joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Accept command line arguments
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x74]
push eax
xor ebx, ebx
push 8
xor esi, esi
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401067
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0xac]
push ecx
push 4
lea edx, [ebp - 0x78]
push edx
push 0x14
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x401067
mov esi, dword [ebp - 0x78]
mov eax, dword [ebp - 0x74]
cmp eax, ebx
je 0x401075
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x401080
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x65
xor eax, eax
mov dl, byte [eax + str._.TZ6ZRZ_X_ACC]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x20], dl
inc eax
and ecx, 0xff
cmp eax, 0x19
jb 0x401087
lea eax, [ebp - 0x20]
push eax
push 0x40cad0
mov byte [ebp - 7], bl
call fcn.004012de
add esp, 8
mov ecx, 0xbd
xor eax, eax
jmp 0x4010c0
mov dl, byte [eax + 0x40a100]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x70], dl
inc eax
and ecx, 0xff
cmp eax, 0x43
jb 0x4010c0
mov byte [ebp - 0x2d], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0x70]
push ecx
push eax
call fcn.00401370
add esp, 8
push ebx
cmp eax, ebx
je 0x40107a
push 0x40cad0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40110a
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [ebp - 0x80], 0x40cad0
mov dword [ebp - 0xa0], 0x401000
mov dword [ebp - 0xa8], 0x30
mov dword [ebp - 0xa4], 0x20008
call esi
push 0x7f00
push ebx
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x94], edi
call esi
push 0x7f00
push ebx
mov dword [ebp - 0x7c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
lea edx, [ebp - 0xa8]
push edx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 0x10
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x9c], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push ebx
push edi
push ebx
push ebx
push 1
push 1
push 0xffff
push 0xffff
push 0xcf0000
push 0x40cad0
push 0x40cad0
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x104
push ebx
push 0x40cad0
call fcn.00405700
mov ecx, 0x40a144
add esp, 0xc
sub ecx, 0x69e6139a
lea eax, [ebp - 0x2c]
call fcn.00401240
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc8]
push eax
call esi
test eax, eax
je 0x40121f
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call edi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0xc8]
push ecx
call esi
test eax, eax
jne 0x401208
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004012cf
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4012cf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b004]
jne 0x4012d9
repz ret
jmp fcn.004015d0

Function at 0x4060bc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004035e3
and dword [ebp - 0x14], 0
cmp dword [0x40ca78], 0
mov dword [ebp - 0x18], eax
jne 0x40616f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406217
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406217
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40ca78], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40ca7c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40ca80], eax
call edi
push eax
call esi
mov dword [0x40ca88], eax
test eax, eax
je 0x40616f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40ca84], eax
mov eax, dword [0x40ca84]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4061c8
cmp dword [0x40ca88], ecx
je 0x4061c8
push eax
call esi
push dword [0x40ca88]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4061c8
test ebx, ebx
je 0x4061c8
call edi
test eax, eax
je 0x4061bf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4061bf
test byte [ebp - 8], 1
jne 0x4061c8
or dword [ebp + 0x10], 0x200000
jmp 0x4061fb
mov eax, dword [0x40ca7c]
cmp eax, dword [ebp - 0x18]
je 0x4061fb
push eax
call esi
test eax, eax
je 0x4061fb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4061fb
mov eax, dword [0x40ca80]
cmp eax, dword [ebp - 0x18]
je 0x4061fb
push eax
call esi
test eax, eax
je 0x4061fb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40ca78]
call esi
test eax, eax
je 0x406217
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406219
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004012cf
leave
ret
Function at 0x403514
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40600c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035ac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40358c
xor eax, eax
push ebp
push 0x403585
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40358c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x40600c]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40600c], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cf0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x410038], 0
je 0x403d51
cmp word [0x410314], 0xd7b2
jne 0x403d19
cmp dword [0x41031c], 0
jbe 0x403d19
mov eax, 0x410310
call dword [0x41032c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d7c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x406018], 0
jne 0x403d6d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4045d0
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x404898
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdac
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404180
xor eax, eax
push ebp
push 0x40495c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x254]
call fcn.004031b8
mov edx, 1
lea eax, [ebp - 0x254]
call fcn.004034d0
call fcn.00402e20
xor esi, esi
mov ebx, 0x4067dc
cmp esi, 0x6b74
jl 0x4048f6
cmp esi, 0x6c0e
jle 0x404900
movzx eax, byte [ebx]
call fcn.00404880
mov byte [ebx], al
inc esi
inc ebx
cmp esi, 0x8c00
jne 0x4048e6
push 0
mov edx, 0x4067dc
mov ecx, 0x8c00
lea eax, [ebp - 0x254]
call fcn.004032b4
call fcn.00402e20
lea eax, [ebp - 0x254]
call fcn.004032d4
call fcn.00402e20
push 6
mov eax, dword [ebp - 4]
call fcn.004041e4
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404963
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x40496c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push 0
push eax
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004042c4
add esp, 0x20c
pop ebx
ret
Function at 0x40499c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404180
xor eax, eax
push ebp
push 0x4049ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004041e4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4049d1
test al, 0x10
je 0x4049d5
xor ebx, ebx
jmp 0x4049d7
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4049f4
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x401026
Capabilities:
Create process on windows
Delete file
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov edx, section..text
push edi
push esi
push ebx
sub esp, 0x574
lea ecx, [esp + 0x64]
cmp edx, entry0
jae 0x40104c
movzx eax, byte [edx]
inc edx
xor al, 0xdc
mov byte [ecx], al
inc ecx
jmp 0x401039
mov byte [ecx], 0
lea esi, [esp + 0x64]
push esi
push 1
push 0
call 0x401220
push 0x104
lea ebx, [esp + 0x468]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
push 0
push 0xffffffffffffff9c
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea ebp, [esp + 4]
push ebp
push 0x64
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0x65]
lea ecx, [esp + 0xc7]
cmp edx, ecx
jae 0x4010d4
movzx eax, byte [esp + 0x64]
xor byte [edx], al
inc edx
jmp 0x4010c6
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
cmp edx, eax
jae 0x4010e6
mov byte [edx], 0
inc edx
jmp 0x4010dc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x8d]
push eax
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x401205
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x47c]
push eax
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
mov eax, 0xffffff9c
push 0
sub eax, dword [esp + 0x6d]
push eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push dword [esp + 0x6d]
push dword [esp + 0x71]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
push eax
mov esi, eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
mov edx, esi
add eax, dword [esp + 0x65]
cmp esi, eax
jae 0x40119b
movzx eax, byte [esp + 0x64]
xor byte [edx], al
mov eax, esi
inc edx
add eax, dword [esp + 0x65]
cmp edx, eax
jmp 0x401187
push pe_nt_image_headers32
lea edi, [esp + 0x6d]
push edi
call sub.KERNEL32.dll_SetFileAttributesA
push edi
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 0
push ebp
push dword [esp + 0x6d]
push esi
push eax
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateProcessA
push 0
call sub.KERNEL32.dll_ExitProcess
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]

Function at 0x408920
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
call fcn.00408942
and esi, eax
mov esi, esi
xor dword [edx], ecx
add edx, 1
inc esi
cmp edx, edi
jne fcn.00408920
ret
Function at 0x48f054
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9df0]
jne 0x48f05e
repz ret
jmp fcn.00493617

Function at 0x4916d1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9df0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048bd92
and dword [ebp - 0x14], 0
cmp dword [0x4acaac], 0
mov dword [ebp - 0x18], eax
jne 0x491784
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49182c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x49182c
mov esi, dword [fcn.00487b10]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4acaac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4acab0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4acab4], eax
call edi
push eax
call esi
mov dword [0x4acabc], eax
test eax, eax
je 0x491784
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4acab8], eax
mov eax, dword [0x4acab8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00487b14]
cmp eax, ecx
je 0x4917dd
cmp dword [0x4acabc], ecx
je 0x4917dd
push eax
call esi
push dword [0x4acabc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4917dd
test ebx, ebx
je 0x4917dd
call edi
test eax, eax
je 0x4917d4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4917d4
test byte [ebp - 8], 1
jne 0x4917dd
or dword [ebp + 0x10], 0x200000
jmp 0x491810
mov eax, dword [0x4acab0]
cmp eax, dword [ebp - 0x18]
je 0x491810
push eax
call esi
test eax, eax
je 0x491810
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x491810
mov eax, dword [0x4acab4]
cmp eax, dword [ebp - 0x18]
je 0x491810
push eax
call esi
test eax, eax
je 0x491810
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4acaac]
call esi
test eax, eax
je 0x49182c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49182e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f054
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x13c2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.013c21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x13c207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13c206a
add dl, dl
jne 0x13c2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13c20dc
xor eax, eax
add dl, dl
jne 0x13c2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13c217d
add dl, dl
jne 0x13c20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13c20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13c20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13c20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x13c20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x13c2075
mov eax, 1
add dl, dl
jne 0x13c20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13c20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13c20e1
sub eax, ebx
mov ebx, 1
jne 0x13c2128
mov ecx, 1
add dl, dl
jne 0x13c210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13c2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13c2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13c2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x13c213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13c214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13c2136
cmp eax, 0x7d00
jae 0x13c216d
cmp eax, 0x500
jb 0x13c2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13c2075
cmp eax, 0x7f
ja 0x13c2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13c2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x13c219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x13c2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x184c8f0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0184ca40
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x184c916
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x184c902
add dl, dl
jne 0x184c921
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x184c974
xor eax, eax
add dl, dl
jne 0x184c92e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x184ca15
add dl, dl
jne 0x184c93d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x184c948
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x184c953
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x184c95e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x184c96a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x184c90d
mov eax, 1
add dl, dl
jne 0x184c982
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x184c98d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x184c979
sub eax, ebx
mov ebx, 1
jne 0x184c9c0
mov ecx, 1
add dl, dl
jne 0x184c9a6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x184c9b1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x184c99d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x184c90d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x184c9d7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x184c9e2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x184c9ce
cmp eax, 0x7d00
jae 0x184ca05
cmp eax, 0x500
jb 0x184ca00
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x184c90d
cmp eax, 0x7f
ja 0x184ca08
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x184c90d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x184ca36
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x184c90d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10d360b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10d36200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10d360d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10d360c2
add dl, dl
jne 0x10d360e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10d36134
xor eax, eax
add dl, dl
jne 0x10d360ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10d361d5
add dl, dl
jne 0x10d360fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d36108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d36113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d3611e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10d3612a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10d360cd
mov eax, 1
add dl, dl
jne 0x10d36142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d3614d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10d36139
sub eax, ebx
mov ebx, 1
jne 0x10d36180
mov ecx, 1
add dl, dl
jne 0x10d36166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10d36171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10d3615d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10d360cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10d36197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10d361a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10d3618e
cmp eax, 0x7d00
jae 0x10d361c5
cmp eax, 0x500
jb 0x10d361c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10d360cd
cmp eax, 0x7f
ja 0x10d361c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10d360cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10d361f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10d360cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xcc
mov eax, dword [0x403004]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [esp + 0x10]
push eax
xorps xmm0, xmm0
mov dword [esp + 0x3c], 0x44
lea eax, [esp + 0x3c]
movlpd qword [esp + 0x40], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x402100
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
movlpd qword [esp + 0x94], xmm0
movlpd qword [esp + 0x9c], xmm0
movlpd qword [esp + 0xac], xmm0
movlpd qword [esp + 0xb4], xmm0
movlpd qword [esp + 0xbc], xmm0
movlpd qword [esp + 0xc4], xmm0
movlpd qword [esp + 0xcc], xmm0
movlpd qword [esp + 0xd4], xmm0
movlpd qword [esp + 0xdc], xmm0
movlpd qword [esp + 0xe4], xmm0
movaps xmmword [esp + 0x38], xmm0
movaps xmmword [esp + 0x48], xmm0
mov dword [esp + 0xa8], 0x44
call esi
test eax, eax
je 0x401120
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x84]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x402100
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x10]
test eax, eax
jne 0x401138
call esi
push dword [esp + 0x14]
call esi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00401161
mov esp, ebp
pop ebp
ret
call esi
push dword [esp + 0x14]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x24]
call esi
mov ecx, dword [esp + 0xcc]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00401161
mov esp, ebp
pop ebp
ret