joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414cc9
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x414d14
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00414e68
test al, al
jne 0x414d0e
sub edx, 2
cmp edx, edi
jne 0x414cf4
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x414d36
lea eax, [edi + 2]
cmp edx, eax
je 0x414d36
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00414c15
add esp, 0x10
jmp 0x414e30
push esi
lea ecx, [ebp - 0x255]
call fcn.00414e68
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414d79
push dword [ebp - 0x25c]
jmp 0x414d26
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x414db6
cmp word [ebp - 0x226], 0
je 0x414dd7
cmp word [ebp - 0x226], ax
jne 0x414db6
cmp word [ebp - 0x224], 0
je 0x414dd7
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00414c15
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x414e23
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x414d90
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x414e0b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x414e30
push 0x414a45
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004198b0
add esp, 0x10
jmp 0x414e00
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a859
leave
ret
Function at 0x41c9c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c9ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c9ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x412ebe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412d3d

Function at 0x41704f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004169bd

Function at 0x41705a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416bf8

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x79065ef9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x76fd60d3
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x727c76aa
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x593a4600
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x438c90
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
add ebx, 1
call fcn.00438ccd
and ebx, eax
sub eax, eax
xor dword [ecx], esi
mov eax, 0xa9b9682e
dec ebx
sub eax, eax
inc ecx
mov ebx, eax
cmp ecx, edi
jne fcn.00438c90
dec eax
and ebx, eax
add eax, 0x372bc0a8
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x6ae2520e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x7c527fa4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401518
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
push ecx
mov eax, dword [eax + 0xc]
movsx ecx, byte [eax]
cmp cl, 0x6e
jne 0x40153d
lea edx, [eax + 1]
mov edi, 1
mov dword [esi + 0xc], edx
movsx ecx, byte [eax + 1]
xor ebx, ebx
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x40154e
test edi, edi
je 0x401584
neg ebx
jmp 0x401584
lea eax, [ecx - 0x30]
mov ecx, 0xa
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, 0x7fffffff
sub eax, edx
cdq
idiv ecx
cmp eax, ebx
jl 0x401581
imul ebx, ebx, 0xa
mov eax, dword [ebp - 0x10]
add ebx, eax
mov eax, dword [esi + 0xc]
lea edx, [eax + 1]
mov dword [esi + 0xc], edx
movsx ecx, byte [eax + 1]
jmp 0x40153f
or ebx, 0xffffffff
pop edx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403517
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push ebx
mov ebx, eax
mov eax, dword [ecx]
cmp eax, 3
je 0x40361c
sub eax, 0x19
cmp eax, 0x3a
ja case.0x403537.40
jmp dword [eax*4 + 0x47ff78]
mov edx, str._restrict
jmp 0x40354a
mov edx, str._volatile
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.00401923
mov edx, str._const
jmp 0x40354a
mov edx, str._transaction_safe
jmp 0x40354a
mov edx, str._noexcept
jmp 0x40356e
mov edx, str._throw
mov eax, ebx
call fcn.00401923
cmp dword [esi + 0x10], 0
je case.0x403537.33
mov edx, 0x28
mov eax, ebx
call fcn.004018a2
mov ecx, dword [esi + 0x10]
jmp 0x403630
mov edx, 0x20
mov eax, ebx
call fcn.004018a2
mov ecx, dword [esi + 0x10]
jmp 0x40364d
mov edx, 0x2a
jmp 0x403641
mov edx, 0x20
mov eax, ebx
call fcn.004018a2
mov edx, 0x26
jmp 0x403641
mov edx, 0x20
mov eax, ebx
call fcn.004018a2
mov edx, 0x47ff4e
jmp 0x40354a
mov edx, str.__Complex
jmp 0x40354a
mov edx, str.__Imaginary
jmp 0x40354a
cmp byte [ebx + 0x104], 0x28
je 0x403603
mov edx, 0x20
mov eax, ebx
call fcn.004018a2
mov ecx, dword [esi + 0xc]
mov edx, 0x11
mov eax, ebx
call fcn.00401cd5
mov edx, 0x47ff67
jmp 0x40354a
mov ecx, dword [ecx + 0xc]
jmp 0x40364d
mov edx, str.___vector_
mov eax, ebx
call fcn.00401923
mov ecx, dword [esi + 0xc]
mov edx, 0x11
mov eax, ebx
call fcn.00401cd5
mov edx, 0x29
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.004018a2
mov ecx, esi
mov eax, ebx
mov edx, 0x11
pop ebx
pop esi
pop ebp
jmp fcn.00401cd5
pop ebx
pop esi
pop ebp
ret

Function at 0x403985
Capabilities:
Parse credit card information

Disassembly:
cmp dword [ecx], 0x33
jne 0x403998
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 4]
jmp fcn.004018e0
mov edx, 0x11
jmp fcn.00401cd5

Function at 0x406be8
Capabilities:
Parse pe header

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x406c0d
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x406c0d
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
pop ebp
ret

