joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8b7b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x8b7b9e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x8b7b92
cmp dword [edi + 0x7c], ebx
je 0x8b7bad
call fcn.008b7f60
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.008b78f0
add esp, 0xc
test eax, eax
je 0x8b7bd4
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x7e
call fcn.008c1f46
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x8b7c12
push 0x4000
call fcn.008c1f46
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x8b7c1f
push esi
call fcn.008c2010
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x8b7c67
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.008b6a40
test eax, eax
jne 0x8b7c67
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x8b7c8e
mov cl, byte [edi + 0x39]
mov byte [esi + 0x7d], cl
jmp 0x8b7c94
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x7d], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x6d]
mov dword [esi + 0x79], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x71], 0x23456789
mov dword [esi + 0x75], 0x34567890
cmp ebp, ebx
je 0x8b7cd1
lea ecx, [ecx]
mov cl, byte [ebp]
cmp cl, bl
je 0x8b7cd1
call fcn.008b6730
add ebp, 1
jne 0x8b7cc0
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x41fae5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x41faf4
pop dword [ebp - 0x10]
mov eax, 0x7963b538
add eax, 0x86de45bc
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3c90b
push 0
mov eax, 0xa2644f68
sub eax, 0xa221fe48
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x489c
xor edx, edx
add edx, eax
mov ebx, 0x432e00
add ebx, dword [ebp - 0x10]
mov edi, 0xcafd5ba6
add dword [ebp - 8], 0x84845ac8
mov esi, dword [ebx]
xor dword [ebp - 8], eax
sub esi, edi
mov dword [ebp - 8], 0xf37a6a28
mov dword [edx], esi
add edx, 0x895e9aeb
sub edx, 0x895e9ae7
add ebx, 4
loop 0x41fb43
add eax, 0x3efd9e0c
add eax, 0xc1037737
mov ebx, eax
add eax, 5
mov ecx, 0x52107155
add ecx, 0xae2f8eab
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x550008], 0x8088405
inc edx
mov dword [ebx + 0x550008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f04c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x53453a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f09b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
jmp 0x41f0ba
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f12c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f115
test esi, esi
jbe 0x41f12c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f107
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f12c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0e4
jmp 0x41f12c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f12c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534541
ret
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x53589f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0x552348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0x552348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0x551178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5358a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x407ca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x4493f0], 0
push esi
push edi
mov edi, edx
jne 0x407d30
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, esi
push 0
shld eax, ecx, 9
push edx
shl ecx, 9
push eax
push ecx
push dword [0x44b728]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [ebp - 8]
push eax
push 0x200
push edi
push dword [0x44b728]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 0x200
mov dword [ebp - 0xc], eax
je 0x407d1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 8]
push 0x200
push dword [ebp - 0xc]
push str.ReadFile_error_bRet:_u_WriteSize:_u_dwSize:_u_ErrCode:_u
call fcn.00414ac0
add esp, 0x14
or esi, dword [ebp + 0xc]
jne 0x407d30
mov ecx, 0x80
mov esi, 0x44a9d8
rep movsd dword es:[edi], dword [esi]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4213bc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4213c2
ret

Function at 0x47006c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x470074
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x470266
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x47027c
mov eax, esi
call fcn.0046ddfc
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404a78
lea ecx, [ebp - 0x10]
mov edx, 0x470290
mov eax, esi
call fcn.0046ddfc
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404a78
lea ecx, [ebp - 0x14]
mov edx, 0x4702a8
mov eax, esi
call fcn.0046ddfc
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404a78
lea ecx, [ebp - 0x18]
mov edx, 0x4702c4
mov eax, esi
call fcn.0046ddfc
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404a78
lea ecx, [ebp - 0x1c]
mov edx, 0x4702e0
mov eax, esi
call fcn.0046ddfc
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404a78
lea ecx, [ebp - 0x24]
mov edx, 0x4702f8
mov eax, esi
call fcn.0046ddfc
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408c5c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040903c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x470310
mov eax, esi
call fcn.0046ddfc
mov eax, dword [ebp - 0x28]
call fcn.0046cf14
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x470320
mov eax, esi
call fcn.0046ddfc
mov eax, dword [ebp - 0x2c]
call fcn.0046cf14
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x470338
mov eax, esi
call fcn.0046ddfc
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040903c
inc eax
je 0x470209
lea ecx, [ebp - 0x34]
mov edx, 0x470338
mov eax, esi
call fcn.0046ddfc
mov eax, dword [ebp - 0x34]
call fcn.00409000
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a584
fstp qword [ebp - 0x3c]
wait
call fcn.0040a8e8
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x470224
lea ecx, [ebp - 0x40]
mov edx, 0x470338
mov eax, esi
call fcn.0046ddfc
mov eax, dword [ebp - 0x40]
call fcn.0046cf14
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x470348
mov eax, esi
call fcn.0046ddfc
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47026d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404a48
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404a48
ret
Function at 0x47c504
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x47c55e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0047c4f4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0046bb80
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0046b780
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c565
lea eax, [ebp - 4]
call fcn.00404a24
ret

Function at 0x47c8e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x47c8f3
add esp, 0xfffffff0
call fcn.00403f74
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47c96c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403c20
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x14], 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.0047cd4c
mov edx, dword [ebp - 4]
lea eax, [esi + 8]
call fcn.00404a78
mov ecx, dword [esi + 8]
lea eax, [esi + 0xc]
mov edx, 0x47c998
call fcn.00404d30
mov ecx, esi
mov dl, 1
mov eax, dword [0x47c714]
call fcn.0047d1ac
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c973
lea eax, [ebp - 4]
call fcn.00404a24
ret

Function at 0x482a50
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x43fb6c]
call fcn.0043fc6c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x482b56
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0043fd0c
mov cl, 1
mov edx, 0x482b98
mov eax, dword [ebp - 8]
call fcn.0043fd70
mov eax, ebx
sub al, 5
je 0x482aa1
sub al, 0xb
je 0x482ab3
jmp 0x482ac3
mov ecx, dword [ebp - 4]
mov edx, 0x482be4
mov eax, dword [ebp - 8]
call fcn.0043ff38
jmp 0x482ac3
mov ecx, dword [ebp - 4]
mov edx, 0x482bf4
mov eax, dword [ebp - 8]
call fcn.0043ff38
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0043fd0c
mov cl, 1
mov edx, 0x482c0c
mov eax, dword [ebp - 8]
call fcn.0043fd70
sub bl, 0x15
je 0x482af2
dec bl
je 0x482b04
dec bl
je 0x482b16
dec bl
je 0x482b28
jmp 0x482b38
mov ecx, dword [ebp - 4]
mov edx, 0x482c40
mov eax, dword [ebp - 8]
call fcn.0043ff38
jmp 0x482b38
mov ecx, dword [ebp - 4]
mov edx, 0x482c58
mov eax, dword [ebp - 8]
call fcn.0043ff38
jmp 0x482b38
mov ecx, dword [ebp - 4]
mov edx, 0x482c70
mov eax, dword [ebp - 8]
call fcn.0043ff38
jmp 0x482b38
mov ecx, dword [ebp - 4]
mov edx, 0x482c84
mov eax, dword [ebp - 8]
call fcn.0043ff38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482b5d
mov eax, dword [ebp - 8]
call fcn.0043fcdc
mov eax, dword [ebp - 8]
call fcn.00403c50
ret
Function at 0x12c3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.012c378f
jae 0x12c370e
xor ecx, ecx
call fcn.012c378f
jae 0x12c373d
xor eax, eax
call fcn.012c378f
jae 0x12c374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.012c378f
adc al, al
jae 0x12c372f
jne 0x12c3779
stosb byte es:[edi], al
jmp 0x12c3711
call fcn.012c379b
sub ecx, ebx
jne 0x12c3756
call fcn.012c3799
jmp 0x12c3775
lodsb al, byte [esi]
shr eax, 1
je 0x12c3783
adc ecx, ecx
jmp 0x12c3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.012c3799
cmp eax, 0x7d00
jae 0x12c3772
cmp ah, 5
jae 0x12c3773
cmp eax, 0x7f
ja 0x12c3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12c3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x405ff1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42c2c4], 0
jne 0x40602f
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406005
mov dword [ecx*4 + 0x42c2c0], eax
inc ecx
cmp ecx, 0x100
jl 0x406000
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40605c
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42c2c0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40603d
not eax
pop ebp
ret 0xc

Function at 0x433790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d000]
push edi
or ebp, 0xffffffff
jmp 0x4337b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4337b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4337a8
mov eax, 1
add ebx, ebx
jne 0x4337cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4337c0
jne 0x4337dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4337c0
xor ecx, ecx
sub eax, 3
jb 0x4337f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x433862
mov ebp, eax
add ebx, ebx
jne 0x4337fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x433808
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43382c
inc ecx
add ebx, ebx
jne 0x433818
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43380d
jne 0x433829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43380d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43384c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43383d
jmp 0x4337ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43384c
add edi, ecx
jmp 0x4337ae
pop esi
mov edi, esi
mov ecx, 0x617
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43386a
cmp byte [edi], 7
jne 0x43386a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43386f
lea edi, [esi + 0x31000]
mov eax, dword [edi]
or eax, eax
je 0x4338de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x34648]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x346d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43389c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x346d8]
or eax, eax
je 0x4338d8
mov dword [ebx], eax
add ebx, 4
jmp 0x4338b9
call dword [esi + 0x346e8]
mov ebp, dword [esi + 0x346dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x433912
sub esp, 0xffffff80
jmp 0x419857
Function at 0x1270780
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x945000]
push edi
or ebp, 0xffffffff
jmp 0x12707a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x12707a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1270798
mov eax, 1
add ebx, ebx
jne 0x12707bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x12707cc
jne 0x12707eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12707eb
dec eax
add ebx, ebx
jne 0x12707d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x12707b0
add ebx, ebx
jne 0x12707e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x127083d
xor ecx, ecx
sub eax, 3
jb 0x1270803
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1270872
sar eax, 1
mov ebp, eax
jmp 0x127080e
add ebx, ebx
jne 0x127080e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12707dc
inc ecx
add ebx, ebx
jne 0x127081c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12707dc
add ebx, ebx
jne 0x1270829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x127081e
jne 0x127083a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x127081e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x127085c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x127084e
jmp 0x127079e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x127085c
add edi, ecx
jmp 0x127079e
pop esi
mov edi, esi
mov ecx, 0x37e4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x127087a
cmp byte [edi], 0x13
jne 0x127087a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x127087f
lea edi, [esi + 0xe6d000]
mov eax, dword [edi]
or eax, eax
je 0x12708f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe79360]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe79424]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x12708ac
mov ecx, edi
jns 0x12708db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe7942c]
or eax, eax
je 0x12708f1
mov dword [ebx], eax
add ebx, 4
jmp 0x12708c9
call dword [esi + 0xe79428]
mov ebp, dword [esi + 0xe79430]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x127092b
sub esp, 0xffffff80
jmp 0x46f1ee