dword [0xce1d60]
test ecx, ecx
je 0x42fe6e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x58], 0x41414141
mov eax, dword [0xcddfc4]
lea esi, [ebp - 0x58]
mov dword [ebp - 0x54], 0x41414141
mov dword [ebp - 0x50], 0x41414141
mov dword [ebp - 0x38], eax
mov eax, dword [0xcddfc8]
mov dword [ebp - 0x4c], 0x41414141
mov dword [ebp - 0x48], 0x41414141
mov dword [ebp - 0x34], eax
mov eax, dword [0xcddfcc]
mov dword [ebp - 0x44], 0x41414141
mov dword [ebp - 0x40], 0x41414141
mov dword [ebp - 0x30], eax
mov eax, dword [0xcddfd0]
mov dword [ebp - 0x3c], 0x41414141
mov dword [ebp - 0x2c], eax
mov eax, dword [0xcddfd4]
mov dword [ebp - 0x28], eax
mov eax, dword [0xcddfd8]
mov dword [ebp - 0x24], eax
mov dword [esp], esi
call fcn.00431c10
movzx eax, ax
sub esp, 4
test eax, eax
mov dword [ebp - 0x9c], eax
jne 0x42ffcd
mov dword [esp], 0x1c
call fcn.00431a90
test eax, eax
mov ebx, eax
je 0x430001
cld
mov edi, eax
mov eax, dword [ebp - 0x9c]
mov ecx, 7
mov edx, 0x1f
rep stosd dword es:[edi], eax
mov dword [ebx], 0x1c
mov eax, dword [0xce1d20]
mov ecx, 1
mov dword [ebx + 4], fcn.00431ac0
mov dword [ebx + 8], 0x42fde0
mov dword [ebx + 0x14], eax
jmp 0x42ff50
mov eax, ebx
and eax, ecx
cmp eax, 1
sbb eax, eax
and al, 0x20
add ecx, ecx
add al, 0x41
mov byte [ebp + edx - 0x98], al
dec edx
jns 0x42ff50
mov eax, dword [0xcddfc4]
mov dword [ebp - 0x78], eax
mov eax, dword [0xcddfc8]
mov dword [ebp - 0x74], eax
mov eax, dword [0xcddfcc]
mov dword [ebp - 0x70], eax
mov eax, dword [0xcddfd0]
mov dword [ebp - 0x6c], eax
mov eax, dword [0xcddfd4]
mov dword [ebp - 0x68], eax
mov eax, dword [0xcddfd8]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x98]
mov dword [esp], eax
call fcn.00431c20
movzx edi, ax
sub esp, 4
test edi, edi
jne 0x42fff2
xor edx, edx
test edx, edx
jne 0x42ffd4
mov dword [esp], ebx
call fcn.00431a80
mov dword [esp], esi
call fcn.00431c10
sub esp, 4
movzx eax, ax
call fcn.0042fdf0
mov ebx, eax
mov dword [0xce1d60], ebx
lea eax, [ebx + 4]
mov dword [0xce1d50], eax
lea eax, [ebx + 8]
mov dword [0xce1d70], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
call fcn.0042fdf0
cmp eax, ebx
mov edx, edi
jne 0x42ffb1
jmp 0x42ffb3
call fcn.00431ac0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x40d9a8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408fab
mov dword [ebp - 0x14], eax
cmp dword [0x4ad780], esi
jne 0x40da9b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40da28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40db7b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40db7b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40db7b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ad780], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ad784], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ad788], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad790], eax
test eax, eax
je 0x40da98
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad78c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40dac0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40dab3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40dad5
push 4
pop eax
jmp 0x40db7d
cmp dword [ebp - 0x14], esi
je 0x40dad5
push dword [0x4ad780]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40daba
mov eax, dword [0x4ad78c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40db33
cmp dword [0x4ad790], edi
je 0x40db33
push eax
call ebx
push dword [0x4ad790]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40db33
test eax, eax
je 0x40db33
call ecx
test eax, eax
je 0x40db28
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40db28
test byte [ebp - 8], 1
jne 0x40db33
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40db63
mov eax, dword [0x4ad784]
cmp eax, edi
je 0x40db60
push eax
call ebx
test eax, eax
je 0x40db60
call eax
mov esi, eax
test esi, esi
je 0x40db60
mov eax, dword [0x4ad788]
cmp eax, edi
je 0x40db60
push eax
call ebx
test eax, eax
je 0x40db60
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ad780]
call ebx
test eax, eax
je 0x40db7b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40db7d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404315
mov esp, ebp
pop ebp
ret
Function at 0x99a0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x99a200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x99a0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99a0c2
add dl, dl
jne 0x99a0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99a134
xor eax, eax
add dl, dl
jne 0x99a0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99a1d5
add dl, dl
jne 0x99a0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x99a12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x99a0cd
mov eax, 1
add dl, dl
jne 0x99a142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99a139
sub eax, ebx
mov ebx, 1
jne 0x99a180
mov ecx, 1
add dl, dl
jne 0x99a166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x99a171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99a15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99a0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x99a197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x99a1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99a18e
cmp eax, 0x7d00
jae 0x99a1c5
cmp eax, 0x500
jb 0x99a1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99a0cd
cmp eax, 0x7f
ja 0x99a1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99a0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x99a1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x99a0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10