Function at 0x406c11
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
movzx esi, word [edx + 6]
lea eax, [edx + eax + 0x18]
cmp ebx, esi
jae 0x406c45
mov edx, dword [eax + 0xc]
cmp ecx, edx
jb 0x406c3f
add edx, dword [eax + 8]
cmp ecx, edx
jb 0x406c47
inc ebx
add eax, 0x28
jmp 0x406c2d
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x40f61e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov ebx, eax
sub esp, 0x50
mov dword [esp], eax
call fcn.0040f228
dec eax
jne 0x40f673
xor eax, eax
lea edi, [ebp - 0x3d]
lea ebx, [ebp - 0x3d]
mov ecx, 0x35
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call fcn.0040f5f4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
mov dword [ebx], 0xffffffff
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret

Function at 0x40f709
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
call fcn.0040f680
mov eax, dword [0x47c214]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push ecx
test eax, eax
jne 0x40f812
call fcn.0040f556
mov ebx, eax
test eax, eax
je 0x40f812
mov dword [eax + 0x24], 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x38]
mov dword [ebx + 0x1c], 0xffffffff
call fcn.0040f61e
mov edx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebp - 0x1c], edx
mov dword [ebx + 0x14], eax
call edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, dword [ebp - 0x1c]
mov esi, eax
call edx
xor edx, edx
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
lea edx, [ebx + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
jne 0x40f7d9
call sub.msvcrt.dll_abort
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor ecx, ecx
push edx
mov dword [ebx + 0x6c], eax
mov al, byte [ebx + 0x20]
mov dword [ebx + 0x68], ecx
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov dword [esp + 4], ebx
mov eax, dword [0x47c214]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push esi
test eax, eax
je 0x40f7d4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41039d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
call fcn.0040f709
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.0040fe6a
test byte [ebx + 0x20], 0x30
jne 0x4103da
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x47c214]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41046e
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
jne 0x410416
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41040c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x410451
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41042e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
je 0x41046e
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.0040f81c
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x47c214]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
Function at 0x415b80
Capabilities:
Encode data using xor
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x4c]
push ebx
sub esp, 0x6c
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x34], 0x4776b4
mov dword [ebp - 0x30], 0x4797b0
mov dword [ebp - 0x2c], ebp
mov dword [ebp - 0x28], 0x415d58
mov dword [ebp - 0x24], esp
mov dword [esp], eax
call fcn.00407283
mov eax, dword [0x489024]
mov edi, dword [0x489028]
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edi
mov dword [esi + 0x30], 0
test eax, eax
js 0x415d45
je 0x415d00
mov dword [esp], eax
mov dword [ebp - 0x48], 0xffffffff
call fcn.00476ef0
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x60], eax
mov esi, eax
mov byte [eax], 0
mov eax, dword [ebp - 0x5c]
sub eax, 1
jne 0x415cd8
mov eax, dword [ebp - 0x50]
mov edi, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x60]
mov ebx, dword [eax + 0x24]
mov esi, dword [eax + 0x28]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x58], ebx
sub esi, ebx
mov dword [ebp - 0x54], esi
lea esi, [edi + eax]
jmp 0x415c40
mov eax, dword [ebp - 0x58]
add edi, 1
add ecx, 1
movzx ebx, byte [eax + edx]
lea eax, [edx + 1]
xor edx, edx
xor bl, byte [edi - 1]
div dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov byte [ecx - 1], bl
mov dword [eax + 0x30], edx
cmp edi, esi
jne 0x415c40
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
mov dword [ebp - 0x48], 1
call fcn.00476e70
mov ecx, dword [ebp - 0x64]
mov dword [0x489020], eax
mov dword [esp + 8], ecx
mov esi, dword [ebp - 0x60]
mov dword [esp], eax
mov dword [esp + 4], esi
call sub.msvcrt.dll_memcpy
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x5c]
sub esp, 8
mov dword [esp + 4], eax
mov esi, dword [ebp - 0x60]
mov dword [esp], esi
call fcn.00476e68
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call fcn.004072d9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [esi + 1]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
jmp 0x415c05
mov dword [esp], 0
mov dword [ebp - 0x48], 2
call fcn.00476e70
mov dword [0x489020], eax
mov dword [ebp - 0x48], 4
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x48], 3
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
jmp 0x415cbe
mov dword [esp], str.cannot_create_std::vector_larger_than_max_size__
mov dword [ebp - 0x48], 0xffffffff
call fcn.004787a4
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x415d8f
cmp dword [ebp - 0x60], 0
je 0x415d7d
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call fcn.00476e68
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
mov dword [ebp - 0x48], 0xffffffff
call fcn.0040754c
sub eax, 1
je 0x415d7d
sub eax, 1
je 0x415d7d
sub eax, 1
je 0x415d7d
ud2
Function at 0x45e428
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x1c
mov ecx, dword [ecx]
mov ebx, dword [ebp + 8]
mov eax, ecx
not eax
test ax, 0x101
jne 0x45e446
add dword [ebx + 8], 0xc
mov al, byte [esi]
mov byte [ebp - 0x19], al
test al, al
jns 0x45e470
xor edx, edx
test byte [esi + 1], 2
je 0x45e462
mov eax, dword [ebx + 0x14]
mov edi, 0x64
cdq
idiv edi
mov eax, dword [esi + 4]
sub eax, 0x13
imul eax, eax, 0x64
add eax, edx
mov dword [ebx + 0x14], eax
and cx, 0x402
cmp cx, 0x400
jne 0x45e507
mov al, byte [ebp - 0x19]
not eax
test al, 0x18
je 0x45e4e8
test byte [ebp - 0x19], 4
je 0x45e4e8
mov eax, dword [ebx + 0x14]
add eax, 0x76c
call fcn.004516b8
mov edi, dword [ebx + 0x1c]
movzx eax, al
mov edx, eax
mov dword [ebp - 0x20], eax
xor eax, eax
neg edx
and edx, 0x1a
movzx ecx, word [edx + eax*2 + 0x4823c0]
cmp ecx, edi
jg 0x45e4bd
inc eax
jmp 0x45e4ae
test byte [ebp - 0x19], 8
jne 0x45e4c9
lea edx, [eax - 1]
mov dword [ebx + 0x10], edx
test byte [ebp - 0x19], 0x10
jne 0x45e4e5
imul edx, dword [ebp - 0x20], 0xd
lea eax, [eax + edx - 1]
movzx eax, word [eax + eax + 0x4823c0]
sub edi, eax
inc edi
mov dword [ebx + 0xc], edi
or byte [esi], 0x18
mov al, byte [esi]
mov edx, dword [ebx + 0x10]
mov byte [ebp - 0x19], al
test al, 8
jne 0x45e4f9
cmp edx, 0xb
ja 0x45e507
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x14]
call fcn.00450fd8
mov dword [ebx + 0x18], eax
mov eax, dword [esi]
and ax, 0x404
cmp ax, 0x400
jne 0x45e548
mov edi, dword [ebx + 0x10]
test byte [ebp - 0x19], 8
jne 0x45e521
cmp edi, 0xb
ja 0x45e548
mov eax, dword [ebx + 0x14]
add eax, 0x76c
call fcn.004516b8
mov edx, dword [ebx + 0xc]
movzx eax, al
imul eax, eax, 0xd
add eax, edi
movzx eax, word [eax + eax + 0x4823c0]
lea eax, [edx + eax - 1]
mov dword [ebx + 0x1c], eax
test byte [ebp - 0x19], 0x60
je 0x45e60d
test byte [ebp - 0x19], 2
je 0x45e60d
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x20], eax
test byte [ebp - 0x19], 4
jne 0x45e5b2
mov al, byte [ebp - 0x19]
mov ecx, 1
xor edx, edx
shr al, 5
and eax, 1
xor eax, 1
mov edi, eax
mov eax, dword [ebp - 0x20]
call fcn.00450fd8
mov ecx, 7
sub eax, edi
mov edx, eax
mov eax, ecx
sub eax, edx
cdq
idiv ecx
mov al, byte [esi + 2]
and eax, 0x3f
dec eax
imul eax, eax, 7
lea esi, [edx + eax]
mov eax, dword [ebx + 0x18]
sub eax, edi
add eax, 7
cdq
idiv ecx
add esi, edx
mov dword [ebx + 0x1c], esi
mov al, byte [ebp - 0x19]
not eax
test al, 0x18
je 0x45e60d
mov eax, dword [ebp - 0x20]
add eax, 0x76c
call fcn.004516b8
xor ecx, ecx
movzx edx, al
mov eax, dword [ebx + 0x1c]
mov esi, edx
neg esi
and esi, 0x1a
movzx edi, word [esi + ecx*2 + 0x4823c0]
cmp edi, eax
jg 0x45e5e6
inc ecx
jmp 0x45e5d7
test byte [ebp - 0x19], 8
jne 0x45e5f2
lea esi, [ecx - 1]
mov dword [ebx + 0x10], esi
test byte [ebp - 0x19], 0x10
jne 0x45e60d
imul edx, edx, 0xd
lea edx, [ecx + edx - 1]
movzx edx, word [edx + edx + 0x4823c0]
sub eax, edx
inc eax
mov dword [ebx + 0xc], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1a0c1a44
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x77a02f1
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x12cf673
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x12cf690
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x12cf681
add dl, dl
jne 0x12cf69b
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x12cf6e7
xor eax, eax
add dl, dl
jne 0x12cf6a8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x12cf784
add dl, dl
jne 0x12cf6b7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12cf6c2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12cf6cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12cf6d8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x12cf6e2
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x12cf687
mov eax, 1
add dl, dl
jne 0x12cf6f5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12cf700
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12cf6ec
sub eax, 2
jne 0x12cf72f
mov ecx, 1
add dl, dl
jne 0x12cf715
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x12cf720
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12cf70c
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12cf687
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x12cf746
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x12cf751
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12cf73d
cmp eax, 0x7d00
jae 0x12cf774
cmp eax, 0x500
jb 0x12cf76f
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12cf687
cmp eax, 0x7f
ja 0x12cf777
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12cf687
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x12cf7a0
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12cf687
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8