joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413970
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push ebp
push esi
cmp ebx, 0x3e8
push edi
ja 0x4139b1
mov eax, dword [0x48e200]
push 0xcc3
push eax
push 0x48ee98
call fcn.004086d0
add esp, 0xc
mov eax, 0xb0451
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov ebp, dword [esp + 0x12c]
cmp ebp, 0x3e8
ja 0x4139e9
mov ecx, dword [0x48e200]
push 0xcc4
push ecx
push 0x48ee80
call fcn.004086d0
add esp, 0xc
mov eax, 0xb0451
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x20]
push 0
push eax
push esi
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x413a9d
mov edi, dword [esp + 0x128]
push 0
push edi
push ebx
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x413a9f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd8ec
cmp eax, 0x38
ja case.0x413a54.10007
xor ecx, ecx
mov cl, byte [eax + 0x413ac0]
jmp dword [ecx*4 + 0x413ab0]
pop edi
pop esi
pop ebp
mov eax, 0xb0454
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xb0455
pop ebx
add esp, 0x10c
ret
mov eax, edi
pop edi
mov dword [ebp], eax
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xb0453
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
mov dword [ebp], eax
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
Function at 0x4163d0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x114]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_select]
push esi
mov esi, dword [esp + 0x118]
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
lea edi, [esi + 1]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push 0
push 0
push edx
push edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
call ebx
test eax, eax
jge 0x416444
cmp dword [0x4cc0e4], 4
je 0x4163fc
test eax, eax
jge 0x416444
mov eax, dword [0x48f618]
push 0x9f7
push eax
push 0x4900c0
call fcn.00408750
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret

Function at 0x41ffd0
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Manually build aes constants

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push edi
jge 0x42009b
mov eax, dword [fcn.004cb7d8]
test eax, eax
je 0x4200b9
push esi
push 0x156
push str..cryptocryptlib.c
or esi, 0xffffffff
push 0x1d
push 9
xor edi, edi
sub esi, ebx
call fcn.0041ffd0
mov eax, dword [0x4cb7c4]
add esp, 0x10
test eax, eax
je 0x420036
push eax
call fcn.00427660
add esp, 4
cmp esi, eax
jge 0x420036
mov eax, dword [0x4cb7c4]
push esi
push eax
call fcn.00427670
mov edi, eax
add esp, 8
test edi, edi
je 0x420036
inc dword [edi]
push 0x15d
push str..cryptocryptlib.c
push 0x1d
push 0xa
call fcn.0041ffd0
add esp, 0x10
test edi, edi
pop esi
je 0x42007a
mov edi, dword [edi + 4]
test edi, edi
je 0x42007a
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push ecx
push edx
push edi
push eax
call dword [fcn.004cb7d8]
push ebx
call fcn.0041fec0
add esp, 0x14
pop edi
pop ebx
ret
push str.pointer___NULL
push 0x1e0
push str..cryptocryptlib.c
push str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
call fcn.00420390
add esp, 0x10
jmp fcn.004554e3
mov eax, dword [0x4cb7c8]
test eax, eax
je 0x4200b9
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push ebx
push ecx
call eax
add esp, 0x10
pop edi
pop ebx
ret
Function at 0x4200c0
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Manually build aes constants

Disassembly:
mov eax, dword [0x4cb7cc]
push ebx
push ebp
push esi
test eax, eax
push edi
je 0x4200f2
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push ecx
call eax
add esp, 0x14
mov ebp, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esp + 0x1c]
test esi, esi
jge 0x4201b6
mov eax, dword [fcn.004cb7d8]
test eax, eax
je 0x4201d1
push 0x156
push str..cryptocryptlib.c
or edi, 0xffffffff
push 0x1d
push 9
xor ebx, ebx
sub edi, esi
call fcn.0041ffd0
mov eax, dword [0x4cb7c4]
add esp, 0x10
test eax, eax
je 0x420156
push eax
call fcn.00427660
add esp, 4
cmp edi, eax
jge 0x420156
mov edx, dword [0x4cb7c4]
push edi
push edx
call fcn.00427670
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x420156
inc dword [ebx]
push 0x15d
push str..cryptocryptlib.c
push 0x1d
push 0xa
call fcn.0041ffd0
add esp, 0x10
test ebx, ebx
je 0x420195
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x420195
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push ebx
push 9
call dword [fcn.004cb7d8]
push esi
call fcn.0041fec0
add esp, 0x14
jmp 0x4201d1
push str.pointer___NULL
push 0x1e0
push str..cryptocryptlib.c
push str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
call fcn.00420390
add esp, 0x10
jmp fcn.004554e3
mov eax, dword [0x4cb7c8]
test eax, eax
je 0x4201d1
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
push ecx
push esi
push 9
call eax
add esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebp, dword [eax]
add ebp, ecx
test esi, esi
mov dword [eax], ebp
jge 0x4202a4
mov eax, dword [fcn.004cb7d8]
test eax, eax
je 0x4202bf
push 0x156
push str..cryptocryptlib.c
or edi, 0xffffffff
push 0x1d
push 9
xor ebx, ebx
sub edi, esi
call fcn.0041ffd0
mov eax, dword [0x4cb7c4]
add esp, 0x10
test eax, eax
je 0x42023f
push eax
call fcn.00427660
add esp, 4
cmp edi, eax
jge 0x42023f
mov edx, dword [0x4cb7c4]
push edi
push edx
call fcn.00427670
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x42023f
inc dword [ebx]
push 0x15d
push str..cryptocryptlib.c
push 0x1d
push 0xa
call fcn.0041ffd0
add esp, 0x10
test ebx, ebx
je 0x420283
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x420283
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push ebx
push 0xa
call dword [fcn.004cb7d8]
push esi
call fcn.0041fec0
add esp, 0x14
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
push str.pointer___NULL
push 0x1e0
push str..cryptocryptlib.c
push str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
call fcn.00420390
add esp, 0x10
jmp fcn.004554e3
mov eax, dword [0x4cb7c8]
test eax, eax
je 0x4202bf
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
push ecx
push esi
push 0xa
call eax
add esp, 0x10
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x420390
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.004535f0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4203d9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4203d9
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x49a1e0
call fcn.0045553b
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.0045372c
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4204db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x420496
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x420496
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x420496
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x420496
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.004535f0
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x420496
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.004554fa
add esp, 8
test eax, eax
je 0x4204db
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420500
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Manually build aes constants

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
push str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
call fcn.00420390
add esp, 0x10
jmp fcn.004554e3
Function at 0x45459d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4545bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045b1e0
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4545de
test byte [esp + 8], 2
je 0x4545de
mov dword [0x4cc0e4], 0xd
mov dword [0x4cc0e8], 5
jmp 0x4545b9
xor eax, eax
ret

Function at 0x454d3a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x454d65
test byte [esp + 8], 0x80
je 0x454d54
and al, 0xfe
jmp 0x454d56
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x454d76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045b1e0
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x4553bb
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Manually build aes constants

Disassembly:
mov ah, 0x3e
not dl
call 0x45543f
imul eax, ebp, 0x9b67f764
lea ecx, [0x428e7107]
cmp eax, 0x73bd573f
and al, 0xb3
and eax, ebp
sub al, al
mov ecx, 0x826e
lea eax, [0x791c3e5a]
imul eax, ecx, 0x7e9f026d
lea edx, [ecx]
mov ch, 0xf4
inc eax
mov esi, edx
imul edx, edi
imul ecx, ebp
push esi
add ecx, edi
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, 0xe66ddd67
bswap edx
mov edx, esi
pop edi
xchg esi, edx
or dh, ch
xchg edi, ebx
mov ch, bh
imul esi, ebp, 0xf22dcaf4
lea esi, [0xccf42ef6]
lea eax, [0]
mov dl, cl
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp al, 0x98
imul eax, ebx
add ebp, ebx
xor bh, ah
and dh, cl
dec edx
mov ah, 4
inc ebp
test cl, 0x3b
imul esi, ecx, 0x907d0944
mov ebp, 0x82a5732f
test al, 0x44
bswap edx
dec dh
sub edx, 0x9fbd8b9e
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, 0
xchg dl, dh
add ebp, eax
mov dl, dh
dec edx
add dl, 0x3d
lea edi, [0xfffffe97]
mov edx, ecx
add edi, 0x169
sbb edx, edi
add edi, ebp
xchg dh, dh
mov ebp, ebx
test esi, edi
rcl ebp, 0xb1
bswap ebp
invalid
invalid
invalid
Function at 0x45543f
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Manually build aes constants

Disassembly:
mov ah, 0x3e
not dl
call 0x45543f
imul eax, ebp, 0x9b67f764
lea ecx, [0x428e7107]
cmp eax, 0x73bd573f
and al, 0xb3
and eax, ebp
sub al, al
mov ecx, 0x826e
lea eax, [0x791c3e5a]
imul eax, ecx, 0x7e9f026d
lea edx, [ecx]
mov ch, 0xf4
inc eax
mov esi, edx
imul edx, edi
imul ecx, ebp
push esi
add ecx, edi
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, 0xe66ddd67
bswap edx
mov edx, esi
pop edi
xchg esi, edx
or dh, ch
xchg edi, ebx
mov ch, bh
imul esi, ebp, 0xf22dcaf4
lea esi, [0xccf42ef6]
lea eax, [0]
mov dl, cl
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp al, 0x98
imul eax, ebx
add ebp, ebx
xor bh, ah
and dh, cl
dec edx
mov ah, 4
inc ebp
test cl, 0x3b
imul esi, ecx, 0x907d0944
mov ebp, 0x82a5732f
test al, 0x44
bswap edx
dec dh
sub edx, 0x9fbd8b9e
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, 0
xchg dl, dh
add ebp, eax
mov dl, dh
dec edx
add dl, 0x3d
lea edi, [0xfffffe97]
mov edx, ecx
add edi, 0x169
sbb edx, edi
add edi, ebp
xchg dh, dh
mov ebp, ebx
test esi, edi
rcl ebp, 0xb1
bswap ebp
invalid
invalid
invalid

Function at 0x4554fa
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Manually build aes constants

Disassembly:
xchg edx, edi
mov edx, ebx
bswap ebp
mov ebp, edi
bswap edx
add dl, 0xe2
lea ebp, [0xb20d3]
imul edx, ecx, 0xb612ecb0
sub ebp, 0xb1365
movzx edx, ax
and dl, bh
imul edx, ebx, 0x755fb84
bswap edx
not edx
lea ecx, [0x6df9d]
adc dh, 0x3a
sub ecx, 0x6df9d
sal edx, cl
xor ecx, ebp

Function at 0x45553b
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Manually build aes constants

Disassembly:
xchg dl, dh
xor ecx, 0xd6e
lea ecx, [edi]
inc edi
xor ecx, 0xd8f
and dh, bh
mov ecx, 0
movsx edx, bx
mov edi, 0x70573248
xor ecx, esi
rcl edi, cl
imul edi, eax, 0xca730bbd
mov ebx, ecx
sub eax, ebx
shr ebp, 0x98
inc ebp
dec dh

Function at 0x455570
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Manually build aes constants

Disassembly:
pop eax
lea edx, [0x9bf5955f]
jmp fcn.004d225e
Function at 0x181011e
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x181013e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x181012a
add dl, dl
jne 0x1810149
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x181019a
xor eax, eax
add dl, dl
jne 0x1810156
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x181023b
add dl, dl
jne 0x1810165
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1810170
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181017b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1810186
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1810190
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1810135
mov eax, 1
add dl, dl
jne 0x18101a8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18101b3
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x181019f
sub eax, ebx
mov ebx, 1
jne 0x18101e6
mov ecx, 1
add dl, dl
jne 0x18101cc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18101d7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x18101c3
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1810135
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18101fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1810208
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x18101f4
cmp eax, 0x7d00
jae 0x181022b
cmp eax, 0x500
jb 0x1810226
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1810135
cmp eax, 0x7f
ja 0x181022e
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1810135
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x181025c
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1810135
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x423cb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19000]
push edi
jmp 0x423cca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x423cd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x423cc0
mov eax, 1
add ebx, ebx
jne 0x423ce3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x423cd8
jne 0x423cf4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423cd8
xor ecx, ecx
sub eax, 3
jb 0x423d08
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x423d7a
mov ebp, eax
add ebx, ebx
jne 0x423d13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423d20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423d44
inc ecx
add ebx, ebx
jne 0x423d30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423d25
jne 0x423d41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423d25
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423d64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423d55
jmp 0x423cc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423d64
add edi, ecx
jmp 0x423cc6
pop esi
mov edi, esi
mov ecx, 0x225
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x423d82
cmp byte [edi], 5
jne 0x423d82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x423d87
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x423dff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23fec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x24028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423db4
mov ecx, edi
jns 0x423de3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x24030]
or eax, eax
je 0x423df9
mov dword [ebx], eax
add ebx, 4
jmp 0x423dd1
call dword [esi + 0x2402c]
mov ebp, dword [esi + 0x24034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x423e33
sub esp, 0xffffff80
jmp 0x402bf0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0xacc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00acc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xacc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xacc06a
add dl, dl
jne 0xacc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xacc0dc
xor eax, eax
add dl, dl
jne 0xacc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xacc17d
add dl, dl
jne 0xacc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xacc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xacc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xacc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xacc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xacc075
mov eax, 1
add dl, dl
jne 0xacc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xacc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xacc0e1
sub eax, ebx
mov ebx, 1
jne 0xacc128
mov ecx, 1
add dl, dl
jne 0xacc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xacc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xacc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xacc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xacc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xacc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xacc136
cmp eax, 0x7d00
jae 0xacc16d
cmp eax, 0x500
jb 0xacc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xacc075
cmp eax, 0x7f
ja 0xacc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xacc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xacc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xacc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10