joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406609
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x406640
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40661a
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406615
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406671
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x406653
pop edi
not eax
pop esi
ret 0xc

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x40eee6
Capabilities:
Encode data using xor

Disassembly:
push edi
pop eax
rcl word [eax - 0x2519fb67], cl
salc
fcmovbe st(0), st(6)
insb byte es:[edi], dx
xchg ebx, eax
stc
lcall 0xa192, 0x70015827
movsd dword es:[edi], dword [esi]
mov bl, 0x7e
aas
mov edx, 0x826bee5c
cld
add ch, 0x3a
arpl word [ecx + 0x18], bx
xor dl, ah
cld
mov dword [0x7f4af94b], eax
sbb ch, byte [ebp + 0x13dded04]
cmpsb byte [esi], byte es:[edi]
pop eax
inc edx
stosd dword es:[di], eax
push 0xffffffffffffff98
jo 0x40eeee
jnp 0x40ef2d
cmovb ebx, dword [ebx + 0x57b73c9e]
xchg dword [eax - 0x2c754f9b], esi
aam 0xce
mov al, 0x8a
rcl esp, cl
into
cmpsd dword [esi], dword es:[edi]
sbb ah, byte [eax + ebx*2 - 0x22]
sti
test eax, 0x8f95db89
mov al, 0x4c
dec esi
pop eax
call 0x509b6ddd
push eax
push edx
retf 0xaa8f

Function at 0x4163ec
Capabilities:
Encode data using xor

Disassembly:
or bl, al
outsd dx, dword [esi]
lea ecx, [ebp + 0x117b8f70]
lea esi, [eax - 0x71]
jnp 0x4163ad
adc dword [esi], edi
push edx
push edx
pop edx
mul dh
xchg edi, eax
lodsd eax, dword [esi]
or esi, esp
xor eax, 0x39808014
loop 0x41639b
cld
out dx, al
out 0x99, al
cmp byte [ebp - 0x6f087b41], ah
mov ebx, eax
mov bl, 0x46
jnp 0x416393
pop esp
loop 0x41641b
jne 0x4163ef
cdq
sub ch, byte [eax + 0x32eb1040]
invalid
movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
arpl word [ecx], bp
jbe 0x416397
sub dword [esi - 0x5b], esi
xor dword [ebp + 0xcd7d4ff], eax
cmp al, 8
xor al, 0x60
insd dword es:[edi], dx
inc esp
sal byte [edx - 0x178ed794], 0x3a
wait
adc dh, dh
invalid
popal
pop ebp
cmp bh, byte [ebx + 0x60]
scasb al, byte es:[edi]
cmp edi, dword [edx + 0x79]
fld qword [eax - 0x22]
das
cmpsb byte [esi], byte es:[edi]
cmp dh, byte [ecx - 0x5f4affe4]
mov ah, byte [edx - 0x6d96d759]
cmp byte [ebx + 0x69], dl
mov dword [esi + edx*4], esi
mov esi, 0x87a8312c
inc eax
sbb byte [ebx], ah
cwde
push edi
sti
sbb ecx, dword [ecx]
push 0x12
in al, 0x4b
xchg byte [ebp + 0x5252a8b4], dl
lahf
sti
fild word [eax - 0x2b]
add eax, 0x42056261
lodsd eax, dword [esi]
push ds
dec edx
pop esp
xchg ebx, eax
jge 0x41640e
inc edx
fild qword [esi - 0x19e8aaf]
rol al, 0xa6
xchg esp, eax
or dword [edx + 0x428a3e8a], ebp
dec edx
scasb al, byte es:[edi]
pop ds
add edi, edi
jne 0x416458
cmc
movsd dword es:[edi], dword [esi]
sbb esi, dword [ebx + 0x3f04bc6a]
mov ch, 0x69
je 0x416480
popal
dec eax
or dl, byte [ecx - 0x57]
ret 0x1fe8
Function at 0x417c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x632038]
mov edx, dword [0x63203c]
mov dword [esp + 0x14], 0
push esi
lea ecx, [eax + eax]
push edi
or ecx, edx
lea edx, [esp + 0x10]
mov dword [esp + 0x18], ecx
push edx
fild qword [esp + 0x1c]
push 0x20019
push 0
mov esi, 0x190
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
fadd qword [0x632050]
push SysFreeString
mov edi, esi
fstp qword [0x632050]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x417cde
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0xc]
push ebp
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
mov ebp, 4
push str.Browse_For_Folder_Width
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call ebx
test eax, eax
jne 0x417ca4
mov edi, dword [esp + 0x1c]
xor esi, esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call ebx
pop ebp
pop ebx
test eax, eax
jne 0x417cd3
or esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret

Function at 0x43b298
Capabilities:
Check for software breakpoints

Disassembly:
cmp eax, 0xcf5126f4
inc esp
mov dl, 0x10
add byte [edi], bh
movsd dword es:[edi], dword [esi]
and ch, byte [ebx + 0x60]
pop esi
inc ebp
fnstenv [edi + ecx]
mov dl, byte [ebx + edx*4]
push ebx
int 0x56
ret 0xf559
jbe 0x43b267
not dword [edi]
dec eax
outsd dx, dword [esi]
clc
insd dword es:[edi], dx
adc ebx, dword [eax - 0xfbaf1fc]
mov word [ebx - 0xf], gs
fdiv dword [esi + 0x48]
enter 0xffffffffffff8b2a, 0xffffffffffffff94
bound ecx, qword [ecx + 1]
fld qword [ebp + 0x37]
dec edx
adc byte [edx + 0x135006bd], 0x49
inc esi
dec eax
dec ebx
mov dh, 7
lea ebp, [eax - 0x12e9aaa7]
invalid

Function at 0x468fc8
Capabilities:
Encode data using xor

Disassembly:
fisub dword [edx - 0x47]
aas
lodsb al, byte [esi]
mov byte [0x20bbc379], al
lcall 0xb945, 0x5820d813
and byte [edi + 0x69e0b4e2], dl
push ebp
cwde
cmp edi, eax
lodsb al, byte [esi]
popfd
xor al, 0xcc
adc al, 0x73
sbb eax, 0xf6e99fdc
mov ebp, 0x7c967730
invalid
Function at 0x629445
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x632418
cmp edx, dword [eax]
je 0x629467
add eax, 8
inc ecx
cmp eax, 0x6324a8
jl 0x629458
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x632418]
jne 0x629595
mov eax, dword [0x63bda0]
cmp eax, 1
je 0x62956f
test eax, eax
jne 0x629498
cmp dword [0x632344], 1
je 0x62956f
cmp edx, 0xfc
je 0x629595
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6294cf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629e30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a260
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x629512
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a260
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ec14
push edi
call fcn.0062be00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629e30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629e40
lea eax, [ebp - 0xa0]
push 0x62ebf4
push eax
call fcn.00629e40
push dword [esi + 0x63241c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629e40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062bd74
add esp, 0x2c
pop edi
jmp 0x629595
lea eax, [ebp + 8]
lea esi, [esi + 0x63241c]
push 0
push eax
push dword [esi]
call fcn.0062a260
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5f972c
Capabilities:
Encode data using xor

Disassembly:
lcall 0x4065, 0xcc88447
push edx
lcall 0x33c2, 0xe4a12179
xchg ebx, eax
invalid

Function at 0x68e88c
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xc039f993], al
cdq
add al, 0x83
pop ebx
cmp ebp, edi
dec ecx
rcl byte [edi], cl
jecxz 0x68e7e0
mov dword [0x801a9e5d], eax
xor byte [edi + 0x2a9e6bc], ch
cdq
cmp eax, 0x230d10b5
out dx, al
fild word [ebx + eax - 0x3a]
pop ds
sbb cl, cl
sub dh, byte [edx - 0x1d160133]
lds ebx, [edi + eax*8]
sbb al, 0xc7
pop esp
cmp al, 0xf9
mov al, 0x6c
mov edi, 0x9d6b1d29
sub dword [0xc1979d6b], ebx
pop edx
daa
invalid
popfd
xchg edi, eax
rcr dword [edx + 0x27], 0x8c
xor dl, byte [edi]
call 0xdd081a52
insd dword es:[edi], dx
xor bl, byte [edi + 0x6d6464dc]
or eax, 0x7c3a0d0e
bound ecx, qword [esp + ebx*8]
dec ebx
push 0x4b299731
cld
ja 0x68e7f5
dec esi
dec edi
inc ecx
mov bh, byte [ecx]
cmp eax, 0x43910dfc
mov eax, 0x4fde2f7b
into
sbb eax, edx
jns 0x68e7b8
dec esp
stosd dword es:[edi], eax
jl 0x68e7ea
or ebp, esi
sti
and ebp, dword [edi]
jge 0x68e7f2
jnp 0x68e7ff
or esi, dword [esi - 0x20146633]
ret
or edi, dword [edi - 0x7e021157]
push cs
fstp dword [ebx - 0x42ba7569]
popfd
sub eax, 0xce5c8b2c
scasd eax, dword es:[edi]
ret
cmp bh, byte [ecx - 0x6eb4ff45]
push es
loope 0x68e8a8
pop ds
jmp 0x68e827
fisub dword [ecx]
or eax, 0xe7499e38
pop ecx
adc eax, 0x3c658a0d
jge 0x68e858
ret 0xe96b

Function at 0x6d8f8c
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x1c88ad97
mov al, 0x60
pop ebp
jbe 0x6d8fa1
pop ss
mov bl, 0x83
feni8087_nop
add ah, dl
cdq
in al, dx
fistp dword [eax - 0x34cbe1f2]
cwde
push cs
push ds
xor al, 0xcb
fmulp st(5)
clc
sbb al, 0x22
in al, 0xdf
xchg byte [ebx + 0x5d1d7bf4], dl
jb 0x6d9000
sub esp, dword [edx]
sbb al, 0x70
scasd eax, dword es:[edi]
fbld tbyte [esi + edx - 0x303cfb87]
cld
int 0x5b
sbb al, byte [ecx - 0x606883e3]
inc ebx
sbb al, 0xe9
mov esp, 0x27a17ea9
or byte [esi - 0x1e], bl
pop ebp
adc dword [0x5e3f3ecd], ebp
lodsb al, byte [esi]
jae 0x6d8ffc
sub eax, 0xdc92b864
fisttp dword [ebx - 0x210d6203]
in al, 0xbc
lodsd eax, dword [esi]
mov esp, 0x3ebf2ea5
scasb al, byte es:[edi]
scasb al, byte es:[edi]
lodsd eax, dword [esi]
or bl, byte [edx + 0x5539b93c]
push ebp
add edx, dword [esi]
out dx, eax
sub byte [edi - 0x18], cl
mov ecx, 0xac950bc1
fdivrp st(0)
mov ch, 0x50
cwde
movsb byte es:[edi], byte [esi]
invalid
Function at 0x43b637
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov ecx, dword [esp]
add esp, 4
mov edx, 0x9547fd58
call fcn.0043b685
sub ebx, 0x8cc01ce9
xor dword [eax], ecx
mov ebx, 0x1279f154
and edx, edx
or edx, ebx
inc eax
sub ebx, 0xd0c42206
sub edx, 0x69d2ceea
sub ebx, edx
cmp eax, esi
jne fcn.0043b637
or edx, edx
sub edx, 0x4d761167
sub edx, 0xff2aa795
ret
Function at 0x40fba0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [esp + 0x40], 0x719f0f43
mov dword [esp + 0x44], 0x75d973ea
mov dword [esp + 0x48], 0x79da77d8
mov dword [esp + 0x4c], 0x7d2b7bdb
mov dword [esp + 0x50], 0x61107f2b
mov dword [esp + 0x54], 0x65026330
mov dword [esp + 0x58], 0x69df670c
mov dword [esp + 0x5c], 0x6dc46bc3
mov dword [esp + 0x60], 0x51ff6fc8
mov dword [esp + 0x64], 0x55c753c9
mov dword [esp + 0x68], 0x59185734
mov dword [esp + 0x6c], 0x5d3a5bec
mov dword [esp + 0x70], 0x410e5f0f
mov dword [esp + 0x74], 0x4512432e
mov dword [esp + 0x78], 0x49264719
mov dword [esp + 0x7c], 0x4de14bf1
mov dword [esp + 0x80], 0xb1184fe2
mov dword [esp + 0x84], 0xb5efb3e4
mov dword [esp + 0x88], 0xb92eb7d4
mov dword [esp + 0x8c], 0xbdeebbee
mov dword [esp + 0x90], 0xa1debfd7
mov dword [esp + 0x94], 0xa532a3e3
mov dword [esp + 0x98], 0xa90aa734
mov dword [esp + 0x9c], 0xad13ab0f
mov dword [esp + 0xa0], 0x910caf0b
mov dword [esp + 0xa4], 0x953993dd
mov dword [esp + 0xa8], 0x99c79700
mov dword [esp + 0xac], 0x9dcf9bcf
mov dword [esp + 0xb0], 0x81f09fc5
mov dword [esp + 0xb4], 0x85d483d5
mov dword [esp + 0xb8], 0x89ee87e4
mov dword [esp + 0xbc], 0x8dc28bc5
mov dword [esp + 0xc0], 0xf1c18f38
mov dword [esp + 0xc4], 0xf59ef3bc
mov dword [esp + 0xc8], 0xf95af794
mov dword [esp + 0xcc], 0xfd57fb53
mov dword [esp + 0xd0], 0xe19eff5b
mov dword [esp + 0xd4], 0xe545e3a9
mov dword [esp + 0xd8], 0xe94be741
mov dword [esp + 0xdc], 0xed81eb79
mov dword [esp + 0xe0], 0xd1abef8c
mov dword [esp + 0xe4], 0xd540d378
mov dword [esp + 0xe8], 0xd979d745
mov dword [esp + 0xec], 0xdd8bdb7f
mov dword [esp + 0xf0], 0xc18ddf8f
mov dword [esp + 0xf4], 0xc5acc39b
mov dword [esp + 0xf8], 0xc9a8c794
mov dword [esp + 0xfc], 0xcda4cb98
mov dword [esp + 0x100], 0x31aecf9c
mov dword [esp + 0x104], 0x35913385
mov dword [esp + 0x108], 0x39953792
mov dword [esp + 0x10c], 0x3d913baa
mov dword [esp + 0x110], 0x21693f6d
mov dword [esp + 0x114], 0x257b2375
mov dword [esp + 0x118], 0x2973274a
mov dword [esp + 0x11c], 0x2d2a2b7e
mov byte [esp + 0x120], 0
mov eax, dword [0x449ce8]
xor esi, esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x40]
mov ecx, esi
and ecx, 0x7a
mov ebx, edx
xor ebx, 0x2ff4a13d
add ebx, ecx
mov ebp, ebx
and ebp, edi
add ebp, ebp
mov ecx, ebp
not ecx
and ecx, ebx
not ebx
and ebx, ebp
sub ecx, ebx
mov ebp, 0x31
sub ebp, ecx
sub ebp, edi
lea ebx, [ecx + edi]
add ebx, 0xe
and ebp, 0xeb
and ebx, 0x14
sub ebx, ebp
add bl, 0xec
mov byte [esp + edx + 0x40], bl
inc edx
add esi, 2
cmp edx, 0xe1
jne 0x40fe00
lea edi, [esp + 0x40]
push 0
push 0
push 0
push 0
push edi
call eax
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x444dcc]
mov ecx, 0x6ad20484
xor ecx, dword [0x444dd4]
add eax, ecx
inc eax
jmp eax
Function at 0x40f59e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x15249938
clc
nop
xor eax, 0x16125347
clc
nop
jae 0x40e20c
add byte [eax], al
and dword [esi + esi - 0x7017d2ea], eax
pop es
add byte [eax], al
wait
cld
nop
jmp 0x40ede4
add esp, 0x10
clc
nop
jae 0x40fe9f
add byte [eax], al
pop ds
pushal
retf 0x99a
push eax
clc
nop
jae 0x40e771
cmp ebp, dword [ebp - 0x53]
mov cl, 0
inc edi
scasd eax, dword es:[edi]
test byte [ebx - 0x61], al
mov eax, 0x4548f84d
clc
nop
jae 0x40d602
iretd
add ecx, dword [ebx + 0x3c]
clc
nop
jae 0x40d8fe
add byte [edx + ecx*8 - 0x62ff8700], al
mov dword [edi - 0x20], eax
clc
nop
jae 0x40ddc5
cmc
add ch, dh
add byte [edx], ch
add al, dh
add byte [ebx + 0xbb97e06], cl
adc byte [eax], al
add al, bh
nop
jae 0x40e8ae
cmp eax, 0x9e003900
push ebx
clc
nop
jae 0x40fc15
arpl word [ebp + 0xa962], sp
add dword [eax], 0xf8cb8b38
mov ecx, ebx
clc
nop
jae 0x40e9f0
add byte [ebx + esi*4 - 0x5f000000], bh
salc
adc eax, 0x8b00e066
invalid
mov eax, dword [esp + 4]
wait
mov eax, 0x73663c35
clc
nop
jae 0x40d7ca
add byte [eax], al
sahf
add dh, bl
pushal
clc
nop
jae 0x40ecca
add byte [eax], al
scasd eax, dword es:[edi]
add ah, bl
add byte [eax], al
mov bl, 0x87
add byte [eax], 0x8b
sub cl, byte [ebx - 0xd07fbb3]
nop
jae 0x40f8a1
lodsd eax, dword [esi]
inc ebx
add byte [edi + 0x515d0062], ah
xor dword [esp], eax
call fcn.0040fa29
clc
nop
jae 0x40ec8d
jecxz 0x40f87b
add byte [eax + edx*4], bh
add byte [ebx - 0x3750f055], cl
push 0x40
push edi
mov edi, 0x40ff81
xchg dword [esp], edi
ret
push ecx
clc
nop
jae 0x40f23c
add ch, dh
mov ch, 0x3d
add byte [eax], al
add byte [eax], cl
mov esi, 0x1441bf0f
mov ecx, 0x7463
wait
cld
nop
jmp 0x40fd4d
Function at 0x9dc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009dc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9dc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9dc06a
add dl, dl
jne 0x9dc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9dc0dc
xor eax, eax
add dl, dl
jne 0x9dc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9dc17d
add dl, dl
jne 0x9dc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9dc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9dc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9dc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9dc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9dc075
mov eax, 1
add dl, dl
jne 0x9dc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9dc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9dc0e1
sub eax, ebx
mov ebx, 1
jne 0x9dc128
mov ecx, 1
add dl, dl
jne 0x9dc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9dc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9dc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9dc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9dc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9dc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9dc136
cmp eax, 0x7d00
jae 0x9dc16d
cmp eax, 0x500
jb 0x9dc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9dc075
cmp eax, 0x7f
ja 0x9dc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9dc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9dc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9dc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403060
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call fcn.00402e60
test eax, eax
jle 0x4030b7
call fcn.00402fb0
mov edi, eax
add dword [0x414e44], edi
push esi
call fcn.00402f50
cmp eax, dword [0x414e44]
je 0x4030a9
push 0
push esi
push ebx
call dword [0x407044]
mov eax, dword [0x414e40]
push eax
call dword [0x407070]
jmp 0x4030c1
push 0
push esi
push ebx
call dword [0x407044]
lea ecx, [ebp - 0x800]
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4030cc
pop eax
lea edx, [ebp - 0x800]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4030e0
mov edi, eax
jmp 0x4030ec
dec edi
cmp byte [ebp + edi - 0x801], 0x5c
jne 0x4030eb
lea ecx, [ebp + edi - 0x800]
mov edx, 0x40613f
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403105
pop eax
push 0x32
lea eax, [ebp - 0x400]
push eax
push 0x1002
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x400]
mov dword [0x414e40], eax
lea edx, [ebp - 0x400]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x40313d
mov dword [0x414e44], eax
lea eax, [ebp - 0x800]
push eax
call fcn.00402f50
push 0x4070fe
push esi
call fcn.00402440
test eax, eax
je 0x403178
push str.JUth0naac2uvdSdSapee
push esi
call fcn.00401f40
test eax, eax
je 0x403178
call fcn.004027a0
push esi
call fcn.004023a0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4045d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406728
push 0x404778
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x2000000
call fcn.00405140
pop ecx
mov dword [0x4072a8], eax
call fcn.00404a10
test eax, eax
jne 0x404617
push 1
call fcn.00404760
pop ecx
mov dword [ebp - 4], 0
call fcn.004046f0
call fcn.00404b00
call fcn.00404b50
call fcn.00404f30
call fcn.00404fd0
mov ebx, 0x406990
jmp 0x404643
call dword [ebx]
add ebx, 4
cmp ebx, 0x406990
jb 0x40463e
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
call fcn.00405090
test byte [ebp - 0x34], 1
je 0x404677
movzx edx, word [ebp - 0x30]
jmp 0x40467c
mov edx, 0xa
push edx
push eax
push 0
push ebx
call fcn.004035d0
mov ebx, eax
mov esi, 0x406990
jmp 0x404694
call dword [esi]
add esi, 4
cmp esi, 0x406990
jb 0x40468f
push ebx
call fcn.00404570
pop ecx
jmp 0x4046cd
or dword [ebp - 4], 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret