joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495d38
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.0047ca40
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.kernel32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x4bb110]
je 0x495e3f
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetFileTime]
test eax, eax
je 0x495da8
push ebx
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x495daf
cmp ebx, ebx
jne 0x495daf
xor eax, eax
jmp 0x495e42
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x495dbc
mov byte [esi + 0x20], bl
jmp 0x495dd0
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00472981
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.00472981
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.00472981
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x495e2b
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x495e3f
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x499186
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4d3804]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x4991d5
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x4991d5
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
je 0x4991e1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0047bda9
leave
ret 8
Function at 0x49aa50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4d3804]
push ebx
push esi
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.0049aa39
cmp dword [esi], 0
mov ebx, eax
je 0x49aab0
push edi
mov edi, dword [ebp + 0x18]
push pe_nt_image_headers32
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push eax
call fcn.0047e82f
add esp, 0xc
cmp eax, 1
pop edi
je 0x49aacd
push 0xffffffffffffffff
push 0
push dword [ebp + 0x14]
call fcn.0049af0b
mov ecx, esi
call fcn.0049a8fe
jmp 0x49aacd
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push eax
call fcn.0047cb1b
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.00499186
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0047bda9
leave
ret

Function at 0x49b162
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4d3804]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x49b1af
push dword [ebp + 8]
call fcn.004a0c9d
mov esi, eax
test esi, esi
je 0x49b1d7
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x49b1d7
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x4ba088
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0047bda9
leave
ret 0xc

Function at 0x49f4ca
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x4d3804]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x49f528
push 0x4bb964
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0047d7bf
add esp, 0x10
cmp eax, 0xffffffff
je 0x49f53c
cmp eax, esi
jae 0x49f53c
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
jmp 0x49f53e
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
jne 0x49f4f3
jmp 0x49f53f
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.0047bda9
leave
ret
Function at 0x49f55f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4d3804]
push ebx
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
xor ebx, ebx
push 0x4b2d5c
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push 0x4bb9bc
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
cmp eax, ebx
je 0x49f601
call eax
mov esi, dword [sym.imp.kernel32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push 0x4bb9a0
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x49f703
call dword [sym.imp.kernel32.dll_GetVersion]
test eax, eax
jns 0x49f6b1
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push 0x4bb978
push 0x80000001
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49f704
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49f6a6
cmp dword [ebp - 0x24], 1
jne 0x49f6a6
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x4bb974
push eax
call fcn.0047e82f
add esp, 0xc
cmp eax, 1
jne 0x49f6a6
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.kernel32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49f704
push 0x4bb968
call edi
cmp eax, ebx
je 0x49f704
lea ecx, [ebp - 0x18]
push ecx
push 0x49f549
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.kernel32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x49f704
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x49f72a
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.0049f4ca
cmp eax, ebx
pop ecx
pop ecx
jne 0x49f72c
inc edi
cmp edi, esi
jl 0x49f713
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0047bda9
leave
ret 4
Function at 0x49fbb0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4adb32
call fcn.0047e810
sub esp, 0x11c
mov eax, dword [0x4d3804]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x49fca9
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x49fc7d
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00403fe0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0049fbb0
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004023a0
test bl, bl
jne 0x49fc7d
or dword [ebp - 4], 0xffffffff
jmp 0x49fbee
cmp esi, 0x103
je 0x49fc8d
cmp esi, 0x3f2
jne 0x49fc9d
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0047bda9
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4a030d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4a0342
cmp edi, dword [esi + 0xc]
jge 0x4a0342
push dword [esi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4a0342
cmp edi, dword [eax + 8]
jge 0x4a0342
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4a0344
xor edi, edi
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a0448
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4a047c
jmp fcn.0048b729
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x4a04ed
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x4a05e6
cmp eax, dword [edi + 0xc]
jge 0x4a05e6
push dword [edi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4a053e
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x4a05cf
cmp dword [ebp + 0xc], ebx
je 0x4a05cf
jmp 0x4a0568
push 0x10
call fcn.004a01d9
cmp eax, ebx
je 0x4a0554
mov ecx, eax
call fcn.004a043f
mov esi, eax
jmp 0x4a0556
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x4a057f
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.kernel32.dll_LocalAlloc]
jmp 0x4a058f
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.kernel32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x4a05a1
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.0048b729
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0047ca40
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4a05e1
cmp ecx, dword [esi + 8]
jge 0x4a05e1
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x4a05e7
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x47bf80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x54000]
push edi
or ebp, 0xffffffff
jmp 0x47bfa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47bfa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bf98
mov eax, 1
add ebx, ebx
jne 0x47bfbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47bfcc
jne 0x47bfeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bfeb
dec eax
add ebx, ebx
jne 0x47bfd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47bfb0
add ebx, ebx
jne 0x47bfe7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47c03d
xor ecx, ecx
sub eax, 3
jb 0x47c003
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47c072
sar eax, 1
mov ebp, eax
jmp 0x47c00e
add ebx, ebx
jne 0x47c00e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bfdc
inc ecx
add ebx, ebx
jne 0x47c01c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bfdc
add ebx, ebx
jne 0x47c029
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47c01e
jne 0x47c03a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47c01e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47c05c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47c04e
jmp 0x47bf9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47c05c
add edi, ecx
jmp 0x47bf9e
pop esi
mov edi, esi
mov ecx, 0x17c2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47c07a
cmp byte [edi], 0xa
jne 0x47c07a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47c07f
lea edi, [esi + 0x78000]
mov eax, dword [edi]
or eax, eax
je 0x47c0f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x80184]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8024c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47c0ac
mov ecx, edi
jns 0x47c0db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x80250]
or eax, eax
je 0x47c0f1
mov dword [ebx], eax
add ebx, 4
jmp 0x47c0c9
call dword [esi + 0x80260]
mov ebp, dword [esi + 0x80254]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47c12b
sub esp, 0xffffff80
jmp 0x432560
Function at 0x40ed5e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x40eae0
or ebx, esi
sub esi, 1
call fcn.0040ed86
xor dword [eax], edx
inc esi
mov esi, 0x75e77cca
add eax, 1
inc ebx
cmp eax, ecx
jne fcn.0040ed5e
ret

Function at 0x16a59f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.FKP1
lea edi, [esi - 0x1272000]
push edi
or ebp, 0xffffffff
jmp 0x16a5a12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a5a19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a5a08
mov eax, 1
add ebx, ebx
jne 0x16a5a2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a5a3c
jne 0x16a5a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a5a5b
dec eax
add ebx, ebx
jne 0x16a5a48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a5a20
add ebx, ebx
jne 0x16a5a57
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x16a5aad
xor ecx, ecx
sub eax, 3
jb 0x16a5a73
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a5ae2
sar eax, 1
mov ebp, eax
jmp 0x16a5a7e
add ebx, ebx
jne 0x16a5a7e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a5a4c
inc ecx
add ebx, ebx
jne 0x16a5a8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a5a4c
add ebx, ebx
jne 0x16a5a99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a5a8e
jne 0x16a5aaa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a5a8e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x16a5acc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a5abe
jmp 0x16a5a0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a5acc
add edi, ecx
jmp 0x16a5a0e
pop esi
mov edi, esi
mov ecx, 0x34f3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a5aea
cmp byte [edi], 0x16
jne 0x16a5aea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x16a5aef
lea edi, [esi + 0x12a2000]
mov eax, dword [edi]
or eax, eax
je 0x16a5b5e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a67a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a6890]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a5b1c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a6894]
or eax, eax
je 0x16a5b58
mov dword [ebx], eax
add ebx, 4
jmp 0x16a5b39
call dword [esi + 0x12a68a4]
mov ebp, dword [esi + 0x12a6898]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x16a5b92
sub esp, 0xffffff80
jmp 0x46c1ac
Function at 0x56a05c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0056a0db
jae 0x56a068
xor ecx, ecx
call fcn.0056a0db
jae 0x56a092
xor eax, eax
call fcn.0056a0db
jae 0x56a0a3
mov al, 0x10
call fcn.0056a0db
adc al, al
jae 0x56a084
jne 0x56a0d0
stosb byte es:[edi], al
jmp 0x56a069
call fcn.0056a0e7
dec ecx
loop 0x56a0af
mov eax, ebp
call fcn.0056a0e5
jmp 0x56a0d1
lodsb al, byte [esi]
shr eax, 1
je 0x56a0f7
adc ecx, 2
mov ebp, eax
jmp 0x56a0d1
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0056a0e5
cmp eax, 0x7d00
jae 0x56a0cf
cmp eax, 0x500
jae 0x56a0d0
cmp eax, 0x7f
ja 0x56a0d1
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x56a069
pop ebp
ret 8
Function at 0x1011c37d
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.1011c3fc
jae 0x1011c389
xor ecx, ecx
call fcn.1011c3fc
jae 0x1011c3b3
xor eax, eax
call fcn.1011c3fc
jae 0x1011c3c4
mov al, 0x10
call fcn.1011c3fc
adc al, al
jae 0x1011c3a5
jne 0x1011c3f1
stosb byte es:[edi], al
jmp 0x1011c38a
call fcn.1011c408
dec ecx
loop 0x1011c3d0
mov eax, ebp
call fcn.1011c406
jmp 0x1011c3f2
lodsb al, byte [esi]
shr eax, 1
je 0x1011c418
adc ecx, 2
mov ebp, eax
jmp 0x1011c3f2
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.1011c406
cmp eax, 0x7d00
jae 0x1011c3f0
cmp eax, 0x500
jae 0x1011c3f1
cmp eax, 0x7f
ja 0x1011c3f2
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1011c38a
pop ebp
ret 8
Function at 0x100065b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [0x101834e4], 0
mov dword [0x101834e8], 0
mov dword [0x101834ec], 0
mov dword [ebp - 0x20], 0
mov dword [0x101834dc], 0x1a14
mov dword [ebp - 0x20], 0
jmp 0x1000661b
mov dword [0x101834e0], 0x20c0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x10]
jae 0x10006609
mov eax, 0x100
mov ecx, dword [0x101834e4]
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x101834e4], edx
mov dword [0x101834dc], 0xfbe
mov edx, dword [0x101834e8]
mov esi, dword [0x101834e4]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x101834e8], edx
mov edx, dword [0x101834e4]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov byte [ebp - 0x21], bl
mov edx, dword [0x101834e8]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov edx, dword [0x101834e4]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov dword [0x101834dc], 0x1d46
mov bl, byte [ebp - 0x21]
mov edx, dword [0x101834e8]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov edx, dword [0x101834e4]
mov esi, dword [ebp - 0x1c]
movzx edx, byte [esi + edx]
mov esi, dword [0x101834e8]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [0x101834ec], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
movzx ecx, byte [edx + ecx]
mov edx, dword [0x101834ec]
mov esi, dword [ebp - 0x1c]
movzx edx, byte [esi + edx]
xor ecx, edx
mov bl, cl
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov byte [edx + ecx], bl
mov ecx, dword [0x101834e0]
add ecx, 0x374
mov dword [0x101834e0], ecx
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
jmp 0x1000661b
Function at 0x10006820
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.10006820]
mov dword [ebp - 4], eax
mov eax, dword [0x101834e0]
sub eax, 0x1fd1
mov dword [0x101834e0], eax
jmp 0x10006849
mov dword [ebp - 8], 0
jmp 0x100068a6
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x5a4d
sete cl
mov byte [ebp - 9], cl
mov al, byte [ebp - 9]
test al, 1
jne 0x10006863
jmp 0x1000687f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1000687d
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x100068a6
jmp 0x1000687f
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov eax, dword [0x101834dc]
sub eax, 0x243b
mov dword [0x101834e0], eax
mov al, 1
test al, 1
jne 0x10006849
jmp 0x10006840
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebp
ret