joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56e53e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x659860]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x56e582
cmp word [edx], bx
jne 0x56e582
or byte [edi + eax + 0x28], 4
jmp 0x56e587
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x56e6db
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x56e6bb
cmp ax, word [ebp - 0x10]
je 0x56e5c0
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x56e6b0
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x56e5e6
push 0xa
pop ecx
cmp word [eax], cx
jne 0x56e5d6
push ecx
pop eax
push 4
jmp 0x56e5db
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x56e6aa
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x56e6a1
cmp dword [ebp - 0x18], 0
je 0x56e6a1
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x659860]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x56e66d
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x56e631
mov word [esi], ax
jmp 0x56e665
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x659860]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x659860]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x659860]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x56e6b0
cmp word [ebp - 4], ax
jne 0x56e682
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x56e682
mov word [esi], ax
add esi, 2
jmp 0x56e6b0
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.005700f7
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x56e6ad
jmp 0x56e6a4
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x56e5a0
jmp 0x56e6db
mov ecx, dword [ecx*4 + 0x659860]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x56e6d2
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x56e6db
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5763f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x64d4f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x576493
cmp byte [esi + 0x3d], 0
je 0x576493
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x576449
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x57645b
sub eax, 1
je 0x57645f
sub eax, 2
je 0x576493
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464d98
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x57647c
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005636e8
add esp, 0x10
cmp edi, eax
jne 0x576449
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464d98
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00464d98
mov esp, ebp
pop ebp
ret
Function at 0x577170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x64d4f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x5771a0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464d98
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x5771dc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x5771dc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464d98
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x5772c3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x577204
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x577237
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0053ecbd
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464d98
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x5772c3
cmp eax, 1
jle 0x577296
cmp eax, 3
jne 0x5772c3
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.005754f0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464d98
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x5772b3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005636e8
add esp, 0x10
cmp edi, eax
jne 0x5772c3
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x5771c7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464d98
mov esp, ebp
pop ebp
ret 4
Function at 0x578830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x578904
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x5788f3
jg 0x578868
test edx, edx
je 0x5788f3
call fcn.00457d10
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x5788b8
jg 0x57887e
test esi, esi
je 0x5788b8
cmp ebx, eax
jg 0x57888d
jl 0x578888
cmp edi, esi
jae 0x57888d
mov esi, edi
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [ebp + 8]
call fcn.00521690
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x5788da
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x5788ed
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [ebp - 4]
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jg 0x578868
jl 0x5788ed
test edi, edi
jne 0x578868
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x578923
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x578925
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x5789cd
jg 0x57893f
test esi, esi
je 0x5789cd
test eax, eax
jl 0x57897e
jg 0x578949
test ebx, ebx
je 0x57897e
cmp edi, eax
jg 0x578958
jl 0x578953
cmp esi, ebx
jae 0x578958
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00521690
mov ecx, dword [ebp - 4]
add esp, 0xc
add dword [ebp + 8], ebx
sub esi, ebx
sbb edi, dword [ebp + 0x10]
mov eax, dword [ecx + 0x2c]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x578984
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edi, edi
jl 0x5789cd
jg 0x57898e
test esi, esi
je 0x5789cd
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x5789cd
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x5789b9
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [ebp + 8]
call fcn.005c64f0
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5789e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x578aae
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x578a9d
jg 0x578a18
test edx, edx
je 0x578a9d
call fcn.00458560
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x578a66
jg 0x578a2e
test esi, esi
je 0x578a66
cmp ebx, eax
jg 0x578a3d
jl 0x578a38
cmp edi, esi
jae 0x578a3d
mov esi, edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00521690
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x578a8a
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x578a97
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp + 8], esi
test ebx, ebx
jg 0x578a18
jl 0x578a97
test edi, edi
jne 0x578a18
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x578acd
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x578acf
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x578b48
jg 0x578ae1
test esi, esi
je 0x578b48
test eax, eax
jl 0x578b22
jg 0x578aeb
test ebx, ebx
je 0x578b22
cmp edi, eax
jg 0x578afa
jl 0x578af5
cmp esi, ebx
jae 0x578afa
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00521690
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [ebp + 0x10]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x578b25
mov edx, dword [ebp + 8]
test edi, edi
jl 0x578b48
jg 0x578b2f
test esi, esi
je 0x578b48
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x578b48
push eax
push esi
push 1
push edx
call fcn.005636e8
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5a4a80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.005a5090
add esp, 8
test al, al
je 0x5a4aa5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x5a4aa5
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x5a5090
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x5a6540
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5a656b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5a656b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x1706058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.017061a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x170607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x170606a
add dl, dl
jne 0x1706089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17060dc
xor eax, eax
add dl, dl
jne 0x1706096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x170617d
add dl, dl
jne 0x17060a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17060b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17060bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17060c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x17060d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1706075
mov eax, 1
add dl, dl
jne 0x17060ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17060f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17060e1
sub eax, ebx
mov ebx, 1
jne 0x1706128
mov ecx, 1
add dl, dl
jne 0x170610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1706119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1706105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1706075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x170613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x170614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1706136
cmp eax, 0x7d00
jae 0x170616d
cmp eax, 0x500
jb 0x1706168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1706075
cmp eax, 0x7f
ja 0x1706170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1706075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x170619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1706075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x571d0f05
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x2ca06955
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x40893c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
add ebx, ebx
call fcn.00408964
and ecx, ecx
add ecx, 0xb8524420
xor dword [edx], eax
inc edx
add ebx, 0xf0646dab
cmp edx, esi
jne fcn.0040893c
add ecx, ebx
add ecx, ebx
ret

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x1044e478
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1044e5c8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1044e49e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044e48a
add dl, dl
jne 0x1044e4a9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044e4fc
xor eax, eax
add dl, dl
jne 0x1044e4b6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044e59d
add dl, dl
jne 0x1044e4c5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044e4d0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044e4db
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044e4e6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1044e4f2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1044e495
mov eax, 1
add dl, dl
jne 0x1044e50a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044e515
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1044e501
sub eax, ebx
mov ebx, 1
jne 0x1044e548
mov ecx, 1
add dl, dl
jne 0x1044e52e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1044e539
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1044e525
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1044e495
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1044e55f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1044e56a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1044e556
cmp eax, 0x7d00
jae 0x1044e58d
cmp eax, 0x500
jb 0x1044e588
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1044e495
cmp eax, 0x7f
ja 0x1044e590
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1044e495
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1044e5be
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1044e495
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], 0x520050
mov ecx, 0x41
mov dword [ebp - 0x18], 0x440049
push ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x520055
push eax
mov dword [ebp - 0x10], 0x530041
mov dword [ebp - 0xc], 0x4b0048
mov dword [ebp - 8], ecx
call dword [0x4090b0]
mov edx, eax
lea ecx, [ebp - 0x1c]
call 0x409460
add esp, 4
mov dword [ebp - 0x88], 0x4f0053
lea eax, [ebp - 4]
mov dword [ebp - 0x84], 0x540046
mov dword [ebp - 0x80], 0x410057
mov dword [ebp - 0x7c], 0x450052
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x88]
mov dword [ebp - 0x78], 0x4d005c
push eax
push 0x80000001
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x750052
mov dword [ebp - 0x30], 0x4f006e
mov dword [ebp - 0x2c], 0x63006e
mov dword [ebp - 0x28], 0x65
call dword [0x40900c]
test eax, eax
jne 0x4042c0
push esi
call dword [0x4090b0]
add eax, eax
push eax
push esi
push 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [0x409008]
push dword [ebp - 4]
neg eax
sbb esi, esi
call dword [0x409010]
lea eax, [esi + 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x24], 0x6c006b
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], 0x660069
mov dword [ebp - 0x1c], 0x73002e
mov dword [ebp - 0x18], 0x730079
mov word [ebp - 0x14], ax
mov dword [ebp - 0x10], 0x6c006b
mov dword [ebp - 0xc], 0x2e0031
mov dword [ebp - 8], 0x790073
mov dword [ebp - 4], 0x73
call fcn.00404750
pop edi
pop esi
pop ebx
test eax, eax
jne 0x404896
lea ecx, [ebp - 0x10]
call fcn.00404750
test eax, eax
jne 0x404896
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret