joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b330
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x42b3f0
mov esi, esp
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42b39e
push str.hAdvAPI32___0
push 0x75dc60
push 0
push 0x29c
push str.f:dd_vctools_vc7libs_ship_atlmfcinclude_atltransactionmanager.h
push 2
call fcn.006c34d0
add esp, 0x18
cmp eax, 1
jne 0x42b39e
int3
cmp dword [ebp - 8], 0
jne 0x42b3ab
mov eax, 1
jmp 0x42b417
mov esi, esp
push str.RegDeleteKeyTransactedW
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42b3ee
mov esi, esp
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0xc]
cmp esi, esp
call fcn.006c7eb0
jmp 0x42b417
jmp 0x42b412
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x42b412
mov esi, esp
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp esi, esp
call fcn.006c7eb0
jmp 0x42b417
mov eax, 1
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 8
Function at 0x43d190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call fcn.00431590
mov dword [ebp - 0x10], eax
mov esi, esp
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0x14], eax
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43d219
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43d233
push 0x110
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcdlgcore.cpp
call fcn.00442350
test eax, eax
je 0x43d233
int3
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0043d280
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00471c20
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp esi, esp
call fcn.006c7eb0
mov eax, dword [ebp - 0x18]
pop esi
add esp, 0x18
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 8

Function at 0x460e20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.00408ef0
movzx eax, al
test eax, eax
jne 0x460e6c
mov ecx, dword [ebp + 8]
call fcn.00406050
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.006c7eb0
test eax, eax
jne 0x460e6c
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x90
call fcn.0058cea0
mov eax, 1
pop esi
add esp, 4
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 4
Function at 0x48e5a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jne 0x48e5cc
call fcn.00431590
mov dword [ebp + 0xc], eax
mov esi, esp
push 0x71d7b8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48e5f8
xor eax, eax
jmp 0x48e695
mov esi, esp
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48e61c
xor eax, eax
jmp 0x48e695
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x48e64f
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp esi, esp
call fcn.006c7eb0
xor eax, eax
jmp 0x48e695
mov esi, esp
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp esi, esp
call fcn.006c7eb0
push eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.0048e6b0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00471c20
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp esi, esp
call fcn.006c7eb0
mov eax, dword [ebp - 0x14]
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 8
Function at 0x5653d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x565404
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x56547a
mov esi, esp
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x565431
call fcn.004437c0
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x565459
call fcn.004437c0
mov esi, esp
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x56547a
call fcn.004437c0
call fcn.0045bb30
cmp dword [eax + 0x3c], 0
je 0x565494
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00564100
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00565900
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x7c], 0
je 0x5654cd
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, esp
call fcn.006c7eb0
mov eax, dword [ebp - 4]
mov dword [eax + 0x7c], 0
cmp dword [ebp - 0x14], 0
je 0x5654e2
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x7c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 8
Function at 0x5d6bd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x705cbe
mov eax, dword fs:[0]
push eax
sub esp, 8
mov dword [ebp - 0x14], 0xcccccccc
mov dword [ebp - 0x10], 0xcccccccc
mov eax, dword [0x782e08]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00426250
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CMFCToolBarButton.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00406690
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00406690
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.00405ff0
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.004262c0
mov ecx, dword [ebp - 0x10]
call fcn.005d7af0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x18]
mov dword [ecx + 0x3c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.005da990
cmp dword [ebp + 0x10], 0
jne 0x5d6c90
mov dword [ebp - 0x14], 0x75e29c
jmp 0x5d6c96
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00405f80
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x20], 0
je 0x5d6d4e
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x3c], 0
jne 0x5d6d4e
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
je 0x5d6d0c
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x38], 0xffffffff
je 0x5d6cef
push 1
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x38]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
push edx
call fcn.005987e0
mov ecx, eax
call fcn.005987f0
jmp 0x5d6d0a
push 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.005987e0
mov ecx, eax
call fcn.00598730
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], eax
jmp 0x5d6d4e
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x34], 0xffffffff
je 0x5d6d33
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.005987e0
mov ecx, eax
call fcn.005987f0
jmp 0x5d6d4e
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
push eax
call fcn.005987e0
mov ecx, eax
call fcn.00598730
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x64eec0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
call fcn.004407c0
mov esi, esp
push 0xfffffffffffffff0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp esi, esp
call fcn.006c7eb0
and eax, 3
cmp eax, 3
je 0x64ef16
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0064f520
jmp 0x64ef22
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.0064f3f0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x64efa1
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x64ef6f
mov edx, dword [ebp - 0x10]
add edx, 1
mov esi, esp
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0042e780
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.006c7eb0
jmp 0x64ef95
mov esi, esp
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.00406240
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.006c7eb0
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.004258b0
jmp 0x64efdb
mov ecx, dword [ebp + 0x10]
call fcn.00406050
mov esi, esp
push eax
push 0xffffffffffffffff
push 0x14d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.006c7eb0
cmp eax, 0xffffffff
jne 0x64efdb
mov ecx, dword [ebp + 0x10]
call fcn.00406050
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0045e990
push edx
mov ecx, ebp
push eax
lea edx, [0x64f000]
call fcn.006c7e50
pop eax
pop edx
pop esi
add esp, 0x10
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x64f220
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0064f520
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x64f295
mov esi, esp
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
mov esi, esp
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0042e780
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.006c7eb0
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.004258b0
jmp 0x64f2a7
mov ecx, dword [ebp + 0x10]
call fcn.00406050
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0045e990
pop esi
add esp, 8
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405e1a
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x40a350
push edi
xor bl, bl
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov esi, eax
test esi, esi
jne 0x405e34
mov esi, edi
movzx eax, word [esi]
cmp eax, 0x5c
je 0x405e46
cmp eax, 0x2f
je 0x405e46
test ax, ax
jne 0x405e72
mov ebp, eax
xor eax, eax
push edi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405e66
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x405e68
test al, 0x10
je 0x405e79
test bp, bp
je 0x405e77
mov word [esi], bp
add esi, 2
jmp 0x405e34
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret

Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xb065de7
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x22b87766
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5a1121bc
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x324b4b43
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x50e86fb8
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x57527193
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x401346
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x8ceeb1da
jno 0x4012aa
sub ch, bh
mov dh, 0x19
push 0xfc7de7
push 0x142e61
imul eax, esi
cmp ebx, 0xd8e1
jne 0x4012c3
xchg ch, dh
or edx, ecx
mov ebp, 0xef0016f
call 0x401346
lea ebx, [0x3c655d9b]
movsx eax, al
inc ebx
jmp 0x4012e2
cmp edx, 0x3cde
jbe 0x4012f0
xchg dh, bh
add bh, dh
mov dl, ah
not ebx
mov eax, 0x86e
mov dl, 0x34
xor eax, 0x86e
jae 0x401304
test ebx, ecx
xchg bh, dh
test dh, cl
add eax, ebx
mov bl, 0xde
and dl, 0x3c
mov ecx, eax
mov eax, ebp
movsx edx, dx
bswap ebp
cmp bl, 0x58
mov esi, 0xe07
test bl, bh
sub esi, 0xe07
dec ebx
add esi, ecx
cmp ebp, ebx
jno 0x40133d
dec ecx
and ebp, 0xd71fd4ef
inc dh
movzx eax, cl
mov edx, ebp
mov ebp, 0x1c0fcea3
add edi, esi
bswap eax
bswap edi
mov ch, dh
imul esi, ecx, 0xedb72dcb
push 0x188
cmp ebx, 0xd647
jb 0x401363
mov ch, ch
dec edi
test cl, 0x84
pop edi
test dl, ah
imul edi, edi, 7
cmp bl, 0x1a
cmp edx, 0x3a5f
jbe 0x401377
imul ebx, ebp
test eax, 0x8ddb575d
push 0
pop edx
xadd edx, edi
mov eax, edx
xor edx, 0xab8
and edi, 0x555f84ab
xor bl, ah
mov ebx, 0x882d1bf7
movzx ecx, cx
push 0x540
imul edi, edi, 0xda7c788c
pop esi
add esi, 0x1f0
movzx edi, dh
mov ebp, esi
xor ebp, 0xf79
add edx, ebp
imul eax, edi
sub edx, 0x848
dec eax
sbb eax, 0x4e0b6f79
outsd dx, dword [esi]
or ecx, dword [esi - 0x7f]
cli
adc dword [edi], eax
add byte [eax], al
jb 0x40138e
pop edi
cmp ebx, esi
mov al, 0x7a
add ebp, 0x10632
mov esi, edx
sub ebp, 0xda7
movd mm4, edi
sub al, 0x97
imul ecx, ebp
imul ebx, esi
cmp edx, 0x52fc
mov dl, bh
cmp ebx, 0x9d5e
js 0x401409
mov edi, 0x5d2a9c06
mov cl, cl
lea eax, [0x1566]
adc eax, 0x5a2d0000
invalid
add byte [eax], al
imul ebp, esi
imul ecx, ecx
sub eax, 0x6355
bswap ebx
add eax, 0x6354
mov edi, 0x7972304d
imul esi, ebx
cmp eax, 0x133
jae 0x401416
movd ebp, mm4
or dl, bl
inc edx
add ebp, 0x223d
add byte [edi], cl
scasd eax, dword es:[edi]
inc byte [ecx + 0x2d83c5]
add byte [ebp - 0x44f2720f], al
push ecx
cmc
invalid
mov ebx, ecx
jno 0x401461
test al, ch
imul eax, edi, 0xae57ac74
jmp ebp
Function at 0x99768c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9976b3
call fcn.00939c18
mov dword [eax], esi
call fcn.00939c05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093a85a
mov eax, esi
jmp 0x997708
test dword [ebp + 0xc], 0xfffffff9
jne 0x997699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9976e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00939c2b
pop ecx
call fcn.00939c05
mov eax, dword [eax]
jmp 0x997708
test al, 0x10
jne 0x997706
test al, 1
je 0x997706
test byte [ebp + 0xc], 2
je 0x997706
call fcn.00939c18
mov dword [eax], 5
call fcn.00939c05
mov dword [eax], 0xd
jmp 0x9976d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0xd9d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d9d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd9d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd9d06a
add dl, dl
jne 0xd9d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd9d0dc
xor eax, eax
add dl, dl
jne 0xd9d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd9d17d
add dl, dl
jne 0xd9d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd9d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd9d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd9d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd9d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd9d075
mov eax, 1
add dl, dl
jne 0xd9d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd9d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd9d0e1
sub eax, ebx
mov ebx, 1
jne 0xd9d128
mov ecx, 1
add dl, dl
jne 0xd9d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd9d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd9d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd9d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd9d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd9d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd9d136
cmp eax, 0x7d00
jae 0xd9d16d
cmp eax, 0x500
jb 0xd9d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd9d075
cmp eax, 0x7f
ja 0xd9d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd9d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd9d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd9d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10