joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104d806a
add dl, dl
jne 0x104d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104d80dc
xor eax, eax
add dl, dl
jne 0x104d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104d817d
add dl, dl
jne 0x104d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104d8075
mov eax, 1
add dl, dl
jne 0x104d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104d80e1
sub eax, ebx
mov ebx, 1
jne 0x104d8128
mov ecx, 1
add dl, dl
jne 0x104d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104d8136
cmp eax, 0x7d00
jae 0x104d816d
cmp eax, 0x500
jb 0x104d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104d8075
cmp eax, 0x7f
ja 0x104d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x97f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x97f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x97f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97f06a
add dl, dl
jne 0x97f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97f0dc
xor eax, eax
add dl, dl
jne 0x97f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97f17d
add dl, dl
jne 0x97f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x97f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x97f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x97f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x97f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x97f075
mov eax, 1
add dl, dl
jne 0x97f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x97f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x97f0e1
sub eax, ebx
mov ebx, 1
jne 0x97f128
mov ecx, 1
add dl, dl
jne 0x97f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x97f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x97f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x97f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x97f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x97f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x97f136
cmp eax, 0x7d00
jae 0x97f16d
cmp eax, 0x500
jb 0x97f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x97f075
cmp eax, 0x7f
ja 0x97f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x97f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x97f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x97f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10026cc1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10026ce7
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10026ce5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10026d32
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10026d15
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10026d32
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10017853
mov dword [eax], 0xd594484f
jmp 0x10026d0a
mov esp, ebp
pop ebp
ret
Function at 0x1002e1d7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002e1fb
xor eax, eax
jmp 0x1002e321
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002e219
xor eax, eax
jmp 0x1002e321
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x5486
push 1
call fcn.1002e075
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002e23d
xor eax, eax
jmp 0x1002e321
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp - 8]
push dword [ebp - 0x10]
call fcn.1002df30
add esp, 0x18
push 0x782d
push dword [ebp + 8]
push dword [ebp - 4]
push 0x7f0b
push dword [ebp - 8]
push 0xe51
push 0
call fcn.1002da30
add esp, 0x1c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002e29b
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1002e0ca
add esp, 0xc
push dword [ebp - 4]
call fcn.1002ce5a
pop ecx
test eax, eax
jne 0x1002e2ac
xor eax, eax
jmp 0x1002e321
push 1
lea eax, [ebp - 4]
push eax
push 0x7fab
push 0x2025
call fcn.1002e121
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002e309
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002e2e3
xor eax, eax
jmp 0x1002e321
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002e2fc
xor eax, eax
jmp 0x1002e321
lea eax, [ebp - 4]
push eax
push 1
call fcn.1002e1a0
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002e31a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002e31e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10042316
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004245d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x10042391
push 9
pop eax
test eax, eax
jne 0x10042391
and dword [ebp - 0xc], 0
jmp 0x10042398
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, 0x1e6e2bfb
sub eax, dword [ebp - 0xc]
imul eax, eax, 0xf1fd
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x100423cd
mov eax, 0xffff
test eax, eax
je 0x100423cd
mov dword [ebp - 0x18], 1
jmp 0x100423d1
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jge 0x100423e4
mov dword [ebp - 0x1c], 1
jmp 0x100423e8
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
imul eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
cmp eax, dword [ecx]
je 0x10042401
mov dword [ebp - 0x24], 1
jmp 0x10042405
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0xffffffff
jl 0x10042414
mov dword [ebp - 0x10], 1
jmp 0x10042418
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
add eax, 0xe584
cmp eax, 0x8cb6
jg 0x10042438
mov dword [ebp - 0x28], 1
jmp 0x1004243c
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x28]
jg 0x1004244f
mov dword [ebp - 0x2c], 1
jmp 0x10042453
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
jmp 0x10042471
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10042471
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esp, ebp
pop ebp
ret
Function at 0x100424d9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10042534
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10042515
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10042532
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10017853
mov dword [eax], 0xe43c
jmp 0x1004250a
jmp 0x1004253f
push 0x9dc
call dword [sym.imp.USER32.dll_GetKeyState]
mov esp, ebp
pop ebp
ret
Function at 0x1005cd50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x1005cd6e
mov ecx, dword [ebp - 8]
call fcn.1005e740
jmp 0x1005cd81
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x1005cd81
mov ecx, dword [ebp - 8]
call fcn.1005e5c0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1005e5c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x1005e5db
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x1005e647
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x1005e61f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x1005e626
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x1005e5d2
jmp 0x1005e652
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jge 0x1005e6be
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x1005e696
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x1005e69d
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x1005e649
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x1005e6fc
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x1005e703
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x1005e740
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x1005e75b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x1005e7c7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x1005e79f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x1005e7a6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x1005e752
mov esp, ebp
pop ebp
ret
Function at 0x10075993
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10088330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006cc4c
mov dword [ebp - 0x14], eax
cmp dword [0x1067478c], esi
jne 0x10075a86
push 0x800
push esi
push 0x1000600c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10075a13
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10075b66
push esi
push esi
push 0x1000600c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10075b66
push 0x10006024
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10075b66
push eax
call ebx
push 0x10006030
push edi
mov dword [0x1067478c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006040
push edi
mov dword [0x10674790], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006054
push edi
mov dword [0x10674794], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067479c], eax
test eax, eax
je 0x10075a83
push 0x10006070
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10674798], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10075aab
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10075a9e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10075ac0
push 4
pop eax
jmp 0x10075b68
cmp dword [ebp - 0x14], esi
je 0x10075ac0
push dword [0x1067478c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10075aa5
mov eax, dword [0x10674798]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10075b1e
cmp dword [0x1067479c], edi
je 0x10075b1e
push eax
call ebx
push dword [0x1067479c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10075b1e
test eax, eax
je 0x10075b1e
call ecx
test eax, eax
je 0x10075b13
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10075b13
test byte [ebp - 8], 1
jne 0x10075b1e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10075b4e
mov eax, dword [0x10674790]
cmp eax, edi
je 0x10075b4b
push eax
call ebx
test eax, eax
je 0x10075b4b
call eax
mov esi, eax
test esi, esi
je 0x10075b4b
mov eax, dword [0x10674794]
cmp eax, edi
je 0x10075b4b
push eax
call ebx
test eax, eax
je 0x10075b4b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067478c]
call ebx
test eax, eax
je 0x10075b66
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10075b68
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0xd0a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd0a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd0a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0a06a
add dl, dl
jne 0xd0a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0a0dc
xor eax, eax
add dl, dl
jne 0xd0a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0a17d
add dl, dl
jne 0xd0a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd0a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd0a075
mov eax, 1
add dl, dl
jne 0xd0a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd0a0e1
sub eax, ebx
mov ebx, 1
jne 0xd0a128
mov ecx, 1
add dl, dl
jne 0xd0a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd0a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd0a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd0a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd0a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd0a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd0a136
cmp eax, 0x7d00
jae 0xd0a16d
cmp eax, 0x500
jb 0xd0a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd0a075
cmp eax, 0x7f
ja 0xd0a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd0a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd0a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd0a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x6066c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x128000]
push edi
or ebp, 0xffffffff
jmp 0x6066e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6066e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6066d8
mov eax, 1
add ebx, ebx
jne 0x6066fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x60670c
jne 0x60672b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x60672b
dec eax
add ebx, ebx
jne 0x606718
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6066f0
add ebx, ebx
jne 0x606727
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x60677d
xor ecx, ecx
sub eax, 3
jb 0x606743
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6067b2
sar eax, 1
mov ebp, eax
jmp 0x60674e
add ebx, ebx
jne 0x60674e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x60671c
inc ecx
add ebx, ebx
jne 0x60675c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x60671c
add ebx, ebx
jne 0x606769
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x60675e
jne 0x60677a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x60675e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x60679c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x60678e
jmp 0x6066de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x60679c
add edi, ecx
jmp 0x6066de
pop esi
mov edi, esi
mov ecx, 0x6560
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6067ba
cmp byte [edi], 0x13
jne 0x6067ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6067bf
lea edi, [esi + 0x203000]
mov eax, dword [edi]
or eax, eax
je 0x606837
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x207efc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x208050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6067ec
mov ecx, edi
jns 0x60681b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x208054]
or eax, eax
je 0x606831
mov dword [ebx], eax
add ebx, 4
jmp 0x606809
call dword [esi + 0x208064]
mov ebp, dword [esi + 0x208058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x60686b
sub esp, 0xffffff80
jmp 0x4c4387