joyce8/EMBER2024-capa huggingface dataset:
Function at 0x896ba8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x896c6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x8d2200]
cmp byte [eax], 0
jne 0x896c38
mov byte [0x196ddec], 0
mov eax, ebx
call fcn.005e3454
xor edx, edx
mov eax, ebx
call fcn.005def7c
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e7e4c
mov al, 1
call fcn.0084d8c4
mov eax, dword [0x8d22d4]
cmp dword [eax], 0
je 0x896c2a
mov eax, dword [0x8d22d4]
mov eax, dword [eax]
cmp byte [eax + 0x2f6], 1
jne 0x896c2a
mov eax, dword [0x8d2200]
cmp byte [eax], 0
jne 0x896c2a
push 9
mov eax, dword [0x8d22d4]
mov eax, dword [eax]
call fcn.0053e644
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e8470
jmp 0x896c64
xor eax, eax
call fcn.0084d8c4
mov eax, ebx
call fcn.005e344c
mov dl, 1
mov eax, ebx
call fcn.005def7c
push 0
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x896c78
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x897834
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x8978e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x196ddec], 1
mov eax, dword [0x8d2200]
cmp byte [eax], 0
jne 0x8978b1
cmp byte [0x196ddec], 1
jne 0x8978a3
mov eax, ebx
call fcn.005e344c
mov dl, 1
mov eax, ebx
call fcn.005def7c
push 0
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x8d26e4]
cmp byte [eax], 0
jne 0x89789a
mov al, 1
call fcn.0084d8c4
mov byte [0x196ddfc], 1
jmp 0x8978d6
mov dl, 1
mov eax, dword [0x196dd50]
call fcn.005def7c
jmp 0x8978d6
mov eax, ebx
call fcn.005e344c
mov dl, 1
mov eax, ebx
call fcn.005def7c
push 0
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8978ea
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x89b860
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov dword [esp], eax
mov si, 3
mov ebx, dword [esp]
mov eax, ebx
test eax, eax
je 0x89b87a
mov eax, dword [eax - 4]
mov edx, ebp
xor ecx, ecx
xchg edx, eax
call fcn.0040c438
mov eax, ebx
test eax, eax
je 0x89b88d
mov eax, dword [eax - 4]
mov edi, eax
test edi, edi
jle 0x89b8c7
mov ebx, 1
mov eax, ebp
call fcn.0040be88
mov edx, dword [esp]
movzx edx, byte [edx + ebx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add si, ax
lea eax, [esi + esi*2]
mov esi, eax
inc ebx
dec edi
jne 0x89b898
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x89b8d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov dword [esp + 4], edx
mov word [esp], ax
movzx esi, word [esp]
mov ebx, dword [esp + 4]
mov eax, ebx
test eax, eax
je 0x89b8f2
mov eax, dword [eax - 4]
mov edx, ebp
xor ecx, ecx
xchg edx, eax
call fcn.0040c438
mov eax, ebx
test eax, eax
je 0x89b905
mov eax, dword [eax - 4]
mov edi, eax
test edi, edi
jle 0x89b940
mov ebx, 1
mov eax, ebp
call fcn.0040be88
mov edx, dword [esp + 4]
movzx edx, byte [edx + ebx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add si, ax
imul si, word [esp]
inc ebx
dec edi
jne 0x89b910
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x8a3c18
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
xor ebx, ebx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov edi, eax
test edi, edi
je 0x8a3c6a
push 0xf01ff
push 0x8a3c74
mov ebp, edi
push ebp
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x8a3c64
push esp
mov ebx, esi
push ebx
call sub.advapi32.dll_QueryServiceStatus
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [esp + 4], 4
sete bl
push ebp
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x8a3c94
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x8a3e32
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
call fcn.007506d8
test al, al
jne 0x8a3e15
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x8a3dae
push 0xf01ff
push 0x8a3e44
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
setne byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
je 0x8a3da5
lea eax, [ebp - 0x20]
push eax
push 0
push 0
mov ebx, dword [ebp - 0x18]
push ebx
call sub.advapi32.dll_QueryServiceConfigW
mov eax, dword [ebp - 0x20]
call fcn.0040712c
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x8a3d95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ebx
call sub.advapi32.dll_QueryServiceConfigW
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x1c]
call fcn.0040c884
mov edx, 0x8a3e70
mov eax, dword [ebp - 8]
call fcn.0042f178
test eax, eax
jne 0x8a3d7d
lea eax, [ebp - 8]
mov edx, 0x8a3e94
call fcn.0040bcec
lea eax, [ebp - 0xc]
mov edx, 0x8a3eb0
call fcn.0040bcec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8a3d9c
mov eax, dword [ebp - 0x1c]
call fcn.0040717c
pop eax
jmp eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp byte [ebp - 0xd], 0
je 0x8a3e15
mov dword [ebp - 0x20], pe_nt_image_headers32
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.0040c9b0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
call sub.advapi32.dll_GetUserNameW
mov eax, dword [ebp - 4]
call fcn.0040c824
call fcn.0040bde4
lea edx, [ebp - 4]
xchg edx, eax
call fcn.0040c9b0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0042f178
test eax, eax
je 0x8a3e10
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042f178
test eax, eax
je 0x8a3e10
xor eax, eax
jmp 0x8a3e12
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8a3e39
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b914
pop eax
jmp eax
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x417f70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
jmp 0x417f8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417f91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417f80
mov eax, 1
add ebx, ebx
jne 0x417fa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417f98
jne 0x417fb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417f98
xor ecx, ecx
sub eax, 3
jb 0x417fc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41803a
mov ebp, eax
add ebx, ebx
jne 0x417fd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418004
inc ecx
add ebx, ebx
jne 0x417ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417fe5
jne 0x418001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417fe5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418024
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418015
jmp 0x417f86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418024
add edi, ecx
jmp 0x417f86
pop esi
mov edi, esi
mov ecx, 0x315
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418042
cmp byte [edi], 4
jne 0x418042
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418047
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x4180bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418074
mov ecx, edi
jns 0x4180a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1807c]
or eax, eax
je 0x4180b9
mov dword [ebx], eax
add ebx, 4
jmp 0x418091
call dword [esi + 0x1808c]
mov ebp, dword [esi + 0x18080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4180f3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x88c008], 0x8088405
inc edx
mov dword [ebx + 0x88c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd18
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd31
add dl, dl
jne 0x41cd54
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cda5
xor eax, eax
add dl, dl
jne 0x41cd61
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce42
add dl, dl
jne 0x41cd70
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd7b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd86
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd91
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cd9b
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd40
mov eax, 1
add dl, dl
jne 0x41cdb3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdbe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdaa
sub eax, ebx
mov ebx, 1
jne 0x41cdf1
mov ecx, 1
add dl, dl
jne 0x41cdd7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cde2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdce
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce08
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce13
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdff
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ce63
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd40
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e558
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x874a17
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e609
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e5f2
test esi, esi
jbe 0x41e609
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088e4
test eax, eax
jne 0x41e5e4
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e609
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e5c1
jmp 0x41e609
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e609
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x874a1e
ret
Function at 0x41ee60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x87540f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41ee9b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eeb4
lea eax, [ebp - 0x10]
mov edx, dword [0x88e270]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eec7
lea eax, [ebp - 0x10]
mov edx, dword [0x88e270]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eed3
adc edx, 0
mov edx, dword [edx*4 + 0x88d0e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41efe1
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d74
test eax, eax
je 0x41efd4
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41efd4
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dd4
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d74
test eax, eax
je 0x41efd4
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41efd4
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41efd4
cmp dx, 0x150
ja 0x41efd4
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d74
test eax, eax
je 0x41efd4
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41efd4
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eff9
inc ebx
cmp ebx, 0x19
jne 0x41ee8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x875416
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x802aa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x710015
lea edi, [esi - 0x30f015]
mov dword [edi + 0x3cb470], 0x99eb0fa5
push edi
or ebp, 0xffffffff
jmp 0x802aca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x802ad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x802ac0
mov eax, 1
add ebx, ebx
jne 0x802ae3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x802af4
jne 0x802b13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x802b13
dec eax
add ebx, ebx
jne 0x802b00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x802ad8
add ebx, ebx
jne 0x802b0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x802b65
xor ecx, ecx
sub eax, 3
jb 0x802b2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x802b9a
sar eax, 1
mov ebp, eax
jmp 0x802b36
add ebx, ebx
jne 0x802b36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x802b04
inc ecx
add ebx, ebx
jne 0x802b44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x802b04
add ebx, ebx
jne 0x802b51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x802b46
jne 0x802b62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x802b46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x802b84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x802b76
jmp 0x802ac6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x802b84
add edi, ecx
jmp 0x802ac6
pop esi
mov edi, esi
mov ecx, 0x10448
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x802ba2
cmp byte [edi], 0x37
jne 0x802ba2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x802ba7
lea edi, [esi + 0x3f0000]
mov eax, dword [edi]
or eax, eax
je 0x802c16
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x402000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x802bd4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402108]
or eax, eax
je 0x802c10
mov dword [ebx], eax
add ebx, 4
jmp 0x802bf1
call dword [esi + 0x402104]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x802c47
cmp al, 0xef
ja 0x802c3a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x802c1c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x802c29
mov ebp, dword [esi + 0x40210c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x402ca2]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x802c93
sub esp, 0xffffff80
jmp 0x4014a0
Function at 0xa7a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a7a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa7a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7a06a
add dl, dl
jne 0xa7a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7a0dc
xor eax, eax
add dl, dl
jne 0xa7a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7a17d
add dl, dl
jne 0xa7a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa7a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa7a075
mov eax, 1
add dl, dl
jne 0xa7a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa7a0e1
sub eax, ebx
mov ebx, 1
jne 0xa7a128
mov ecx, 1
add dl, dl
jne 0xa7a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa7a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa7a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa7a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa7a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa7a136
cmp eax, 0x7d00
jae 0xa7a16d
cmp eax, 0x500
jb 0xa7a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7a075
cmp eax, 0x7f
ja 0xa7a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa7a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa7a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405a73
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [ebx]
sub ebx, dword [ebx]
adc dword [edx], ecx
adc dword [ebx], ecx
lcall 8, 0x7b020513
add byte [ecx + edx], al
add al, 0x11
add eax, 0x306f
or ah, byte [esi]
adc dword [ebx], ecx
pop ss
pop eax
adc ecx, dword [ebx]
adc dword [ebx], ecx
adc dword [edx], ecx
mov gs, word [ecx + 0x32]
fnstsw word [eax]
mov eax, dword [0x8000000]
jb 0x405a83
push es
add byte [eax + 0x17], dh
outsd dx, dword [esi]
and eax, 0x390a0000
nop
add byte [eax], al
add byte [eax], cl
or byte [edi], bl
cmp ch, byte [edi + 0x26]
add byte [eax], al
or dl, byte [edi]
pop eax
outsd dx, dword [esi]
and al, 0
add byte [edx], cl
adc eax, dword [esi]
adc dword [esi], eax
jb 0x405aa3
push es
add byte [eax + 0x6f], dh
add byte cs:[eax], al
or dl, byte [edi]
outsd dx, dword [esi]
das
add byte [eax], al
or dl, byte [ebx]
pop es
adc dword [edi], eax
adc ecx, dword [esi + edx]
adc ecx, dword [0xc11202b]
adc dword [0x208139a], ecx
jnp 0x405af2
add byte [eax], al
add al, 0x11
or byte [edi + 0x31], ch
add byte [eax], al
or ch, byte [edi + 0x30]
add byte [eax], al
or ah, byte [esi]
adc dword [0xd135817], ecx
adc dword [0x698e0c11], ecx
xor bl, al
sub esi, dword [edi]
pop es
adc dword [esi + ecx*4], ecx
imul esi, dword [edx], 0x7372bd8
jb 0x405b01
push es
add byte [eax + 0x6f], dh
jo 0x405b7f
xor al, byte [eax]
add byte [edx], cl
sub al, 0x28
pop es
jb 0x405b0e
push es
add byte [eax + 0x6f], dh
add byte cs:[eax], al
or bl, byte [eax]
outsd dx, dword [esi]
xor eax, dword [eax]
add byte [edx], cl
adc ecx, dword [ecx]
add bh, byte [ebx + 0xa]
add byte [eax], al
add al, 0x11
or dword [esi], edx
lcall 0x346f, 0x9a170911
add byte [eax], al
or ch, byte [ebx]
add dl, byte [esi]
sub al, byte [esi]
pop ss
pop eax
or al, byte [esi]
add ecx, dword [esi - 0x29ac097]
invalid
add byte [eax + 0x28], dh
sbb byte [eax], al
add byte [edx], cl
jge 0x405b95
or ch, byte [0xd7b020c]

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219