joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419ad0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [0x428e50]
sub esp, 0x240
cmp eax, ecx
push ebx
push ebp
push esi
push edi
ja 0x419c3d
mov ecx, dword [0x88e0f8]
mov eax, dword [0x428e54]
cmp ecx, eax
ja 0x419c3d
mov edx, dword [esp + 0x254]
lea eax, [esp + 0x150]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x150]
push 0x4290bc
push ecx
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x150]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x419c3d
mov eax, dword [0x88e0f8]
mov bl, 0x2e
inc eax
mov dword [0x88e0f8], eax
test byte [esp + 0x10], 0x10
je 0x419bb9
cmp byte [esp + 0x3c], bl
je 0x419bb9
mov ecx, dword [esp + 0x254]
lea edx, [esp + 0x150]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x150]
push eax
push ecx
call edi
lea edx, [esp + 0x150]
push 0x4273b8
push edx
call edi
mov eax, dword [esp + 0x258]
lea ecx, [esp + 0x150]
inc eax
push eax
push ecx
call fcn.00419ad0
add esp, 8
test eax, eax
jne 0x419c4a
jmp 0x419c0b
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x419c0b
mov dl, byte [esp + eax + 0x39]
lea ecx, [esp + eax + 0x39]
or dl, 0x20
lea esi, [esp + eax + 0x3a]
mov byte [ecx], dl
mov dl, byte [esi]
or dl, 0x20
mov byte [esi], dl
mov dl, byte [esp + eax + 0x3b]
or dl, 0x20
mov byte [esp + eax + 0x3b], dl
cmp byte [esp + eax + 0x38], bl
jne 0x419c0b
cmp byte [ecx], 0x6d
jne 0x419c0b
cmp byte [esi], 0x70
jne 0x419c0b
cmp dl, 0x33
je 0x419c4a
cmp dl, 0x32
je 0x419c4a
cmp dl, 0x31
je 0x419c4a
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, dword [0x88e0f8]
mov edx, dword [0x428e54]
inc ecx
cmp ecx, edx
mov dword [0x88e0f8], ecx
ja 0x419c36
test eax, eax
jne 0x419b55
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x240
ret
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x240
ret
Function at 0x419c70
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x244
push ebp
mov ebp, dword [esp + 0x24c]
push edi
lea eax, [esp + 0x14c]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14c]
push 0x4290bc
push ecx
call edi
lea edx, [esp + 0xc]
lea eax, [esp + 0x14c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x419cca
pop edi
xor eax, eax
pop ebp
add esp, 0x244
ret
push ebx
push esi
xor bl, bl
test byte [esp + 0x14], 0x10
je 0x419d1e
cmp byte [esp + 0x40], 0x2e
je 0x419d1e
lea ecx, [esp + 0x154]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x40]
lea eax, [esp + 0x154]
push edx
push eax
call edi
lea ecx, [esp + 0x154]
push 0x4273b8
push ecx
call edi
lea edx, [esp + 0x154]
push edx
call fcn.00419c70
add esp, 4
jmp 0x419dca
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x419dca
mov dl, byte [esp + eax + 0x3d]
lea ecx, [esp + eax + 0x3d]
or dl, 0x20
lea esi, [esp + eax + 0x3e]
mov byte [ecx], dl
mov dl, byte [esi]
or dl, 0x20
mov byte [esi], dl
mov dl, byte [esp + eax + 0x3f]
or dl, 0x20
mov byte [esp + eax + 0x3f], dl
cmp byte [esp + eax + 0x3c], 0x2e
jne 0x419dca
cmp byte [ecx], 0x6d
jne 0x419dca
cmp byte [esi], 0x70
jne 0x419dca
cmp dl, 0x33
je 0x419d75
cmp dl, 0x32
je 0x419d75
cmp dl, 0x31
jne 0x419dca
mov ecx, dword [0x88e0fc]
push ebp
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
shl eax, 2
mov byte [eax + 0x8340c8], cl
lea ecx, [eax + 0x8340dc]
mov byte [eax + 0x8340c9], bl
mov byte [eax + 0x8340ca], bl
push ecx
mov byte [eax + 0x8340cb], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x88e0fc]
lea edx, [esp + 0x40]
push edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
lea ecx, [eax*4 + 0x8340dc]
push ecx
call edi
inc dword [0x88e0fc]
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419cce
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x244
ret

Function at 0x419e00
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10
mov al, byte [0x8320b8]
lea ecx, [esp]
push ecx
mov byte [esp + 4], al
mov byte [esp + 5], 0x3a
mov byte [esp + 6], 0x5c
mov byte [esp + 7], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x419e55
lea edx, [esp]
push 0
push edx
mov dword [0x88e0f8], 0
call fcn.00419ad0
add esp, 8
test eax, eax
je 0x419e5e
lea eax, [esp]
push eax
call fcn.00419c70
add esp, 4
mov eax, dword [0x88e0fc]
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret
Function at 0x419e70
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x28]
push esi
push 0
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x2c], esi
jne 0x419e9b
xor eax, eax
pop esi
add esp, 0x24
ret
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll__llseek]
push edi
push 2
push 0
push esi
call ebp
push 0
push 0x20
push esi
mov edi, eax
call ebp
lea ecx, [esp + 0x14]
push 0xc
push ecx
push esi
sub edi, 0x20
call dword [sym.imp.KERNEL32.dll__lread]
test eax, eax
je 0x41a042
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
sub edi, 0xc
test eax, eax
mov dword [esp + 0x3c], edi
jne 0x41a042
mov eax, dword [esp + 0x1c]
cmp eax, edi
ja 0x41a042
cmp dword [esp + 0x14], ebx
jne 0x41a018
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esp + 0x1c]
mov edi, eax
push edx
push edi
push esi
call dword [sym.imp.KERNEL32.dll__lread]
test eax, eax
je 0x419ffe
push str.HeroMp3.ini
push 0x100
push 0x91a3e0
push 0x82d6c0
push str.INSTALLPATH
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x419f6b
push 0x100
push 0x91a3e0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4273b8
push 0x91a3e0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
lea eax, [esp + 0x28]
push str._08X.INI
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
push 0x91a3e0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x91a3e0
call dword [sym.imp.KERNEL32.dll__lcreat]
mov esi, eax
cmp esi, 0xffffffff
je 0x419ff2
mov edx, dword [esp + 0x1c]
push edx
push edi
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, ebx
mov ecx, ebx
and eax, 0xffff
lea edx, [esp + 0x24]
shr ecx, 0x10
push eax
push ecx
push str._04X__04X
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x24]
push str.HeroMp3.ini
push 0x91a3e0
push eax
push str.MPXNameFile
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esi, dword [esp + 0x38]
mov dword [esp + 0x10], 1
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [esp + 0x3c]
mov ebp, dword [sym.imp.KERNEL32.dll__llseek]
jmp 0x41a01e
push 1
push eax
push esi
call ebp
sub edi, dword [esp + 0x1c]
je 0x41a042
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x41a042
lea ecx, [esp + 0x14]
push 0xc
push ecx
push esi
call dword [sym.imp.KERNEL32.dll__lread]
test eax, eax
jne 0x419ed1
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x24
ret
Function at 0x41a060
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x110
lea edx, [esp]
push ebx
mov ebx, dword [esp + 0x118]
mov eax, ebx
push ebp
mov ecx, ebx
push esi
and eax, 0xffff
push edi
shr ecx, 0x10
push eax
push ecx
push str._04X__04X
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x10]
push str.HeroMp3.ini
push 0x100
push 0x91a3e0
push 0x82d6c0
push eax
push str.MPXNameFile
call esi
test eax, eax
jne 0x41a24c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x20]
push str.HeroMp3.ini
push ecx
call edi
lea edx, [esp + 0x20]
lea eax, [esp + 0xa0]
push edx
push eax
call edi
lea ecx, [esp + 0xa0]
lea edx, [esp + 0x20]
push ecx
push 0x80
push edx
push 0x82d6c0
push str.INIFile
push str.MPXNameFile
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41a17f
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push 0x100
push 0x91a3e0
push 0x82d6c0
push ecx
push str.MPXNameFile
call esi
test eax, eax
jne 0x41a24c
lea edx, [esp + 0x20]
lea eax, [esp + 0xa0]
push edx
push eax
call ebp
test eax, eax
je 0x41a17f
lea ecx, [esp + 0x20]
lea edx, [esp + 0xa0]
push ecx
push edx
call edi
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x20]
push eax
push 0x80
push ecx
push 0x82d6c0
push str.INIFile
push str.MPXNameFile
call esi
test eax, eax
jne 0x41a10e
lea edx, [esp + 0x20]
push str.HeroMp3.ini
push edx
call edi
lea eax, [esp + 0x20]
lea ecx, [esp + 0xa0]
push eax
push ecx
call edi
lea edx, [esp + 0xa0]
lea eax, [esp + 0x20]
push edx
push 0x80
push eax
push 0x82d6c0
push str.NameItem
push str.MPXNameFile
call esi
test eax, eax
jne 0x41a231
lea ecx, [esp + 0xa0]
lea edx, [esp + 0x20]
push ecx
push 0x80
push edx
push 0x82d6c0
push str.INIFile
push str.MPXNameFile
call esi
test eax, eax
je 0x41a24a
lea eax, [esp + 0x20]
lea ecx, [esp + 0xa0]
push eax
push ecx
call ebp
test eax, eax
je 0x41a24a
lea edx, [esp + 0x20]
lea eax, [esp + 0xa0]
push edx
push eax
call edi
lea ecx, [esp + 0xa0]
lea edx, [esp + 0x20]
push ecx
push 0x80
push edx
push 0x82d6c0
push str.NameItem
push str.MPXNameFile
call esi
test eax, eax
je 0x41a1c1
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.00419e70
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x41a320
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x100
push ebx
push esi
push edi
mov edi, dword [esp + 0x110]
cmp byte [edi + 1], 0x3a
jne 0x41a341
lea eax, [edi + 2]
lea ecx, [esp + 0xc]
push eax
push ecx
jmp 0x41a347
lea edx, [esp + 0xc]
push edi
push edx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call ebx
mov eax, dword [0x82f33c]
mov ecx, dword [0x82f300]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ecx
je 0x41a38b
push 0x91a3e0
lea ecx, [esp + 0x90]
push 0x80
push ecx
lea edx, [esp + 0x18]
push 0x82d6c0
push edx
push str.ChineseGB
call esi
test eax, eax
jne 0x41a3b2
push 0x91a3e0
lea ecx, [esp + 0x90]
push 0x80
push ecx
lea edx, [esp + 0x18]
push 0x82d6c0
push edx
push str.English
call esi
test eax, eax
je 0x41a3bd
lea eax, [esp + 0x8c]
push eax
push edi
call ebx
pop edi
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x41a3d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x100
lea eax, [esp + 0x80]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
mov edi, dword [esp + 0x110]
push edi
push eax
call ebx
mov ecx, dword [0x82f33c]
mov eax, dword [0x82f300]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp ecx, eax
je 0x41a42d
push 0x91a3e0
lea edx, [esp + 0x10]
push 0x80
push edx
lea eax, [esp + 0x98]
push 0x82d6c0
push eax
push str.ChineseGB
call esi
test eax, eax
jne 0x41a454
push 0x91a3e0
lea edx, [esp + 0x10]
push 0x80
push edx
lea eax, [esp + 0x98]
push 0x82d6c0
push eax
push str.English
call esi
test eax, eax
je 0x41a46b
lea ecx, [esp + 0xc]
push ecx
push edi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x100
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x100
ret

Function at 0x41a4d0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x8320a4]
sub esp, 0x80
test eax, eax
push esi
je 0x41a55d
mov eax, dword [0x82f33c]
mov ecx, dword [0x82f300]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ecx
je 0x41a519
push 0x91a3e0
lea ecx, [esp + 8]
push 0x80
push ecx
push 0x82d6c0
push str.DiscName
push str.ChineseGB
call esi
test eax, eax
jne 0x41a53d
push 0x91a3e0
lea ecx, [esp + 8]
push 0x80
push ecx
push 0x82d6c0
push str.DiscName
push str.English
call esi
test eax, eax
je 0x41a55d
mov eax, dword [esp + 0x88]
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
pop esi
add esp, 0x80
ret
xor eax, eax
pop esi
add esp, 0x80
ret
Function at 0x41acc0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x18
mov eax, dword [str.File_1d]
mov ecx, dword [0x428cd4]
push ebx
mov ebx, dword [esp + 0x20]
push esi
xor esi, esi
push ebx
push esi
push str.ITEMNUM
push str.PLAYLIST
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov word [esp + 0x20], si
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, esi
mov dword [0x8320b0], eax
mov dword [0x8320ac], eax
jle 0x41ad4b
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push edi
mov edi, 0x88e320
lea edx, [esp + 0x10]
push esi
lea eax, [esp + 0x20]
push edx
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x1c]
push ebx
push 0x104
push edi
push 0
push ecx
push str.PLAYLIST
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x8320b0]
inc esi
add edi, 0x104
cmp esi, eax
jl 0x41ad10
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x41ede3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4294c0
cmp edx, dword [eax]
je 0x41ee05
add eax, 8
inc ecx
cmp eax, 0x429550
jl 0x41edf6
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4294c0]
jne 0x41ef33
mov eax, dword [0x88e114]
cmp eax, 1
je 0x41ef0d
test eax, eax
jne 0x41ee36
cmp dword [0x4291d8], 1
je 0x41ef0d
cmp edx, 0xfc
je 0x41ef33
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41ee6d
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041f8a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041fb30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41eeb0
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041fb30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x423854
push edi
call fcn.00420ef0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041f8a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041f8b0
lea eax, [ebp - 0xa0]
push 0x423834
push eax
call fcn.0041f8b0
push dword [esi + 0x4294c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041f8b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00420e61
add esp, 0x2c
pop edi
jmp 0x41ef33
lea eax, [ebp + 8]
lea esi, [esi + 0x4294c4]
push 0
push eax
push dword [esi]
call fcn.0041fb30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10094315
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10094324
pop dword [ebp - 0x20]
mov eax, 0xcdffd383
sub eax, 0xbdf6905f
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x8ca0ced0
sub dword [ebp - 0x30], 0x3e4e8985
mov dword [ebp - 0x2c], 0xee1ef04
sub dword [ebp - 0x2c], 0xdcaea2bf
mov dword [ebp - 0x28], 0x79a58ceb
sub dword [ebp - 0x28], 0x2d5948bd
mov dword [ebp - 0x24], 0xb680085f
sub dword [ebp - 0x24], 0xb680085f
lea eax, [ebp - 0x30]
push eax
mov eax, 0x61df575c
add eax, 0xae2c49b8
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x761ab123
sub dword [ebp - 0x30], 0x1a847cd
mov dword [ebp - 0x2c], 0x9a9c92c9
sub dword [ebp - 0x2c], 0x59303154
mov dword [ebp - 0x28], 0x52315765
add dword [ebp - 0x28], 0x113e1507
mov dword [ebp - 0x24], 0x1c7a0474
sub dword [ebp - 0x24], 0x1c7a0474
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x45e8b00a
sub eax, 0x35dd0fde
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a97d
push 0
call eax
mov ecx, 0x5a4b9396
add ecx, 0xa5b4a907
mov edi, eax
mov ebx, 0x90c53270
sub ebx, 0x80b0ce70
add ebx, dword [ebp - 0x20]
mov edx, 0xc28969eb
mov esi, dword [ebx]
sub dword [ebp - 0x10], esi
xor esi, edx
xor dword [ebp - 0xc], ecx
mov dword [edi], esi
xor dword [ebp - 0x1c], esi
add edi, 4
add ebx, 4
loop 0x10094440
add eax, 0xe547
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x11696058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x116961a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1169607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1169606a
add dl, dl
jne 0x11696089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x116960dc
xor eax, eax
add dl, dl
jne 0x11696096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1169617d
add dl, dl
jne 0x116960a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x116960b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x116960bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x116960c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x116960d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11696075
mov eax, 1
add dl, dl
jne 0x116960ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x116960f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x116960e1
sub eax, ebx
mov ebx, 1
jne 0x11696128
mov ecx, 1
add dl, dl
jne 0x1169610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11696119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11696105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11696075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1169613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1169614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11696136
cmp eax, 0x7d00
jae 0x1169616d
cmp eax, 0x500
jb 0x11696168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11696075
cmp eax, 0x7f
ja 0x11696170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11696075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1169619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11696075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10d6610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc93000]
push edi
or ebp, 0xffffffff
jmp 0x10d6632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10d6639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10d6628
mov eax, 1
add ebx, ebx
jne 0x10d664b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10d665c
jne 0x10d667b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10d667b
dec eax
add ebx, ebx
jne 0x10d6668
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10d6640
add ebx, ebx
jne 0x10d6677
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10d66cd
xor ecx, ecx
sub eax, 3
jb 0x10d6693
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10d6702
sar eax, 1
mov ebp, eax
jmp 0x10d669e
add ebx, ebx
jne 0x10d669e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10d666c
inc ecx
add ebx, ebx
jne 0x10d66ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10d666c
add ebx, ebx
jne 0x10d66b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10d66ae
jne 0x10d66ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10d66ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10d66ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10d66de
jmp 0x10d662e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10d66ec
add edi, ecx
jmp 0x10d662e
pop esi
mov edi, esi
mov ecx, 0x302d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10d670a
cmp byte [edi], 0x16
jne 0x10d670a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10d670f
lea edi, [esi + 0xcd0000]
mov eax, dword [edi]
or eax, eax
je 0x10d6787
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1909e64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1909f90]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10d673c
mov ecx, edi
jns 0x10d676b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1909f94]
or eax, eax
je 0x10d6781
mov dword [ebx], eax
add ebx, 4
jmp 0x10d6759
call dword [esi + 0x1909fa4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10d67b8
cmp al, 0xef
ja 0x10d67ab
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10d678d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10d679a
mov ebp, dword [esi + 0x1909f98]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10d67ec
sub esp, 0xffffff80
jmp 0x43cd8d
Function at 0x104f0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104f01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104f007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104f006a
add dl, dl
jne 0x104f0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104f00dc
xor eax, eax
add dl, dl
jne 0x104f0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104f017d
add dl, dl
jne 0x104f00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104f00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104f00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104f00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104f00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104f0075
mov eax, 1
add dl, dl
jne 0x104f00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104f00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104f00e1
sub eax, ebx
mov ebx, 1
jne 0x104f0128
mov ecx, 1
add dl, dl
jne 0x104f010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104f0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104f0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104f0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104f013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104f014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104f0136
cmp eax, 0x7d00
jae 0x104f016d
cmp eax, 0x500
jb 0x104f0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104f0075
cmp eax, 0x7f
ja 0x104f0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104f0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104f019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104f0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10