joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10165e17
Capabilities:
Packed with generic packer

Disassembly:
push eax
lea esp, [esp + 4]
je 0x101002ec
call fcn.100efa75
jno 0x100643b6
mov eax, 0x47136fb9
mov word [eax - 0xd], ds
push 0xffffffffffffffd3
mov ecx, 0x8c47136f
pop eax
push 0xffffffffffffffd3
pop ss
fisub dword [eax + ecx*2 + 0x7e7dc21e]
xor ax, 0xf836
pushfd
xchg dword [eax - 0x21c59395], ecx
xchg ecx, eax
xchg edx, eax
jo 0x100643eb
iretd
push ebp
daa
mov dword [edi + 0x2e836a4a], eax
imul esp, edi, 0xffffffd6
xlatb
pop ds
pushfd
and al, 0x80
jae 0x1006447a
inc eax
dec esp
xchg ecx, eax
and al, 0xd
aas
push 0xfffffffffffffff7
add ebp, esi
jg 0x10064453
pop ss
inc esi
stosd dword es:[edi], eax
jge 0x1006442f
dec ecx
mov fs, eax
add dword [ebp + ebp - 0x24], 0x4e2ae5c5
xchg ebx, eax
rcr dword [eax], cl
iretd
push esi
push esp
pushal
pushfd
mov dword [esp + 0x28], 0x9c064a59
mov byte [esp], ch
call fcn.101a37aa
or al, 0x24
mov dword [esp], 0x43dd1c5d
pushal
lea esp, [esp + 0x20]
jbe 0x10081d58
pushfd
pushfd
mov dword [esp + 4], 0x116c91f8
push dword [esp]
pushal
pushfd
lea esp, [esp + 0x2c]
jmp fcn.10004522
push 0xdc1694aa
pushal
mov byte [esp], ch
mov dword [esp + 0x20], 0x116c91f8
pushal
pushfd
pushfd
lea esp, [esp + 0x48]
jmp fcn.10004522
cld
cwde
pop eax
bswap bx
pushal
cld
mov ebx, dword [ebp + 0xc]
mov byte [esp + 4], 0xfa
std
mov dword [ebx], eax
std
push 0x3cd3af1d
std
lea esp, [esp + 0x24]
pushal
std
cld
bswap ecx
das
dec si
mov ecx, dword [ebp + 0x10]
cwde
mov esi, dword [ebp + 8]
shld ax, di, 1
bts edi, 1
das
xor di, 0xc3bb
mov edi, dword [ebp + 0xc]
cmc
adc ah, 0xf
mov edi, dword [edi]
btr bp, sp
bt bp, cx
shrd bx, sp, 9
clc
add edi, 8
cwde
lahf
rep movsb byte es:[edi], byte [esi]
mov cx, 0x9d7e
popal
lea eax, [edi - 0x68dca4bc]
not al
mov ax, bp
mov eax, 1
pushal
lea esp, [esp + 0x20]
jmp fcn.100051a8
mov ebx, dword [ebx]
push esp
test ebx, ebx
lea esp, [esp + 8]
jne 0x100643a3
je 0x101002ec
pushfd
mov dword [esp], ebx
pushfd
lea esp, [esp + 4]
call fcn.1001ea15
adc ah, cl
call fcn.101002e9
call fcn.10105965
jno 0x10170f6c
push 0x5f3f7642
mov dword [esp], 0x40e0301d
push ebp
mov word [esp], 0x9040
mov dword [esp], 0xda7b35fe
push 0x44e721d3
lea esp, [esp + 4]
jmp fcn.1000ae3e
pushfd
mov byte [esp], bh
push dword [esp]
mov byte [esp + 4], 0xdd
mov dword [esp + 4], 0x40e0301d
mov dword [esp], ecx
jmp loc.100155f6
Function at 0x1017280e
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0x10], eax
test dl, ch
cmp dword [ebp - 0x10], 0
jl 0x1018d246
pushfd
mov byte [esp], bh
lea esp, [esp + 4]
jne 0x10181dca
pushfd
lea eax, [esp + 0x7449c490]
setg al
bswap eax
mov eax, 0
pushfd
pushfd
mov dword [esp], ebp
lea esp, [esp + 0xc]
jmp loc.100101bc
pushfd
mov dword [esp], ecx
call fcn.10183253
mov ch, 0x64
cmp dword [edx + 0x36], ebp
xlatb
xchg ecx, eax
xchg esi, eax
cmp eax, 0xedf58eee
xchg byte [eax], bh
rol byte [edi + 0x94c76dc], cl
lcall 0x376c, 0x157ed72e
lea ecx, [edi + 0x6a48e6c7]
xor cl, byte [ebx]
and dh, al
xlatb
or dword [ebx], esp
add bh, byte [ecx - 0x6ab79ac]
rcr dl, 1
adc ah, byte [esi]
iretd
jmp 0x10112568
jmp 0x101a72ff
shl cl, cl
mov ecx, dword [ebp - 0x30]
stc
clc
stc
stc
xor eax, eax
jmp 0x10145012
call fcn.1005abd7
pushfd
call fcn.10190bd8
or cx, 0xaa0a
bsr cx, dx
push 0xc944e60e
sar cl, 5
add esp, 8
sar ch, 3
lea ecx, [esp + 0x4b4ca604]
jmp 0x10174600
push 0xa2508239
mov byte [esp], 0x3a
mov dword [esp + 4], 6
mov byte [esp], 0x9f
mov byte [esp], 0x17
lea esp, [esp + 4]
call fcn.1001ea1b
stc
stc
add esp, 4
stc
jmp 0x100b6f39
Function at 0x10185be8
Capabilities:
Packed with generic packer

Disassembly:
pushfd
cwde
mov eax, 0
mov dword [esp], 0xb5071404
lea esp, [esp + 4]
jmp loc.100101bc
stosb byte es:[edi], al
xchg ebx, eax
xor bl, byte [ebx]
dec ebx
nop
mov esp, 0xce782d01
push esi
salc
inc edx
sub sp, bx
call 0x1015b5e1
mov byte [esp + 4], ah
push dword [esp]
lea esp, [esp + 0xc]
call fcn.1001ea1b
pushfd
cmp bl, dl
add esp, 8
stc
cmc
mov dword [ebp - 0x10], eax
clc
cmc
pushal
bt sp, dx
cmp dword [ebp - 0x10], 1
pushfd
mov byte [esp], al
push ebx
lea esp, [esp + 0x28]
je 0x100f53a7
pushfd
cmc
mov byte [esp], 0x4c
cmp ah, cl
cmp dword [ebp + 0x10], 1
pushal
pushfd
lea esp, [esp + 0x28]
jle 0x101325f1
jne 0x10181dca
setge ah
call fcn.10182c3d
jmp 0x100f67b3
pushal
push 0xf6327ecd
mov byte [esp + 4], 0x9e
push dword [esp]
lea esp, [esp + 0x28]
jne 0x10181dca
movzx ax, dl
cwde
movsx ax, cl
not al
mov dword [ebp - 8], esp
mov ax, 0xc12e
call fcn.101668d6
jmp 0x100f67c9

Function at 0x1019301e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x38]
cmp dword [ebp - 8], esp
pushfd
jmp 0x1015d2cd

Function at 0x10196314
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jne 0x10151288
lea eax, [edx*4 + 0x67ee4c60]
lahf
setnp al
mov eax, 0
pushal
pushfd
lea esp, [esp + 0x24]
jmp loc.1000a006

Function at 0x10197104
Capabilities:
Packed with generic packer

Disassembly:
call fcn.10087767
stc
pushal
cmp dl, 0x6c
sub esp, 0xffffffd0
cmp dword [ebp - 8], esp
pushfd
mov byte [esp], 0x6b
lea esp, [esp + 4]
je 0x101a7326
call fcn.1017280e
pushfd
pushal
mov dword [esp + 0x20], 0xfd3c1d32
lea esp, [esp + 0x20]
jb 0x10122aa5
push 0xad40664b
pushfd
mov dword [esp + 4], 0xa3daa168
pushal
pushal
mov word [esp], sp
lea esp, [esp + 0x44]
jmp fcn.1000e04e
clc
cmp sp, ax
nop
push dword [esp]
clc
nop
jmp 0x10155767

Function at 0x101ab202
Capabilities:
Packed with generic packer

Disassembly:
cmc
cmp dh, dh
nop
bt edi, eax
bt si, 6
pushal
mov dword [esp], 0x5de41a95
sub esp, 0xffffffd0
cmp dword [ebp - 8], esp
jmp 0x101a246f
mov byte [esp + 0xc], 0x42
test si, 0x88e3
nop
jmp 0x10140ec9
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5cfa6eba
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3b5b5370
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x15fec
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push esi
push edi
push 0x18
pop edi
push 0x820
mov dword [ebp - 0x1c], eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
xor esi, esi
push 0x120089
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jge 0x1603d
xor eax, eax
jmp 0x160ae
push 5
push edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jge 0x16060
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x16039
push esi
push dword [ebp - 0x34]
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
cmp edi, esi
je 0x16055
push esi
push esi
push dword [ebp - 0x34]
lea eax, [ebp - 0xc]
push edi
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
push dword [ebp - 4]
test eax, eax
jge 0x1609e
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x16039
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x1610e
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
xor ebx, ebx
push ebx
push 0xa
push ebx
call esi
mov edi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
push ebx
push edi
cmp eax, 0xc0000004
jne 0x161cf
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call edi
push ebx
push dword [ebp - 4]
push ebx
call esi
mov esi, eax
cmp esi, ebx
je 0x161d5
push ebx
push dword [ebp - 4]
push esi
push 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jge 0x1616e
push ebx
push esi
call edi
jmp 0x161d5
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0x20]
push 0x5c
push eax
call dword [sym.imp.ntoskrnl.exe_strrchr]
pop ecx
pop ecx
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
sub eax, ecx
movzx edx, word [ecx]
mov word [eax + ecx], dx
inc ecx
inc ecx
cmp dx, bx
jne 0x161ae
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
push ebx
push esi
call edi
mov eax, dword [ebp - 8]
jmp 0x161d7
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x161e4
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
xor ebx, ebx
push ebx
push 0xa
push ebx
call esi
mov edi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
push ebx
push edi
cmp eax, 0xc0000004
jne 0x16284
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call edi
push ebx
push dword [ebp - 4]
push ebx
call esi
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, ebx
je 0x1628a
push ebx
push dword [ebp - 4]
push esi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jge 0x16243
push ebx
push esi
call edi
jmp 0x1628a
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, esi
add eax, 0x38
jmp 0x16262
mov eax, dword [esi]
cmp eax, ebx
je 0x16278
add esi, eax
lea eax, [esi + 0x38]
push 1
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x16257
mov esi, dword [esi + 0x44]
jmp 0x1627a
mov esi, ebx
push ebx
push dword [ebp - 8]
call edi
mov eax, esi
jmp 0x1628c
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x16298
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ebp + 0xc]
add eax, ecx
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
cmp edx, dword [ecx + 0xc]
jae 0x162b9
mov eax, edx
jmp 0x162e4
push ebx
push esi
movzx esi, word [eax + 6]
push edi
xor edi, edi
test esi, esi
jbe 0x162de
mov eax, dword [ecx + 0xc]
cmp edx, eax
jb 0x162d6
mov ebx, dword [ecx + 8]
add ebx, eax
cmp edx, ebx
jb 0x162e8
add ecx, 0x28
inc edi
cmp edi, esi
jb 0x162c6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edx
jmp 0x162e1

