joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dbb20
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push edi
mov dword [ebx], 0x4000400
test edx, edx
je 0x4dbb61
lea eax, [ebx + 0x104]
mov ecx, edx
nop
movaps xmm0, xmmword [0x4f5140]
lea eax, [eax + 0x10]
movups xmmword [eax - 0x110], xmm0
movaps xmm0, xmmword [0x4f5140]
movups xmmword [eax - 0x10], xmm0
sub ecx, 1
jne 0x4dbb40
cmp byte [esp + 0x30], 0
lea edi, [ebx + 0x204]
mov ecx, 0x80
mov eax, 0x4000400
rep stosd dword es:[edi], eax
jne 0x4dbd65
mov dword [esp + 8], 0
test edx, edx
je 0x4dbd65
push ebp
lea ebp, [ebx + 0x404]
lea ecx, [ebx + 0x4808]
mov dword [esp + 0x10], ebp
push esi
mov dword [esp + 0x1c], ecx
mov edi, dword [ebx + 0x4804]
xor esi, esi
mov dword [ecx], edi
movzx ecx, word [ebx]
mov eax, ecx
mov dword [esp + 0x30], edi
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov dword [esp + 0x38], esi
movzx eax, byte [eax + 0x4f9b20]
movzx edx, byte [ecx + 0x4f9b20]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x20], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x4f9b20]
add eax, edx
mov dword [esp + 0x24], eax
movzx eax, byte [ecx + 0x4f9b20]
add eax, edx
mov dword [esp + 0x28], eax
test edi, edi
je 0x4dbd3b
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
shl edi, 3
mov dword [esp + 0x18], edi
nop dword [eax]
cmp esi, 8
jae 0x4dbc85
lea edx, [esi + 8]
xor ebp, ebp
mov esi, dword [esp + 0x10]
nop
mov ecx, edx
lea edi, [esi*8]
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
and ecx, 0x7f
lea eax, [edi + edx]
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x4f9b20]
add ebp, eax
cmp edx, 1
jne 0x4dbc30
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x38]
add eax, ebp
mov ebp, dword [esp + 0x14]
mov dword [ebp + esi*4], eax
inc esi
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], esi
cmp esi, eax
jb 0x4dbc20
jmp 0x4dbd3b
cmp esi, eax
jae 0x4dbd3b
nop dword [eax]
cmp esi, 0x10
jae 0x4dbcf2
mov edx, esi
xor ebp, ebp
mov esi, dword [esp + 0x18]
nop dword [eax]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edi + edx]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
mov edi, esi
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x4f9b20]
add ebp, eax
cmp edx, 1
jne 0x4dbca0
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
add eax, ebp
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov dword [ebp + esi*4], eax
inc esi
mov dword [esp + 0x38], esi
cmp esi, dword [esp + 0x30]
jb 0x4dbc90
jmp 0x4dbd3b
xor edi, edi
lea eax, [esi + 0xf0]
nop word [eax + eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x4f9b20]
add edi, ecx
cmp eax, 1
jne 0x4dbd00
mov eax, dword [esp + 0x28]
add eax, edi
mov dword [ebp + esi*4], eax
inc esi
cmp esi, dword [esp + 0x30]
jb 0x4dbcf2
mov eax, dword [esp + 0x10]
add ebp, 0x440
mov ecx, dword [esp + 0x1c]
inc eax
add ecx, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ebp
cmp eax, dword [esp + 0x34]
jb 0x4dbba4
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x1c
ret
Function at 0x4e2ac0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0xc]
push esi
push edi
xor edi, edi
add ecx, eax
mov eax, dword [esp + 0xc]
nop dword [eax]
mov esi, ecx
shr ecx, 1
and esi, 1
neg esi
shr esi, 4
movzx edx, word [eax + ecx*2]
and esi, 0x7f
shr edx, 4
xor edx, esi
movzx edx, byte [edx + 0x4f9b20]
add edi, edx
cmp ecx, 1
jne 0x4e2ae0
mov eax, edi
pop edi
pop esi
ret
Function at 0x4e2df0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ecx, 8
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov edx, dword [edi + 0xaa4]
lea ebp, [edi + 0xaac]
mov eax, dword [edi + 0xaa8]
sub ecx, edx
and eax, dword [esp + 0x18]
shr esi, cl
mov ecx, edx
shl eax, cl
add esi, eax
imul eax, esi, 0x600
add ebp, eax
cmp byte [esp + 0x20], bl
jne 0x4e2e45
push dword [esp + 0x28]
push 8
push ebp
call fcn.004e2ac0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x28]
mov esi, 0x100
mov edi, dword [esp + 0x24]
add edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x4f9b20]
mov ecx, edi
xor ecx, edx
add ebx, eax
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x4e2e54
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x4e2ea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x24], edx
lea esi, [edi + 0x105a4]
lea ebp, [edi + 0x101a0]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
mov eax, dword [edi + 0x10da0]
xor ebx, ebx
test eax, eax
je 0x4e2f28
mov ebp, dword [esp + 0x24]
lea eax, [ebx + 0x40]
xor esi, esi
nop word [eax + eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
lea ecx, [eax + ebp]
and edx, 0x7f
movzx ecx, word [edi + ecx*2 + 0x6e0c]
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x4f9b20]
add esi, ecx
cmp eax, 1
jne 0x4e2ee0
mov ebp, dword [esp + 0x10]
mov dword [ebp + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x10da0]
cmp ebx, eax
jb 0x4e2ed1
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov ecx, 0xe
cmp eax, ecx
jbe 0x4e2f48
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [ebp + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x10da0]
jb 0x4e2f31
mov eax, dword [ebp]
add edx, 0x40
mov dword [esi - 4], eax
mov eax, dword [ebp + 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
add ebp, 0x100
mov dword [esi + 8], eax
add esi, 0x200
mov dword [esp + 0x10], ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], esi
cmp edx, 0x100
jb 0x4e2ec5
mov ebx, 4
lea eax, [edi + 0x107b0]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
nop dword [eax]
cmp ebx, 4
ja 0x4e2fa9
mov esi, ebx
jmp 0x4e2fb9
bsr edx, ebx
mov eax, ebx
lea ecx, [edx - 1]
shr eax, cl
and eax, 1
lea esi, [eax + edx*2]
mov eax, esi
mov edx, esi
shr eax, 1
and edx, 1
dec eax
or edx, 2
mov ecx, eax
mov dword [esp + 0x18], eax
shl edx, cl
mov eax, ebx
mov ebx, dword [esp + 0x18]
mov ecx, 1
sub eax, edx
mov dword [esp + 0x1c], edx
xor ebp, ebp
mov dword [esp + 0x24], ecx
mov edx, eax
sub ecx, esi
add ecx, dword [esp + 0x1c]
and edx, 1
shr eax, 1
mov dword [esp + 0x18], eax
mov eax, edx
neg eax
movzx ecx, word [edi + ecx*2 + 0x700a]
shr eax, 4
shr ecx, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x4f9b20]
mov ecx, dword [esp + 0x24]
add ebp, eax
mov eax, dword [esp + 0x18]
lea ecx, [edx + ecx*2]
mov dword [esp + 0x24], ecx
sub ebx, 1
jne 0x4e2fe5
mov ecx, dword [esp + 0x10]
mov eax, dword [edi + esi*4 + 0x101a0]
mov ebx, dword [esp + 0x14]
add eax, ebp
inc ebx
mov dword [ecx - 0x200], eax
mov eax, dword [edi + esi*4 + 0x102a0]
add eax, ebp
mov dword [esp + 0x14], ebx
mov dword [ecx], eax
mov eax, dword [edi + esi*4 + 0x103a0]
add eax, ebp
mov dword [ecx + 0x200], eax
mov eax, dword [edi + esi*4 + 0x104a0]
add eax, ebp
mov dword [ecx + 0x400], eax
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, 0x80
jb 0x4e2fa0
mov dword [edi + 0x10da4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4e48db
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4e4978
push ebx
push esi
call fcn.004e49c9
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00460f80
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4e4925
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4e4977
push edi
push eax
call fcn.0042a897
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4e4945
call fcn.0042a85d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4e4976
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00460f80
add esp, 0x20
test eax, eax
jne 0x4e4964
push edi
call fcn.0042a85d
jmp 0x4e496c
push ebx
call fcn.0042a85d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4e497b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4e498c
pop esi
ret
push ebx
push edi
push esi
call fcn.004e49c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0042a897
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4e49b4
push ebx
push esi
push edi
call fcn.004095d0
add esp, 0xc
push 0
call fcn.0042a85d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4e4a0b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e4c76
Function at 0x4e5150
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x518cc0]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4e517b
pop esi
pop ebp
add esp, 0xc
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x4e51ca
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [edi]
push ebx
push dword [esp + 0x2c]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov ebx, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x28], ebx
jmp 0x4e51d2
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x30]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4e5243
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x18], eax
lea esp, [esp]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4e5200
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x4e5275
jmp 0x4e5250
mov eax, dword [edi]
push 1
push 0x4fabe8
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x4fabe9
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x4e5250
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x79e359d0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x40eb1748
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0xa9b4f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x570000]
push edi
or ebp, 0xffffffff
jmp 0xa9b512
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa9b519
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9b508
mov eax, 1
add ebx, ebx
jne 0xa9b52b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa9b53c
jne 0xa9b55b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9b55b
dec eax
add ebx, ebx
jne 0xa9b548
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa9b520
add ebx, ebx
jne 0xa9b557
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa9b5ad
xor ecx, ecx
sub eax, 3
jb 0xa9b573
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa9b5e2
sar eax, 1
mov ebp, eax
jmp 0xa9b57e
add ebx, ebx
jne 0xa9b57e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9b54c
inc ecx
add ebx, ebx
jne 0xa9b58c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9b54c
add ebx, ebx
jne 0xa9b599
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa9b58e
jne 0xa9b5aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa9b58e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa9b5cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa9b5be
jmp 0xa9b50e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa9b5cc
add edi, ecx
jmp 0xa9b50e
pop esi
mov edi, esi
mov ecx, 0xcde6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa9b5ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa9b5ef
lea edi, [esi + 0x699000]
mov eax, dword [edi]
or eax, eax
je 0xa9b660
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x69d7c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x69d800]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa9b615
mov ecx, edi
jns 0xa9b644
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x69d804]
or eax, eax
je 0xa9b65a
mov dword [ebx], eax
add ebx, 4
jmp 0xa9b632
call dword [esi + 0x69d814]
mov ebp, dword [esi + 0x69d808]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa9b694
sub esp, 0xffffff80
jmp 0x425d58
Function at 0x1cdb058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1cdb1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1cdb07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1cdb06a
add dl, dl
jne 0x1cdb089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1cdb0dc
xor eax, eax
add dl, dl
jne 0x1cdb096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1cdb17d
add dl, dl
jne 0x1cdb0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1cdb0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1cdb0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1cdb0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1cdb0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1cdb075
mov eax, 1
add dl, dl
jne 0x1cdb0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1cdb0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1cdb0e1
sub eax, ebx
mov ebx, 1
jne 0x1cdb128
mov ecx, 1
add dl, dl
jne 0x1cdb10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1cdb119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1cdb105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1cdb075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1cdb13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1cdb14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1cdb136
cmp eax, 0x7d00
jae 0x1cdb16d
cmp eax, 0x500
jb 0x1cdb168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1cdb075
cmp eax, 0x7f
ja 0x1cdb170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1cdb075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1cdb19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1cdb075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x15ba058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x15ba1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x15ba07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15ba06a
add dl, dl
jne 0x15ba089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15ba0dc
xor eax, eax
add dl, dl
jne 0x15ba096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15ba17d
add dl, dl
jne 0x15ba0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15ba0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15ba0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15ba0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x15ba0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x15ba075
mov eax, 1
add dl, dl
jne 0x15ba0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15ba0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15ba0e1
sub eax, ebx
mov ebx, 1
jne 0x15ba128
mov ecx, 1
add dl, dl
jne 0x15ba10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15ba119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15ba105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15ba075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x15ba13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15ba14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15ba136
cmp eax, 0x7d00
jae 0x15ba16d
cmp eax, 0x500
jb 0x15ba168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15ba075
cmp eax, 0x7f
ja 0x15ba170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15ba075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x15ba19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x15ba075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40387c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4038d5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.KERNEL32.DLL_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00403718
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00403718
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x4038bf
inc ebx
jmp 0x4038a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038dc
lea eax, [ebp - 8]
call fcn.00405820
ret

Function at 0x4038e4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405820
test esi, esi
jne 0x40391b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00405910
jmp 0x40393c
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00403718
mov dword [esp], eax
test esi, esi
je 0x40393c
cmp dword [ebx], 0
je 0x40393c
dec esi
jmp 0x403923
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x404698
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x62a024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404730
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404710
xor eax, eax
push ebp
push 0x404709
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40474c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404710
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x62a024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x62a024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4055cc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x64004c], 0
je 0x40562d
cmp word [0x640220], 0xd7b2
jne 0x4055f5
cmp dword [0x640228], 0
jbe 0x4055f5
mov eax, 0x64021c
call dword [0x640238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x62a788
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405654
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x62a034], 0
jne 0x405649
push 0
push 0x62a780
push 0x62a788
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x4057a8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x62a03c], 0
je 0x4057d3
mov edx, esi
mov eax, ebx
call dword [0x62a03c]
mov dword [ebp - 8], eax
jmp 0x4057eb
mov eax, 8
call fcn.00403320
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
mov eax, dword [ebp - 8]
mov dword [eax + 4], esi
mov byte [0x64004d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, 0x405770
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.KERNEL32.DLL_CreateThread_1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc