joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13754d3
Capabilities:
Authenticate hmac

Disassembly:
shl eax, 2
jmp 0x151e62e
mov ebx, dword [ebp - 0x1c]
push dword [ebx]
call fcn.00404d40
lea esp, [esp + 8]
cmp esp, 0x957adc
cmc
cmp eax, 0
jne 0x15b3d06
mov eax, 1
jmp 0x1321948
mov dword [ebp - 0x1c], ebx
not ebx
push 0xf4334d
jmp 0x12246e9
jmp 0x1341a7b
push 0x406781f
jmp 0x155ee3d
shl eax, 2
stc
add ebx, eax
test eax, 0x2ee43008
cmp cx, si
mov ebx, dword [ebx]
add ebx, 4
jmp 0x13964bc
dec eax
jns 0x155ee4f
push 0x9c9
jmp 0x127c40a
jmp 0x45029a
jne 0x1341a6d
mov eax, 1
jmp 0x12792f2
jmp 0x15b3d0e
mov eax, 0
cmp bp, si
cmp di, 0x41e
clc
test eax, eax
jmp 0x458851
push ebp
mov ebp, esp
sub esp, 0xc
jmp 0x151cd4a
mov dword [ebp - 0x14], ebx
setae bh
jmp 0x1524e56
push 0x406781f
push 4
jmp 0x15af4b8
mov ebx, dword [ebp - 0xc]
call fcn.00403fd7
push ebx
cmovbe eax, ebp
dec eax
movsx ax, cl
push ecx
mov eax, dword [ebp - 0x10]
jmp 0x13e8aa5
call fcn.00404d40
lea esp, [esp + 8]
cmp esi, 0x166650eb
test esi, 0xce436da
cmp eax, 0
jmp 0x14a8116
dec eax
jmp 0x148572d
jns 0x150de7a
push 0x98d
jmp 0x40f8f2
call fcn.00470ff7
lea esp, [esp + 0xc]
jmp 0x12827aa
je 0x13c98b8
mov eax, 1
jmp 0x12a4a72
push 0x406781f
jmp 0x14b6ca9
jl 0x12202ae
push 0x9c9
jmp 0x454d8c
jne 0x1341a6d
mov ebx, dword [ebp - 0xc]
call fcn.00403fd7
push ebx
bswap ax
inc al
push ecx
mov eax, dword [ebp - 0x10]
jmp 0x1285898
shl eax, 2
cmp dh, 0xdf
lea ebx, [ebx + eax]
mov ebx, dword [ebx]
stc
add ebx, 8
jmp 0x125e418
push 1
jmp 0x14913c7
push dword [ebx]
jmp 0x13d210c
mov ebx, dword [ebp - 0x1c]
push dword [ebx]
jmp 0x155a32e
pop ecx
clc
pop ebx
cmp eax, ecx
jl 0x12827aa
push 0x98d
jmp 0x1493d8c
jmp 0x155fe0a
lea ebx, [ebx + eax]
clc
cmc
test bx, bp
mov ebx, dword [ebx]
add ebx, 8
jmp 0x15f07ba
push 0xf43366
movzx ebx, dx
mov ebx, dword [ebp - 0x14]
jmp 0x14e8f83
call fcn.00404d40
lea esp, [esp + 8]
cmp eax, 0
jmp 0x12e239f
push 4
call fcn.00470ff7
add esp, 0xc
movsx ebx, sp
mov ecx, edi
pop ecx
seta bh
cmp sp, 0x3dc0
or bh, 0x8d
pop ebx
cmp eax, ecx
jmp 0x14a5bcf
push 0x33d495f0
call fcn.0124e214
jns 0x15af4c1
push 0x903
jmp 0x139fb24
call fcn.00470ff7
lea esp, [esp + 0xc]
pop ecx
neg bx
btc bx, si
pop ebx
cmp si, ax
cmp eax, ecx
jl 0x14b2f87
push 0x903
jmp 0x44314b
mov eax, 0
cmp eax, ebx
stc
test eax, eax
jmp 0x1492a65
mov dword [ebp - 0x1c], ebx
movzx ebx, bx
push 0xf43373
jmp 0x14fa905

Function at 0x145bd02
Capabilities:
Packed with generic packer

Disassembly:
push ebp
movsx ebp, sp
mov ebp, esp
cmc
sub esp, 0x24
jmp 0x14bab70
push 8
jmp 0x1507f65
push 8
jmp 0x157bf58
call fcn.00470feb
add esp, 4
cmovg si, bp
mov dword [ebp - 4], eax
movzx esi, sp
xchg edi, esi
mov edi, eax
mov si, 0x22bf
movzx esi, si
mov esi, 0x53eaf0
lodsd eax, dword [esi]
jmp 0x1518bcd
stosd dword es:[edi], eax
movsx eax, sp
bswap ax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 8], 0
jmp 0x14d5c85
call fcn.00470feb
add esp, 4
mov dword [ebp - 0xc], eax
mov edi, eax
movzx eax, bx
mov esi, 0x53eaf0
lodsd eax, dword [esi]
jmp loc.00472a08
Function at 0x1536892
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0x10], 0
jmp 0x15e02bf
nop
jmp 0x144f9f9
nop
jmp 0x1563ca2
call fcn.00470feb
add esp, 4
jmp 0x13dde9f
stosd dword es:[edi], eax
lodsd eax, dword [esi]
jmp 0x1492a8d
nop
nop
nop
jmp 0x1493c48
call fcn.0041765e
mov dword [ebp - 0x1c], eax
mov ebx, 0x1cdd7c25
bswap bx
mov ebx, dword [ebp - 0x14]
jmp 0x141d814
push eax
jmp 0x12eda5c
stosd dword es:[edi], eax
cbw
lodsd eax, dword [esi]
jmp 0x142f2f2
push 0
bswap eax
push dword [ebp - 0x18]
movzx eax, sp
movsx ax, dl
push 1
lea eax, [ebp - 4]
jmp 0x12f295a
mov esi, 0x53eaf0
lodsd eax, dword [esi]
jmp 0x15ef3d3
mov dword [ebp - 0x14], eax
mov edi, eax
not ah
mov esi, 0x53eaf0
movsx ax, ah
lodsd eax, dword [esi]
jmp 0x130d7c9
nop
nop
jmp 0x15893a7
push 8
jmp 0x15d990d
push ebx
jmp 0x14a5916
stosd dword es:[edi], eax
movsx eax, cx
not ah
xchg ah, al
push 0
cwde
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], 0
seta ah
jmp 0x13aaf6c
nop
jmp 0x1408641
stosd dword es:[edi], eax
jmp 0x1226591
nop
nop
pushal
bswap edi
mov eax, 1
not ebp
xchg dx, ax
mov eax, 2
rdtsc
cbw
bswap si
mov eax, 4
lahf
bswap ecx
cdq
mov eax, 2
mov eax, 5
mov bl, 0x74
xchg di, cx
mov eax, 4
not ebp
mov eax, 2
cdq
mov eax, 5
jmp 0x15b0d48
call fcn.00470ff1
lea esp, [esp + 4]
and bx, bp
mov al, ch
cmp ebp, 0x3501363a
mov eax, dword [ebp - 0x1c]
dec bh
shld bx, bx, 0xb0
sub ecx, ecx
movzx bx, bh
movsx ebx, dx
push eax
setg bh
movzx ebx, si
lea eax, [ebp - 8]
xchg bl, bl
mov ebx, eax
xchg ah, al
pop eax
jmp loc.004159a7
push 8
jmp 0x15ce5e6
push ebp
mov ebp, esp
cmc
jmp 0x159f289
nop
jmp 0x12b9bca
nop
jmp 0x1298c0f
push 8
jmp 0x129ebae
sub esp, 0x24
jmp 0x1523086
mov eax, 6
xchg edx, ecx
popal
push edx
mov edx, 1
mov edx, 2
xchg dx, dx
mov edx, 4
cdq
mov edx, 2
mov edx, 5
not dx
movsx edx, ax
mov dx, 0x5108
mov edx, 4
mov edx, 2
not dx
mov edx, 5
movzx edx, di
mov edx, 5
movsx dx, dl
pop edx
jmp 0x1593536
call fcn.00470feb
add esp, 4
bswap di
mov si, dx
movzx edi, bp
mov dword [ebp - 4], eax
mov edi, eax
jmp 0x13c84f3
call fcn.00470feb
add esp, 4
movzx edi, di
mov dword [ebp - 0xc], eax
movzx edi, ax
bswap edi
mov edi, 0x48c64f78
mov edi, eax
cbw
mov esi, 0x53eaf0
mov ax, dx
cwde
movsx ax, cl
lodsd eax, dword [esi]
jmp 0x12a8f08
jmp 0x126dbe1
stosd dword es:[edi], eax
mov dword [ebp - 8], 0
jmp 0x141b2f6
stosd dword es:[edi], eax
lahf
lodsd eax, dword [esi]
jmp 0x15e13f5

Function at 0x156e407
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [ebp - 4], 0
jmp 0x12cd23f
mov dword [ebp - 0xc], 0
jmp 0x1372b57
nop
jmp 0x152f8d1
nop
jmp 0x146bfb8
nop
jmp 0x124dff2
mov dword [ebp - 8], 0
jmp 0x1224748
mov dword [ebp - 0x10], 0
jmp 0x1584b33
nop
nop
jmp 0x456830
nop
jmp 0x1288922
nop
nop
jmp 0x15dcc18
push ebp
mov ebp, edx
mov ebp, esp
sub esp, 0x24
jmp 0x11da2f8
nop
jmp 0x12446f6
nop
jmp 0x147d7e5
Function at 0x1588f98
Capabilities:
Packed with generic packer

Disassembly:
nop
cmp cx, bx
stc
cmp sp, 0x7af
nop
test bx, sp
jmp 0x15e1422
pushal
sar bp, 0x4c
sar cx, cl
movsx edx, ax
mov eax, 1
xor ebp, eax
adc esi, ebp
mov eax, 2
mov eax, 4
ror ecx, cl
test cx, 0x2552
mov eax, 2
xadd bp, si
mov eax, 5
mov eax, 4
mov eax, 2
and edx, esi
mov eax, 5
btc edi, ebp
mov eax, 6
mov bp, 0x6dee
btc bx, 0x20
movzx ebx, ax
popal
stc
push edx
shr al, 0x83
mov edx, 1
or ah, dh
mov edx, 2
and dh, 0xd4
shr dh, 0x28
bsr dx, bp
mov edx, 4
ror eax, cl
test esi, esp
mov edx, 2
and ah, ah
shrd edx, esp, 0x52
mov edx, 5
rcl ah, cl
clc
bt ax, 0x93
mov edx, 4
sbb dh, dl
mov edx, 2
cbw
mov edx, 5
movzx ax, ch
cmc
mov edx, 5
bts edx, ebx
shl edx, 0x57
pop edx
mov dword [ebp - 4], 0
btr ax, 0x84
shr ah, 0x5e
rol al, 0x84
mov dword [ebp - 8], 0
ror al, cl
mov dword [ebp - 0xc], 0
push ecx
stc
cbw
push edx
movsx eax, bp
mov cx, 0x7bfb
bsf dx, bp
push ebx
mov edx, 0x4db545ff
movzx eax, ax
xor ecx, ebx
mov eax, 1
ror ecx, cl
cwd
add dh, dh
cpuid
sub ebx, ebx
mov bl, al
jmp 0x13d2181
call fcn.00470fe5
add esp, 0x10
push 0x80000101
push 0
movzx ebx, sp
push eax
bswap ebx
push 1
mov bl, bl
mov ebx, 0x472970
jmp 0x1366b59
mov dword [ebp - 0xc], 0
jmp 0x1492d10
call fcn.00470fe5
add esp, 0x10
setne bl
movzx bx, cl
push 0x80000101
bswap bx
mov bx, cx
push 0
mov ebx, ecx
bswap ebx
push eax
cmova ebx, ecx
bswap bx
push 1
movzx ebx, cx
mov ebx, 0x3acb7921
mov ebx, 0x472970
jmp loc.0045a234
call fcn.00470fe5
add esp, 0x10
setno bl
xchg bl, bh
mov dword [ebp - 0x1c], eax
xchg bx, bx
push 0x80000301
movsx ebx, cx
push 0
push dword [ebp - 0xc]
movzx ebx, di
push 1
bswap bx
mov bl, 0x7c
mov ebx, 0x471e80
jmp 0x130f1cb
mov ebx, 0x471e80
jmp 0x14a6c89
mov dword [ebp - 4], ebx
mov bl, cl
movsx cx, bh
movzx ecx, si
jmp 0x152c156
nop
jmp 0x11d3907
nop
test esp, 0x29e504d5
cmp cx, si
nop
nop
clc
cmp edi, edx
jmp 0x141a14b
jmp 0x147a4ef
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x1305e83
call fcn.00470fe5
add esp, 0x10
mov bl, dh
xchg bx, bx
push 0x80000101
push 0
push eax
xchg bl, bh
movsx ebx, bx
push 1
cmovbe bx, sp
mov ebx, 0x472970
call fcn.00470fe5
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x80000301
setb bh
push 0
push dword [ebp - 8]
movsx ebx, bp
push 1
movsx bx, dl
mov ebx, 0x471e80
jmp 0x130275e
pop ecx
movsx bx, ah
bswap bx
mov bh, 0xb
push 0x80000301
push 0
setbe bh
movzx bx, ah
push dword [ebp - 4]
xchg bh, bh
push 1
mov ebx, ecx
jmp 0x13ce55c
mov dword [ebp - 8], ebx
mov bl, dl
cmovno cx, ax
mov ecx, esp
cwd
mov dword [ebp - 0xc], ebx
movzx ebx, cx
pop ebx
cwd
pop edx
jmp 0x14abb19
push ebp
mov ebp, esp
sub esp, 0x2c
jmp 0x1497712
nop
test eax, 0x21263bec
nop
nop
nop
nop
cmp dx, 0x615d
nop
jmp 0x12d34b4
Function at 0x1592b36
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
call fcn.00470feb
add esp, 4
mov dword [ebp - 4], eax
cmovbe si, sp
jmp 0x1539b45
sub esp, 0x2c
push 8
jmp 0x1227627
stosd dword es:[edi], eax
mov dword [ebp - 8], 0
jmp loc.00450c6f
stosd dword es:[edi], eax
movsx eax, bp
cmovl eax, ecx
lodsd eax, dword [esi]
jmp 0x14c1fcb
mov edi, eax
movzx esi, di
mov esi, 0x53eaf0
xchg ah, ah
lodsd eax, dword [esi]
jmp 0x14d43a7
push ebp
cmc
cmova ebp, esi
mov ebp, esp
jmp 0x138ef19
Function at 0x811058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008111a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x81107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81106a
add dl, dl
jne 0x811089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8110dc
xor eax, eax
add dl, dl
jne 0x811096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81117d
add dl, dl
jne 0x8110a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8110b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8110bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8110c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8110d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x811075
mov eax, 1
add dl, dl
jne 0x8110ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8110f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8110e1
sub eax, ebx
mov ebx, 1
jne 0x811128
mov ecx, 1
add dl, dl
jne 0x81110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x811119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x811105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x811075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x81113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x81114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x811136
cmp eax, 0x7d00
jae 0x81116d
cmp eax, 0x500
jb 0x811168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x811075
cmp eax, 0x7f
ja 0x811170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x811075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x81119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x811075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x725d90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15e000]
push edi
or ebp, 0xffffffff
jmp 0x725db2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x725db9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x725da8
mov eax, 1
add ebx, ebx
jne 0x725dcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x725ddc
jne 0x725dfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x725dfb
dec eax
add ebx, ebx
jne 0x725de8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x725dc0
add ebx, ebx
jne 0x725df7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x725e4d
xor ecx, ecx
sub eax, 3
jb 0x725e13
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x725e82
sar eax, 1
mov ebp, eax
jmp 0x725e1e
add ebx, ebx
jne 0x725e1e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x725dec
inc ecx
add ebx, ebx
jne 0x725e2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x725dec
add ebx, ebx
jne 0x725e39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x725e2e
jne 0x725e4a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x725e2e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x725e6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x725e5e
jmp 0x725dae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x725e6c
add edi, ecx
jmp 0x725dae
pop esi
mov edi, esi
mov ecx, 0x6a6f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x725e8a
cmp byte [edi], 0x24
jne 0x725e8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x725e8f
lea edi, [esi + 0x322000]
mov eax, dword [edi]
or eax, eax
je 0x725f07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x336c8c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x336de0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x725ebc
mov ecx, edi
jns 0x725eeb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x336de8]
or eax, eax
je 0x725f01
mov dword [ebx], eax
add ebx, 4
jmp 0x725ed9
call dword [esi + 0x336de4]
mov ebp, dword [esi + 0x336dec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x725f3b
sub esp, 0xffffff80
jmp 0x4e96df
Function at 0x407570
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x40758a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407591
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407580
mov eax, 1
add ebx, ebx
jne 0x4075a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407598
jne 0x4075b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407598
xor ecx, ecx
sub eax, 3
jb 0x4075c8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40763a
mov ebp, eax
add ebx, ebx
jne 0x4075d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4075e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x407604
inc ecx
add ebx, ebx
jne 0x4075f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4075e5
jne 0x407601
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4075e5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407624
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407615
jmp 0x407586
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407624
add edi, ecx
jmp 0x407586
pop esi
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407683
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407641
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x706c]
or eax, eax
je 0x40767d
mov dword [ebx], eax
add ebx, 4
jmp 0x40765e
call dword [esi + 0x7068]
mov ebp, dword [esi + 0x7070]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4076b7
sub esp, 0xffffff80
jmp 0x401020
Function at 0x2195058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.021951a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x219507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x219506a
add dl, dl
jne 0x2195089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x21950dc
xor eax, eax
add dl, dl
jne 0x2195096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x219517d
add dl, dl
jne 0x21950a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21950b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21950bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21950c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x21950d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2195075
mov eax, 1
add dl, dl
jne 0x21950ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21950f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x21950e1
sub eax, ebx
mov ebx, 1
jne 0x2195128
mov ecx, 1
add dl, dl
jne 0x219510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2195119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2195105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2195075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x219513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x219514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2195136
cmp eax, 0x7d00
jae 0x219516d
cmp eax, 0x500
jb 0x2195168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2195075
cmp eax, 0x7f
ja 0x2195170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2195075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x219519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2195075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40186a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x40a310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00401844
mov edi, eax
xor ebx, ebx
pop ecx
mov dword [ebp - 0x1fc], edi
cmp edi, ebx
je 0x401a0a
push 3
call fcn.00403627
pop ecx
cmp eax, 1
je 0x4019b6
push 3
call fcn.00403627
or eax, eax
pop ecx
jne 0x4018c8
cmp dword [section..data], 1
je 0x4019b6
cmp esi, 0xfc
je 0x401a0a
push str.Runtime_Error__n_nProgram:
push 0x314
mov edi, 0x40ab80
push edi
call fcn.004035c4
add esp, 0xc
test eax, eax
jne 0x4019ac
push 0x104
mov esi, 0x40abb2
push esi
push ebx
mov word [0x40adba], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0x2fb
or eax, eax
jne 0x401934
push str._program_name_unknown_
push ebx
push esi
call fcn.004035c4
add esp, 0xc
or eax, eax
je 0x401934
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00402ecc
push esi
call fcn.004035a9
pop ecx
inc eax
cmp eax, 0x3c
jbe 0x40196b
push esi
call fcn.004035a9
lea eax, [eax*2 + 0x40ab3c]
mov ecx, eax
sub ecx, esi
push 3
sar ecx, 1
push 0x407b5c
sub ebx, ecx
push ebx
push eax
call fcn.004034dc
add esp, 0x14
or eax, eax
jne 0x401928
push 0x407b54
mov esi, 0x314
push esi
push edi
call fcn.00403467
sub esp, 0xfffffff4
or eax, eax
jne 0x401928
push dword [ebp - 0x1fc]
push esi
push edi
call fcn.00403467
sub esp, 0xfffffff4
test eax, eax
jne 0x401928
push 0x12010
push 0x407b08
push edi
call fcn.004032fb
add esp, 0xc
jmp 0x401a0a
push ebx
push ebx
push ebx
push ebx
push ebx
jmp 0x40192f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
cmp esi, ebx
je 0x401a0a
cmp esi, 0xffffffff
je 0x401a0a
xor eax, eax
mov cl, byte [edi + eax*2]
mov byte [ebp + eax - 0x1f8], cl
cmp word [edi + eax*2], bx
je 0x4019e3
inc eax
cmp eax, 0x1f4
jb 0x4019cb
lea eax, [ebp - 0x1f8]
lea edi, [ebp - 0x1fc]
push ebx
push edi
push eax
mov byte [ebp - 5], bl
call fcn.00403270
pop ecx
push eax
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
pop ebx
call fcn.00403666
leave
ret
Function at 0x401f2c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov edi, edi
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x401f48
xor eax, eax
jmp 0x401fbf
cmp word [esi], bx
je 0x401f5d
sub eax, 0xfffffffe
cmp word [eax], bx
jne 0x401f4d
sub eax, 0xfffffffe
cmp word [eax], bx
jne 0x401f4d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub eax, esi
push ebx
sar eax, 1
inc eax
push ebx
push ebx
push ebx
push eax
push esi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call edi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x401fb5
push eax
call fcn.00403ee4
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x401fb5
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x401fa9
push dword [ebp - 4]
call fcn.00403e4b
pop ecx
mov dword [ebp - 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 4]
jmp 0x401fbe
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov eax, 0x5a4d
mov ecx, esp
mov edx, dword [ecx + 8]
cmp word [edx], ax
je 0x403136
xor eax, eax
pop ebp
ret
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x403132
xor edx, edx
mov eax, 0x10b
cmp word [ecx + 0x18], ax
sete dl
pop ebp
mov eax, edx
ret

Function at 0x403160
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov edx, esp
mov eax, dword [edx + 8]
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx eax, word [ebx + 0x14]
push edi
push esi
mov ebp, ebp
movzx edi, word [ebx + 6]
xor esi, esi
lea eax, [eax + ebx + 0x18]
push ebp
or edi, edi
je 0x40319d
mov ebp, dword [edx + 0xc]
mov edx, dword [eax + 0xc]
cmp ebp, edx
jb 0x403195
mov ebx, dword [eax + 8]
add ebx, edx
cmp ebp, ebx
jb 0x40319f
inc esi
sub eax, 0xffffffd8
cmp esi, edi
jb 0x403185
xor eax, eax
pop ebp
pop esi
pop edi
pop ebx
ret