Function at 0x21311
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x20]
call fcn.000161e4
movsx cx, cl
pushal
jmp 0x1f5ef
lea ecx, [esi*2 + 0x2e92592b]
lea ecx, [ebp - 4]
lea esp, [esp + 0x20]
jo 0x1fbdb
push edx
push dword [esp]
mov dword [esp + 4], ecx
push edx
jmp 0x1f9d4
pushal
mov byte [esp + 4], bl
mov dword [esp + 0x24], eax
pushal
pushfd
mov dword [esp], edx
push dword [esp]
mov dword [0x14280], eax
lea esp, [esp + 0x4c]
ja 0x1f3b4
pushal
mov dword [esp + 0x1c], 0x1f666
mov byte [esp], cl
jmp 0x1fefa
jmp 0x1fbe0
push ecx
pushal
pushfd
mov dword [esp + 0x20], eax
pushal
mov dword [0x14280], eax
push ebx
mov dword [esp + 0x40], 0x1fc0d
jmp 0x1fbfb
call 0x1fc00
call fcn.0001f48e
mov byte [esp], al
lea esp, [esp + 8]
call fcn.00015d20
push 0xbf0e87cc
pushal
mov dword [esp + 0x20], 0x16874
mov word [esp], 0x470
jmp 0x1f5dc
Function at 0x101cad85
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.101cae04
jae 0x101cad91
xor ecx, ecx
call fcn.101cae04
jae 0x101cadbb
xor eax, eax
call fcn.101cae04
jae 0x101cadcc
mov al, 0x10
call fcn.101cae04
adc al, al
jae 0x101cadad
jne 0x101cadf9
stosb byte es:[edi], al
jmp 0x101cad92
call fcn.101cae10
dec ecx
loop 0x101cadd8
mov eax, ebp
call fcn.101cae0e
jmp 0x101cadfa
lodsb al, byte [esi]
shr eax, 1
je 0x101cae20
adc ecx, 2
mov ebp, eax
jmp 0x101cadfa
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.101cae0e
cmp eax, 0x7d00
jae 0x101cadf8
cmp eax, 0x500
jae 0x101cadf9
cmp eax, 0x7f
ja 0x101cadfa
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x101cad92
pop ebp
ret 8
Function at 0x46d1f4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x291e266e
dec ebp
sbb byte [edx], 0x73
wait
sub bl, byte [ebx]
cmpsd dword [esi], dword es:[edi]
or al, 0xbc
sub byte [edi - 0x60], 0x52
xor dword [edx], ebp
movsd dword es:[edi], dword [esi]
mov ebx, 0xf60e2922
pushfd
sub al, 0x6e
imul eax, dword [edi - 0x19f8121e], 0x29
jo 0x46d1b3
in eax, 0x42
inc edx
push ds
mov bh, 0x9b
loop 0x46d219
salc
out dx, eax
dec edx
cmp dl, byte [ecx]
mov esi, 0x4b68d25a
xor eax, 0xee499d34
and ecx, dword [edi + 0x5d1e489b]
cmc
scasd eax, dword es:[edi]
aaa
push es
cmpsb byte [esi], byte es:[edi]
sub ah, byte [ebx]
pushal
test al, 0x51
xor byte [ebx - 0x426e1a75], ch
stosd dword es:[edi], eax
mov esp, ebp
xchg ecx, eax
mov ebp, 0x2dca0ba9
or edx, dword [eax]
jle 0x46d229
stosd dword es:[edi], eax
mov esp, ebp
xchg ecx, eax
mov ebp, 0x2dca0ba9
or edx, dword [eax]
jle 0x46d229
sti
sub byte [eax], 0x29
cmp dword [esi - 0x3b543348], 0xffffffc4
pop ebx
sbb al, 0x6d
mov dh, ah
push es
jl 0x46d1cd
pop ds
leave
cdq
xchg dword [esi], edx
cmpsb byte [esi], byte es:[edi]
push 0xffffffffffffffaa
jne 0x46d1a7
pop ebx
mov cl, 0x26
jo 0x46d1e3
test edx, edi
pop ebx
pop ebp
lea ebx, [eax + ecx + 2]
or byte [edx], al
xor al, 0x69
cmc
cmp eax, 0xaf0a9323
retf
Function at 0x2a42058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.02a421a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x2a4207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2a4206a
add dl, dl
jne 0x2a42089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2a420dc
xor eax, eax
add dl, dl
jne 0x2a42096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2a4217d
add dl, dl
jne 0x2a420a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2a420b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2a420bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2a420c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x2a420d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2a42075
mov eax, 1
add dl, dl
jne 0x2a420ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2a420f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2a420e1
sub eax, ebx
mov ebx, 1
jne 0x2a42128
mov ecx, 1
add dl, dl
jne 0x2a4210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2a42119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2a42105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2a42075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2a4213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2a4214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2a42136
cmp eax, 0x7d00
jae 0x2a4216d
cmp eax, 0x500
jb 0x2a42168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2a42075
cmp eax, 0x7f
ja 0x2a42170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2a42075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x2a4219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2a42075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10044eb
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 4
jl 0x100453e
cmp esi, 0x10
jl 0x1004524
mov eax, esi
shr eax, 4
je 0x1004524
mov ecx, dword [ebp + 8]
mov edx, eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ecx + 0xc]
xor edi, dword [ecx + 8]
xor edi, dword [ecx + 4]
xor edi, dword [ecx]
add ecx, 0x10
xor eax, edi
dec edx
jne 0x100450e
pop edi
jmp 0x100452a
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, esi
shr edx, 2
and edx, 3
je 0x1004544
xor eax, dword [ecx]
add ecx, 4
dec edx
jne 0x1004534
jmp 0x1004544
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
and esi, 3
mov edx, esi
pop esi
je 0x100456a
dec edx
je 0x1004565
dec edx
je 0x100455e
dec edx
jne 0x100456a
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
movzx ecx, byte [ecx]
xor eax, ecx
pop ebp
ret 0xc

Function at 0x129b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x129b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x129b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x129b06a
add dl, dl
jne 0x129b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x129b0dc
xor eax, eax
add dl, dl
jne 0x129b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x129b17d
add dl, dl
jne 0x129b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x129b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x129b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x129b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x129b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x129b075
mov eax, 1
add dl, dl
jne 0x129b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x129b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x129b0e1
sub eax, ebx
mov ebx, 1
jne 0x129b128
mov ecx, 1
add dl, dl
jne 0x129b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x129b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x129b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x129b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x129b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x129b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x129b136
cmp eax, 0x7d00
jae 0x129b16d
cmp eax, 0x500
jb 0x129b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x129b075
cmp eax, 0x7f
ja 0x129b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x129b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x129b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x129b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4034b4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407018]
jne 0x4034be
repz ret
jmp fcn.004038ce
Function at 0x401da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401db9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401df4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401df0
lea ebx, [ebx]
cmp esi, eax
jae 0x401df4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401de0
cmp esi, eax
jb 0x401dfa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40fc03
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ce60]
jne 0x40fc0d
repz ret
jmp fcn.0041456c

Function at 0x41a600
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413f7b
and dword [ebp - 4], 0
cmp dword [0x430ac0], 0
mov ebx, eax
jne 0x41a6b1
push 0x425cf8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41a762
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x425cec
push edi
call esi
test eax, eax
je 0x41a762
push eax
call fcn.00413f09
mov dword [esp], 0x425cdc
push edi
mov dword [0x430ac0], eax
call esi
push eax
call fcn.00413f09
mov dword [esp], 0x425cc8
push edi
mov dword [0x430ac4], eax
call esi
push eax
call fcn.00413f09
mov dword [esp], 0x425cac
push edi
mov dword [0x430ac8], eax
call esi
push eax
call fcn.00413f09
pop ecx
mov dword [0x430ad0], eax
test eax, eax
je 0x41a6b1
push 0x425c94
push edi
call esi
push eax
call fcn.00413f09
pop ecx
mov dword [0x430acc], eax
mov eax, dword [0x430acc]
cmp eax, ebx
je 0x41a709
cmp dword [0x430ad0], ebx
je 0x41a709
push eax
call fcn.00413f84
push dword [0x430ad0]
mov esi, eax
call fcn.00413f84
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41a709
test edi, edi
je 0x41a709
call esi
test eax, eax
je 0x41a700
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41a700
test byte [ebp - 0xc], 1
jne 0x41a709
or dword [ebp + 0x10], 0x200000
jmp 0x41a742
mov eax, dword [0x430ac4]
cmp eax, ebx
je 0x41a742
push eax
call fcn.00413f84
pop ecx
test eax, eax
je 0x41a742
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41a742
mov eax, dword [0x430ac8]
cmp eax, ebx
je 0x41a742
push eax
call fcn.00413f84
pop ecx
test eax, eax
je 0x41a742
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430ac0]
call fcn.00413f84
pop ecx
test eax, eax
je 0x41a762
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41a764
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret