joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548e04
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x548e21
add esp, 0xfffffff0
call fcn.00403dac
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x548fbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0053f610
test al, al
jne 0x548e5e
mov ecx, 0x548ff0
mov dl, 1
mov eax, dword [0x533d0c]
call fcn.0040e718
call fcn.004042d8
xor eax, eax
push ebp
push 0x548e8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0053e0bc
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0053dfa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x548eaa
mov eax, dword [ebp - 0x10]
mov edx, 0x54902c
call fcn.00405358
je 0x548ec7
mov eax, esi
mov edx, 0x54902c
call fcn.00405358
jne 0x548eeb
mov eax, edi
mov edx, 0x54903c
call fcn.00405358
je 0x548eeb
mov ecx, 0x549014
mov dl, 1
mov eax, dword [0x533fb4]
call fcn.0040e718
call fcn.004042d8
mov eax, edi
xor edx, edx
call fcn.00405358
jne 0x548f18
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00405358
je 0x548f18
mov ecx, 0x549014
mov dl, 1
mov eax, dword [0x533fb4]
call fcn.0040e718
call fcn.004042d8
mov eax, dword [ebp - 0x10]
mov edx, 0x54907c
call fcn.00405358
jne 0x548f4b
mov eax, edi
mov edx, 0x549088
call fcn.00405358
je 0x548f4b
mov ecx, 0x549014
mov dl, 1
mov eax, dword [0x533fb4]
call fcn.0040e718
call fcn.004042d8
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00546ef4
lea eax, [ebx + 4]
mov edx, esi
call fcn.004050dc
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004050dc
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004050dc
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004050dc
lea eax, [ebx + 8]
call fcn.004050a0
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
mov ax, word [0x5490d4]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548fc4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004050b8
ret
Function at 0x54a8b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x54a8d5
add esp, 0xfffffff0
call fcn.00403dac
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x54aa70
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0053f610
test al, al
jne 0x54a912
mov ecx, 0x54aaa4
mov dl, 1
mov eax, dword [0x533d0c]
call fcn.0040e718
call fcn.004042d8
xor eax, eax
push ebp
push 0x54a93e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0053e0bc
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0053dfa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54a95e
mov eax, edi
xor edx, edx
call fcn.00405358
jne 0x54a98b
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00405358
je 0x54a98b
mov ecx, 0x54aac8
mov dl, 1
mov eax, dword [0x533fb4]
call fcn.0040e718
call fcn.004042d8
mov eax, dword [ebp - 0x10]
mov edx, 0x54aae0
call fcn.00405358
jne 0x54a9be
mov eax, edi
mov edx, 0x54aaec
call fcn.00405358
je 0x54a9be
mov ecx, 0x54aac8
mov dl, 1
mov eax, dword [0x533fb4]
call fcn.0040e718
call fcn.004042d8
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00546ef4
lea eax, [ebx + 4]
mov edx, esi
call fcn.004050dc
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004050dc
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004050dc
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004050dc
lea eax, [ebx + 8]
call fcn.004050a0
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x41c9d0]
call fcn.00403a50
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x41c9d0]
call fcn.00403a50
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x41c9d0]
call fcn.00403a50
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x54ab38]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x536d30]
call fcn.0054614c
mov dword [ebx + 0x3c], eax
mov ax, word [0x54ab3c]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54aa77
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004050b8
ret
Function at 0x54d4cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x54d4ee
add esp, 0xfffffff0
call fcn.00403dac
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x54d659
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0053f610
test al, al
jne 0x54d52b
mov ecx, 0x54d68c
mov dl, 1
mov eax, dword [0x533d0c]
call fcn.0040e718
call fcn.004042d8
push dword [0x5c2d70]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x5c2d70]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405310
mov eax, dword [ebp - 0xc]
call fcn.005400e8
test al, al
jne 0x54d5fd
push dword [0x5c2d6c]
push dword [ebp + 8]
push dword [0x5c2d6c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405310
mov eax, dword [ebp - 0x14]
call fcn.005400e8
test al, al
jne 0x54d5fd
push dword [0x5c2d70]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x5c2d70]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405310
mov eax, dword [ebp - 0x18]
call fcn.00540200
test al, al
jne 0x54d5fd
push dword [0x5c2d6c]
push edi
push dword [0x5c2d6c]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405310
mov eax, dword [ebp - 0x20]
call fcn.00540200
test al, al
jne 0x54d5fd
mov ecx, 0x54d68c
mov dl, 1
mov eax, dword [0x533d0c]
call fcn.0040e718
call fcn.004042d8
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00546ef4
lea eax, [ebx + 4]
mov edx, esi
call fcn.004050dc
lea eax, [ebx + 8]
call fcn.004050a0
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.004050dc
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.004050dc
mov byte [ebx + 0xc], 0xc
mov ax, word [0x54d6a8]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d660
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004050b8
ret

Function at 0x58215c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5821d7
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x5821be
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404bdc
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0040976c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5821de
lea eax, [ebp - 0x104]
call fcn.0040495c
ret
Function at 0x595a68
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e1c
xor eax, eax
push ebp
push 0x595bfa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, 0xff
call fcn.0040aaf8
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404c2c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x595aef
lea eax, [ebp - 0x3c]
mov ecx, 0x595c14
mov edx, dword [ebp - 4]
call fcn.00404c78
mov edx, dword [ebp - 0x3c]
mov eax, ebx
call fcn.0040a974
jmp 0x595af9
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040a974
cmp byte [ebp + 8], 0
je 0x595b0e
push ebx
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x595bdc
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.kernel32.dll_GetDiskFreeSpaceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x31], al
xor eax, eax
push ebp
push 0x595b9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 8
call fcn.0040291c
mov esi, eax
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
mov eax, dword [0x5c395c]
mov eax, dword [eax]
call eax
test eax, eax
je 0x595b87
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x28]
mov dword [eax], edx
mov edx, dword [ebp - 0x24]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 4], edx
mov edx, 8
mov eax, esi
call fcn.0040293c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x595bd3
mov eax, dword [ebp - 0x38]
push eax
call sub.kernel32.dll_SetErrorMode
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x595c01
lea eax, [ebp - 0x3c]
call fcn.0040495c
lea eax, [ebp - 4]
call fcn.0040495c
ret

Function at 0x595c18
Capabilities:
Get memory capacity

Disassembly:
push ebx
push esi
add esp, 0xffffffe0
mov esi, edx
mov ebx, eax
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x10]
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [esp + 0x14]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
add esp, 0x20
pop esi
pop ebx
ret

Function at 0x595c4c
Capabilities:
Get memory capacity

Disassembly:
push ebx
push esi
add esp, 0xffffffe0
mov esi, edx
mov ebx, eax
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 8]
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x598998
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e1c
xor eax, eax
push ebp
push 0x598b07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a420
test al, al
jne 0x5989e7
mov ecx, 0xe7
mov edx, 0x598b20
mov eax, 0x598b5c
call fcn.004048b8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e2c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x598ace
mov eax, esi
call fcn.0040291c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push esi
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x598b70
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
mov edi, dword [ebp - 0x14]
mov eax, dword [edi + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00409fd0
push dword [ebx]
push 0x598b7c
mov eax, dword [edi + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00409fd0
push dword [ebp - 0x18]
mov eax, ebx
mov edx, 3
call fcn.00404cec
push dword [ebx]
push 0x598b7c
mov eax, dword [edi + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00409fd0
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.00404cec
push dword [ebx]
push 0x598b7c
mov eax, dword [edi + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00409fd0
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 3
call fcn.00404cec
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.0040293c
jmp 0x598ae4
mov ecx, 0x598b88
mov dl, 1
mov eax, dword [0x598934]
call fcn.0040e718
call fcn.004042d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x598b0e
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404980
lea eax, [ebp - 4]
call fcn.0040495c
ret
Function at 0x5992d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x599405
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, 4
call fcn.0040495c
mov eax, dword [ebp - 4]
add eax, 8
call fcn.0040495c
mov edi, 0xff
mov esi, 0xff
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5993b9
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x214]
mov edx, ebx
call fcn.00404b44
lea eax, [ebp - 0x214]
mov edx, 0x59941c
call fcn.00404c34
mov eax, dword [ebp - 0x214]
call fcn.00404e2c
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 4]
add eax, 8
lea edx, [ebp - 0x210]
mov ecx, pe_nt_image_headers32
call fcn.00404bdc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, 4
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.00404bdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5993ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59940c
lea eax, [ebp - 0x214]
call fcn.0040495c
ret

Function at 0x599420
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5994de
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5994af
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetEnvironmentStringsA
mov esi, eax
lea eax, [ebp - 8]
call fcn.0040495c
or edi, 0xffffffff
inc edi
mov bl, byte [esi + edi]
test bl, bl
je 0x59947c
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404b44
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404c34
jmp 0x59945d
lea eax, [ebp - 8]
mov edx, 0x5994f4
call fcn.00404c34
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 8]
call fcn.0040495c
cmp byte [esi + edi + 1], 0
jne 0x59945d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5994c3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5994e5
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404980
ret
Function at 0x10004330
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
and byte [ebp + 0x33], bl
pop ebx
fist dword [edi - 0x6b95fff8]
pop ebp
xor ebx, dword [ebx - 0x25]
xchg edi, eax
or byte [eax], al
push 0xffffffffffffff94
sbb eax, 0x94ba0d5b
fsubr dword [edi]
xchg ebp, eax
dec edi
xchg ecx, eax
pop edx
rcr edx, 0x83
js 0x10004332
inc esi
das
pop ebx
dec edx
stosd dword es:[edi], eax
inc ebx
xchg ebp, eax
adc al, byte [esi]
pop es
fcmovnu st(0), st(2)
cmp dh, byte [edx + 0x2d]
or bh, cl
dec edi
mov byte [0x8a4c13a5], al
pushal
mov bl, 0xcc
sub eax, 0x83501f98
invalid

Function at 0x10004930
Capabilities:
Encode data using xor

Disassembly:
pop ebp
fdiv st(3), st(0)
cmp ch, byte [esi - 0x6e]
push es
dec edx
cli
push ecx
sub byte [edx], dl
xor dword [ecx + 0x64], ebx
sub dl, byte [ecx + 0x57ddceea]
adc edi, edi
div byte [edx + 0x6b]
jo 0x10004929
ja 0x1000499e
ret
xchg dword [ebx + edx*2], edi
div cl
sub dword [edi - 0x7cc21902], 0xffffffec
and edi, dword [ebx]
lodsb al, byte [esi]
iretd

Function at 0x1002b090
Capabilities:
Encode data using xor

Disassembly:
ja 0x1002b0a1
invalid
sub edx, ecx
jp 0x1002b0cd
sub byte [edx + 0x64], al
pop es
inc edx
pop es
xor byte [ebx], bl
lcall 0xb817, 0x87dab898
rep movsb byte es:[edi], byte [esi]
mov ch, 0x72
sub al, 0xc0
rol cl, cl
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
mov esi, 0x1ebf3cac
push 0x416c0bb
xchg ebp, eax
pop esi
jb 0x1002b0a4
inc ecx
invalid
pop ecx
or eax, 0xe2f791d6
stc
cmp byte ds:[esp + 0x6a9b2a4a], bl
shl byte [ecx + 0x45], 0xa6
clc
shl bl, 1
invalid
Function at 0x10452058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104521a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1045207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045206a
add dl, dl
jne 0x10452089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104520dc
xor eax, eax
add dl, dl
jne 0x10452096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045217d
add dl, dl
jne 0x104520a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104520b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104520bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104520c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104520d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10452075
mov eax, 1
add dl, dl
jne 0x104520ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104520f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104520e1
sub eax, ebx
mov ebx, 1
jne 0x10452128
mov ecx, 1
add dl, dl
jne 0x1045210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10452119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10452105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10452075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1045213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1045214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10452136
cmp eax, 0x7d00
jae 0x1045216d
cmp eax, 0x500
jb 0x10452168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10452075
cmp eax, 0x7f
ja 0x10452170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10452075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1045219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10452075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x93027c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x930282
pop ebp
sub ebp, 6
sub ebp, 0x53027c
jmp 0x9302e0
jmp 0x9302e9
mov eax, 0x53027c
add eax, ebp
add eax, 0x93
mov ecx, 0x62f
mov edx, 0x4e4bcc09
xor byte [eax], dl
inc eax
dec ecx
jne 0x930300
jmp 0x930313
arpl word [ecx + 0x61], cx
or dword [ecx], ebx
or dword [ecx], ecx
popal
or ebp, eax
and eax, 0x53f98809
sal al, cl
sub al, 0x88
stc
push ebx
sal al, cl
sub al, 0x3a
leave
pop ecx
neg byte [ecx + esi*2 + 0x59094048]
add ah, 0x82
xor byte [0x88090909], 0xc8
int1
or dword [ecx], ecx
or dword [edx], ecx
les esi, [ecx + 0x909090f]
mov bl, 0x21
or dword [ecx], ecx
or esi, edi
jmp 0x93035c
popal
mov eax, dword [0x6109003e]
fcmovnb st(0), st(3)
inc eax
or dword [eax], ecx
and eax, 0x909612d
or dword [ecx], ecx
loope 0x93037c
or dword [ecx], ecx
or eax, esp
and dword [ecx], ecx
or dword [ecx], ecx
pop esp
and ch, 0x82
mov word [ecx], es
or dword [ecx], ecx
or dword [edx + 0x909059c], eax
or dword [edx + 0x9091984], eax
or eax, ecx
loopne 0x93039b
cmp byte [ebx], cl
mov cl, bl
or eax, 0xfd8c0640
div dh
not byte [ebx + ecx*8 + 5]
or dword [edx + 0x90d2d85], eax
or dword [ecx], ecx
popal
mov eax, dword [0x6109003e]
fcmovnb st(0), st(3)
inc eax
or dword [eax], ecx
and eax, 0xce1582d
or dword [ecx], ecx
or eax, esp
or ecx, dword ss:[ecx]
or dword [edx + eax*4 - 0x1b], ebx
idiv byte [ebp + eax - 0xa]
jl 0x9303c9
loope 0x930445
jnp 0x9303d4
or dword [ecx], ecx
or dword [edx + 0x90901b4], eax
or dword [edx], edi
or dword [ecx], ecx
xor byte [ecx + eax + 0x3a090909], 0xc0
mov bl, bh
push edi
test eax, 0xfb8820ef
ror byte [eax - 0x1056a805], 0x20
mov bl, bh
and byte [eax - 0x1056a805], cl
and byte [edx], bh
fisttp dword [edx + 0x6410ce1]
sti
push edi
test eax, 0xdb3a20ef
mov ah, cl
or al, 0x41
push es
lea eax, [edi + 9]
or dword [ecx], ecx
push es
add dword [ecx + 9], 0x826f0909
adc eax, 0xe1f28930
push es
lea edx, [ebx]
or dword [ecx], ecx
or dword [ecx - 0x72f91f0e], ecx
sbb byte [ecx], cl
or dword [ecx], ecx
outsd dx, dword [esi]
mov dl, dh
imul byte [esi + eax]
lea ebx, [ecx + ecx]
or dword [ecx], ecx
dec eax
loopne 0x9303dc
div dh
mul byte [eax]
inc ebp
xor byte [eax], cl
mov cl, al
or al, 0x8a
loope 0x930431
loopne 0x9303da
div dh
mul byte [eax]
pop ebp
xor byte [ebx], cl
mov cl, al
jp 0xe21d1218
jecxz 0x930440
mov ah, cl
or al, 0xe0
mov byte [0x54f6f6f6], al
retf
and ch, 0x5f
pop esi
pop esp
cmp byte [ebp + eax - 0x7e], 0x74
add ebp, esi
mov ebx, 0x880f8389
iretd

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002be76
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x1003c034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x430], 0
push 0x404
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x420]
movq qword [ebp - 0x1c], xmm0
push 0
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
call fcn.10020540
add esp, 0xc
mov dword [ebp - 0x420], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x10003d04
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x10003d04
call fcn.10002520
mov esi, eax
jmp 0x10003df1
push dword [ebp - 0x424]
push dword [ebp - 0x428]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10003d27
call fcn.10002520
jmp 0x10003de4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x428], ebx
test ebx, ebx
jne 0x10003d45
call fcn.10002520
jmp 0x10003de4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x10003d66
mov esi, 0x8007000e
jmp 0x10003de6
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.10002000
jmp 0x10003d90
cmp dword [ebp - 0x420], 0
mov dword [ebp - 4], 1
jne 0x10003da7
mov esi, 0x8007000e
jmp 0x10003de6
push esi
push dword [ebp - 0x420]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x10003dc7
call fcn.10002520
jmp 0x10003de4
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x420]
call fcn.10003ae0
mov esi, eax
test edi, edi
je 0x10003df1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x10003e10
lea ecx, [ebp - 0x420]
call fcn.10003220
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100088fa
mov esp, ebp
pop ebp
ret 0x10