joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011fc40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012e6ab
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x32005f
mov dword [ebp - 0x58], 0x390039
mov dword [ebp - 0x54], 0x370039
mov dword [ebp - 0x50], 0x360045
mov dword [ebp - 0x4c], 0x2d0045
mov dword [ebp - 0x48], 0x330033
mov dword [ebp - 0x44], 0x340036
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x330030
mov dword [ebp - 0x38], 0x2d0038
mov dword [ebp - 0x34], 0x440038
mov dword [ebp - 0x30], 0x310038
mov dword [ebp - 0x2c], 0x44002d
mov dword [ebp - 0x28], 0x330046
mov dword [ebp - 0x24], 0x420045
mov dword [ebp - 0x20], 0x360046
mov dword [ebp - 0x1c], 0x320038
mov dword [ebp - 0x18], 0x420036
mov dword [ebp - 0x14], 0x45
call fcn.100088b0
mov ecx, eax
test ecx, ecx
je 0x1011fdde
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10016a90
test al, al
jne 0x1011fdbe
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1011fda0
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000b940
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10008520
int3
Function at 0x1011fdf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012e728
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0x690059
mov dword [ebp - 0x64], 0x67006e
mov dword [ebp - 0x60], 0x610079
mov dword [ebp - 0x5c], 0x43006e
mov dword [ebp - 0x58], 0x6e006f
mov dword [ebp - 0x54], 0x690066
mov dword [ebp - 0x50], 0x430067
mov dword [ebp - 0x4c], 0x6e0065
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x530072
mov dword [ebp - 0x40], 0x750074
mov dword [ebp - 0x3c], 0x500062
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], 0x690066
mov dword [ebp - 0x30], 0x570078
mov dword [ebp - 0x2c], 0x64006e
mov dword [ebp - 0x28], 0x6c0043
mov dword [ebp - 0x24], 0x730061
mov dword [ebp - 0x20], 0x4e0073
mov dword [ebp - 0x1c], 0x6d0061
mov dword [ebp - 0x18], 0x5f0065
mov word [ebp - 0x14], ax
call fcn.100088b0
mov ecx, eax
test ecx, ecx
je 0x1011ff2b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10016a90
test al, al
jne 0x1011ff0b
lea ecx, [ebp - 0x68]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1011fef0
sub ecx, edx
lea eax, [ebp - 0x68]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000b940
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10008520
int3

Function at 0x1011ff40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012e858
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x4f0053
mov dword [ebp - 0x30], 0x540046
mov dword [ebp - 0x2c], 0x410057
mov dword [ebp - 0x28], 0x450052
mov dword [ebp - 0x24], 0x59005c
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1c], 0x790067
mov dword [ebp - 0x18], 0x6e0061
mov word [ebp - 0x14], ax
call fcn.100088b0
mov ecx, eax
test ecx, ecx
je 0x10120019
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10016a90
test al, al
jne 0x1011fffb
lea ecx, [ebp - 0x34]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1011ffe0
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000b940
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10008520
int3
Function at 0x101210f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
js 0x10121259
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.100e67c0
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call edi
test esi, esi
jle 0x1012115f
lea eax, [ebp - 0x228]
push eax
call edi
sub esi, 1
jne 0x10121151
mov eax, dword [0x10183c30]
mov esi, dword [eax]
cmp esi, eax
je 0x10121259
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.100e67c0
add esp, 0xc
lea eax, [ebp - 0x228]
push dword [esi + 0x14]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
mov ecx, dword [esi + 0x10]
test eax, eax
jne 0x10121280
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov word [ebp - 8], ax
cmp ecx, 3
jne 0x10121211
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
test eax, eax
jne 0x1012126c
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x10121237
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10121233
cmp esi, dword [eax + 8]
jne 0x10121233
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x10121223
mov esi, eax
jmp 0x1012124d
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x1012124d
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x10121241
cmp esi, dword [0x10183c30]
jne 0x10121180
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x4010f5
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x411020]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0xa0
mov eax, 0x40d7f4
call fcn.00409686
mov eax, dword [ebp + 0x218]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 0x20], ebx
test byte [0x412c50], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], eax
jne 0x401162
mov eax, dword [0x41205c]
or dword [0x412c50], 1
mov ecx, 0x41205c
call dword [eax + 0xc]
add eax, 0x10
push 0x40d97d
mov dword [0x412c4c], eax
call fcn.00402d62
pop ecx
mov eax, dword [0x412c4c]
mov eax, dword [eax - 0xc]
cmp eax, ebx
jne 0x40127b
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
jle 0x40127b
lea eax, [ebp]
call fcn.004017dd
push str.RootGenius_shuame_
push 0x412c4c
call fcn.00401807
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push dword [0x412c4c]
call esi
lea eax, [ebp - 0x18]
push eax
mov edi, str.Data_
call fcn.00401744
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 4], 1
call fcn.0040183b
mov eax, dword [eax]
pop ecx
pop ecx
push ebx
push eax
call esi
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.00401f7c
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401f7c
lea eax, [ebp - 0x10]
push eax
mov edi, str.DataApk
call fcn.00401744
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 2
call fcn.0040183b
mov eax, dword [eax]
pop ecx
pop ecx
push ebx
push eax
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
lea eax, [ebp - 0x10]
push eax
mov edi, str.DataBin
call fcn.00401744
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 3
call fcn.0040183b
mov eax, dword [eax]
pop ecx
pop ecx
push ebx
push eax
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x28]
push esi
call fcn.00401890
pop ecx
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [esi]
push 3
push eax
lea eax, [ebp - 0xac]
lea ecx, [ebp - 0xa8]
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0xac], ecx
call fcn.004019d4
push dword [ebp - 0xac]
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0xac], eax
je 0x4012d3
push dword [ebp - 0xac]
call fcn.00402f32
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.00402c2c
add ebp, 0x210
leave
ret
Function at 0x4012f8
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
push esi
push edi
push 0x40fac8
push eax
push dword [0x412c44]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 8], eax
cmp edi, esi
jne 0x401331
xor al, al
jmp 0x401382
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x40132d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x80
push 2
push esi
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
mov edi, eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
cmp edi, esi
je 0x401380
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebp
ret

Function at 0x401386
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x40d8ee
call fcn.00409686
mov eax, dword [0x41205c]
mov ecx, 0x41205c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x40fad8
lea ecx, [ebp - 0x14]
call fcn.004010f5
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040179c
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
push eax
push 0x82
call fcn.004012f8
pop ecx
mov bl, al
pop ecx
lea eax, [esi - 0x10]
call fcn.00401f7c
mov al, bl
call fcn.00409725
ret

Function at 0x4013f9
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x40d8c3
call fcn.00409686
mov eax, dword [0x41205c]
mov ecx, 0x41205c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push str.RootGenius.zip
lea ecx, [ebp - 0x14]
call fcn.004010f5
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040179c
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov edi, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
lea eax, [ebp - 0x10]
push eax
push 0x84
call fcn.004012f8
mov bl, al
pop ecx
pop ecx
test bl, bl
je 0x4014a0
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x40fc7c
call fcn.004010f5
lea eax, [edi - 0x10]
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], esp
mov ebx, esp
call fcn.00401b0b
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0
call fcn.00401fac
add esp, 0xc
push edi
mov bl, al
call esi
lea eax, [edi - 0x10]
call fcn.00401f7c
mov al, bl
call fcn.00409725
ret
Function at 0x4014b0
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x40d890
call fcn.00409686
mov eax, dword [0x41205c]
mov ecx, 0x41205c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push str.RootGeniusEx.zip
lea ecx, [ebp - 0x18]
call fcn.004010f5
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040179c
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401f7c
mov edi, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
lea eax, [ebp - 0x14]
push eax
push 0x85
call fcn.004012f8
pop ecx
pop ecx
mov byte [ebp - 0xd], al
test al, al
je 0x40155c
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x40fc7c
call fcn.004010f5
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], esp
lea eax, [edi - 0x10]
mov dword [ebp - 0x18], esp
call fcn.00401b0b
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
mov byte [ebp - 4], 0
call fcn.00401fac
add esp, 0xc
push edi
mov byte [ebp - 0xd], al
call esi
lea eax, [edi - 0x10]
call fcn.00401f7c
mov al, byte [ebp - 0xd]
call fcn.00409725
ret

Function at 0x40156d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edi, ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x40fb30
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
and dword [ebp - 0x10], 0x80000000
and eax, 0x7fffffff
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x20], eax
xor esi, esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], esi
fild qword [ebp - 0x24]
fild qword [ebp - 0x14]
fchs
faddp st(1)
fld qword [0x40fcb8]
fmul st(1), st(0)
fmulp st(1)
fcomp qword [0x40fcb0]
fnstsw ax
test ah, 5
jp 0x401607
push 4
mov eax, edi
pop ecx
and eax, 0x3ff
push 0x30
cmp cx, ax
jne 0x4015fa
push 0x40fb38
push 0x40fb40
jmp 0x401604
push str.Warning
push str.C_disk_space_will_cause_the_software_can_not_be_used_
push esi
call ebx
mov byte [ebp - 5], 1
call fcn.00401386
test al, al
jne 0x401619
mov byte [ebp - 5], al
jmp 0x401687
push 0x40fad8
lea ecx, [ebp - 0x10]
call fcn.004010f5
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop ecx
push dword [eax]
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004013f9
test al, al
jne 0x401657
mov byte [ebp - 5], al
jmp 0x40167a
push 0x40fbe4
lea ecx, [ebp - 0x10]
call fcn.004010f5
pop ecx
push dword [eax]
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
call fcn.004014b0
cmp byte [ebp - 5], 0
jne 0x4016b0
xor esi, esi
push 4
pop eax
and edi, 0x3ff
push 0x30
cmp ax, di
jne 0x4016a3
push 0x40fc04
push str.Root
jmp 0x4016ad
push str.Error
push str.Root_Genius_failed_to_initialize_
push esi
call ebx
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402c2c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411020]
jne 0x402c36
repz ret
jmp fcn.0040361c

Function at 0x407b1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403794
and dword [ebp - 4], 0
cmp dword [0x412b68], 0
mov ebx, eax
jne 0x407bcd
push 0x40f0fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407c7e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40f0f0
push edi
call esi
test eax, eax
je 0x407c7e
push eax
call fcn.00403722
mov dword [esp], 0x40f0e0
push edi
mov dword [0x412b68], eax
call esi
push eax
call fcn.00403722
mov dword [esp], 0x40f0cc
push edi
mov dword [0x412b6c], eax
call esi
push eax
call fcn.00403722
mov dword [esp], 0x40f0b0
push edi
mov dword [0x412b70], eax
call esi
push eax
call fcn.00403722
pop ecx
mov dword [0x412b78], eax
test eax, eax
je 0x407bcd
push 0x40f098
push edi
call esi
push eax
call fcn.00403722
pop ecx
mov dword [0x412b74], eax
mov eax, dword [0x412b74]
cmp eax, ebx
je 0x407c25
cmp dword [0x412b78], ebx
je 0x407c25
push eax
call fcn.0040379d
push dword [0x412b78]
mov esi, eax
call fcn.0040379d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407c25
test edi, edi
je 0x407c25
call esi
test eax, eax
je 0x407c1c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407c1c
test byte [ebp - 0xc], 1
jne 0x407c25
or dword [ebp + 0x10], 0x200000
jmp 0x407c5e
mov eax, dword [0x412b6c]
cmp eax, ebx
je 0x407c5e
push eax
call fcn.0040379d
pop ecx
test eax, eax
je 0x407c5e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407c5e
mov eax, dword [0x412b70]
cmp eax, ebx
je 0x407c5e
push eax
call fcn.0040379d
pop ecx
test eax, eax
je 0x407c5e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412b68]
call fcn.0040379d
pop ecx
test eax, eax
je 0x407c7e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407c80
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4be3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.04be378f
jae 0x4be370e
xor ecx, ecx
call fcn.04be378f
jae 0x4be373d
xor eax, eax
call fcn.04be378f
jae 0x4be374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.04be378f
adc al, al
jae 0x4be372f
jne 0x4be3779
stosb byte es:[edi], al
jmp 0x4be3711
call fcn.04be379b
sub ecx, ebx
jne 0x4be3756
call fcn.04be3799
jmp 0x4be3775
lodsb al, byte [esi]
shr eax, 1
je 0x4be3783
adc ecx, ecx
jmp 0x4be3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.04be3799
cmp eax, 0x7d00
jae 0x4be3772
cmp ah, 5
jae 0x4be3773
cmp eax, 0x7f
ja 0x4be3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4be3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x402aeb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43631d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x44c054]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x44c054]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
cmp ebx, esi
jne 0x402b35
xor eax, eax
jmp 0x402ca5
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x402b5e
mov edx, dword [edi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x402b5e
dec dword [edx]
mov edx, dword [edi + 0x20]
mov eax, ebx
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x402ca5
cmp dword [edi + 0x50], 0
je 0x402ca3
mov ecx, edi
call fcn.00403ad4
xor eax, eax
cmp dword [edi + 0x40], eax
jne 0x402b8f
push dword [edi + 0x50]
movsx eax, bl
push eax
call dword [sym.imp.MSVCR110.dll_fputc]
pop ecx
cmp eax, esi
pop ecx
cmovne esi, ebx
jmp 0x402ca3
push eax
push 8
lea ecx, [esp + 0x28]
mov byte [esp + 0x1b], bl
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], eax
mov byte [esp + 0x28], al
call fcn.00407a4e
and dword [esp + 0x48], 0
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x24]
cmovae edx, dword [esp + 0x24]
lea ecx, [esp + 0x24]
cmovae ecx, dword [esp + 0x24]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x27]
push eax
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP110.dll_public:_int___thiscall_std::codecvt_char__char__int_::out_int___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x402c9a
cmp eax, 1
jg 0x402c7f
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
cmp ecx, 0x10
lea eax, [esp + 0x20]
cmovae eax, edx
sub ebx, eax
mov dword [esp + 0x14], ebx
mov ebx, dword [ebp + 8]
je 0x402c49
push dword [edi + 0x50]
cmp ecx, 0x10
push dword [esp + 0x18]
lea eax, [esp + 0x28]
cmovae eax, edx
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fwrite]
mov ecx, dword [esp + 0x24]
add esp, 0x10
cmp ecx, eax
jne 0x402c9a
jmp 0x402c4d
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x13]
mov byte [edi + 0x45], 1
cmp dword [esp + 0x1c], eax
jne 0x402c7b
test ecx, ecx
jne 0x402bb4
cmp dword [esp + 0x30], 0x20
jae 0x402c9a
push ecx
push 8
lea ecx, [esp + 0x28]
call fcn.00407a4e
jmp 0x402bb4
mov esi, ebx
jmp 0x402c9a
cmp eax, 3
jne 0x402c9a
movsx eax, byte [esp + 0x13]
push dword [edi + 0x50]
push eax
call dword [sym.imp.MSVCR110.dll_fputc]
pop ecx
cmp eax, esi
pop ecx
cmovne esi, ebx
lea ecx, [esp + 0x20]
call fcn.004023b1
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0041d508
mov esp, ebp
pop ebp
ret 4
Function at 0x407a4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x407a5d
pop dword [ebp - 0x24]
mov eax, 0xdff6d131
sub eax, 0xdfb656d4
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xcb378dde
add dword [ebp - 0x34], 0x831ab76d
mov dword [ebp - 0x30], 0xa9c01abe
sub dword [ebp - 0x30], 0x778cce79
mov dword [ebp - 0x2c], 0xd207279b
sub dword [ebp - 0x2c], 0x85bae36d
mov dword [ebp - 0x28], 0xaa1623ee
sub dword [ebp - 0x28], 0xaa1623ee
lea eax, [ebp - 0x34]
push eax
mov eax, 0xc381f70d
add eax, 0x3cc1a9a3
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x82600bc4
add dword [ebp - 0x34], 0xf2125d92
mov dword [ebp - 0x30], 0x71ad26d
sub dword [ebp - 0x30], 0xc5ae70f8
mov dword [ebp - 0x2c], 0x53d55829
sub dword [ebp - 0x2c], 0xf065ebbd
mov dword [ebp - 0x28], 0x69d86854
sub dword [ebp - 0x28], 0x69d86854
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xee600ba1
add eax, 0x11e39497
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3eaa5
push 0
call eax
mov ecx, 0x7d5a531f
sub ecx, 0x7d5a0955
mov edx, eax
mov esi, 0x457a00
add esi, dword [ebp - 0x24]
mov ebx, 0x4af4f19e
xor dword [ebp - 0x10], edx
mov edi, dword [esi]
mov dword [ebp - 0x10], 0x4d32cdd0
add edi, ebx
sub dword [ebp - 0x18], 0xdd29efbd
mov dword [edx], edi
add dword [ebp - 0x10], ebx
add edx, 0x7fe1299e
add edx, 0x801ed666
add esi, 0x6a16ff7b
add esi, 0x95e90089
loop 0x407b73
add eax, 0xa41fe35f
add eax, 0x5be1369c
xor ebx, ebx
add ebx, eax
add eax, 0x5b382d06
sub eax, 0x5b382d01
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret