joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bc060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
cmp eax, ecx
je 0x6bc20e
test al, 7
jne 0x6bc20e
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x14]
cmp ecx, 1
jne 0x6bc135
cmp eax, 8
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov dword [esp + 0x20], ecx
jb 0x6bc12c
mov esi, dword [ebp + 0xc]
add esi, 0xfffffff9
shr eax, 3
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, edi
call fcn.006bb700
mov ecx, dword [esp + 0x20]
xor dword [esp + 0x18], ecx
xor dword [esp + 0x14], ebx
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.006bb780
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add dword [ebp + 8], 8
add esi, 8
mov byte [esi + 6], cl
mov edx, ecx
shr edx, 8
mov byte [esi + 5], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 4], dl
mov dword [esp + 0x20], ecx
shr ecx, 0x18
mov byte [esi + 3], cl
mov ecx, eax
mov byte [esi + 2], al
mov edx, eax
shr ecx, 8
shr edx, 0x10
mov ebx, eax
mov byte [esi + 1], cl
shr eax, 0x18
sub dword [esp + 0x10], 1
mov byte [esi], dl
mov byte [esi - 1], al
jne 0x6bc0b7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ecx, 2
jne 0x6bc1bc
cmp eax, 8
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jb 0x6bc12c
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
shr eax, 3
mov dword [esp + 0x10], eax
mov edi, edi
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.006bb780
lea ecx, [esp + 0x14]
push ecx
push ebx
mov ecx, edi
call fcn.006bb700
mov ecx, dword [esp + 0x18]
xor ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x1c]
add esi, 8
push esi
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ecx
push edx
mov ecx, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
call fcn.006bbe80
add ebx, 8
sub dword [esp + 0x10], 1
jne 0x6bc160
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 8
jb 0x6bc12c
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
shr eax, 3
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push ebx
mov ecx, edi
call fcn.006bb700
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.006bb780
add esi, 8
push esi
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.006bbe80
add ebx, 8
sub dword [esp + 0x10], 1
jne 0x6bc1d2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0x9212a0
call fcn.0074c741
push 0x96b598
lea ecx, [esp + 0x20]
push ecx
call fcn.0074cb18
int3
Function at 0x6bc240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
cmp eax, ecx
je 0x6bc40d
test al, 7
jne 0x6bc40d
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x14]
cmp ecx, 1
jne 0x6bc331
cmp eax, 8
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov dword [esp + 0x28], ecx
jb 0x6bc328
mov esi, dword [ebp + 0xc]
add esi, 0xfffffff9
shr eax, 3
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, edi
call fcn.006bb700
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], ecx
push eax
mov ecx, edi
mov dword [esp + 0x24], edx
call fcn.006bbb00
mov ecx, dword [esp + 0x18]
xor ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
add dword [ebp + 8], 8
add esi, 8
mov dword [esp + 0x28], edx
mov byte [esi + 6], cl
mov edx, ecx
shr edx, 8
mov byte [esi + 5], dl
mov edx, ecx
xor eax, ebx
mov ebx, dword [esp + 0x1c]
shr edx, 0x10
mov byte [esi + 4], dl
mov dword [esp + 0x18], ecx
shr ecx, 0x18
mov byte [esi + 3], cl
mov ecx, eax
mov byte [esi + 2], al
mov edx, eax
shr ecx, 8
shr edx, 0x10
mov dword [esp + 0x14], eax
mov byte [esi + 1], cl
shr eax, 0x18
sub dword [esp + 0x10], 1
mov byte [esi], dl
mov byte [esi - 1], al
jne 0x6bc297
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ecx, 2
jne 0x6bc3bb
cmp eax, 8
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jb 0x6bc328
mov ebx, dword [ebp + 0xc]
shr eax, 3
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.006bb700
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call fcn.006bb780
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, eax
xor eax, dword [esp + 0x1c]
mov esi, ecx
xor ecx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
add ebx, 8
push ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], ecx
push eax
mov ecx, edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], esi
call fcn.006bbe80
add dword [ebp + 8], 8
sub dword [esp + 0x10], 1
jne 0x6bc357
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 8
jb 0x6bc328
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
shr eax, 3
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x14]
push ecx
push ebx
mov ecx, edi
call fcn.006bb700
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.006bbb00
add esi, 8
push esi
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.006bbe80
add ebx, 8
sub dword [esp + 0x10], 1
jne 0x6bc3d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0x9212a0
call fcn.0074c741
push 0x96b598
lea edx, [esp + 0x28]
push edx
call fcn.0074cb18
int3
Function at 0x6bc4b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
push 0x101
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
mov edi, ecx
xor esi, esi
call fcn.0074d440
push 0x101
lea ecx, [esp + 0x120]
push ebx
push ecx
call fcn.0074d440
mov eax, dword [edi + 0x104]
add esp, 0x18
jmp 0x6bc4f0
cmp esi, eax
jne 0x6bc4f6
xor esi, esi
mov dl, byte [esi + edi]
mov byte [esp + ebx + 0xc], bl
mov byte [esp + ebx + 0x110], dl
add ebx, 1
add esi, 1
cmp ebx, 0x100
jb 0x6bc4f0
xor esi, esi
xor eax, eax
jmp 0x6bc520
mov cl, byte [esp + eax + 0xc]
movzx edx, byte [esp + eax + 0x110]
movzx ebx, cl
add ebx, esi
add edx, ebx
and edx, 0xff
mov esi, edx
movzx edx, byte [esp + esi + 0xc]
mov byte [esp + eax + 0xc], dl
add eax, 1
cmp eax, 0x100
mov byte [esp + esi + 0xc], cl
jb 0x6bc520
mov edx, dword [esp + 0x220]
xor edi, edi
xor esi, esi
test edx, edx
jle 0x6bc5ba
mov ecx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x21c]
sub ebp, ecx
add esi, 1
and esi, 0xff
mov al, byte [esp + esi + 0x10]
movzx ebx, al
add ebx, edi
and ebx, 0xff
mov edi, ebx
movzx ebx, byte [esp + edi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + edi + 0x10], al
movzx ebx, byte [esp + esi + 0x10]
add ebx, eax
and ebx, 0xff
movzx eax, byte [esp + ebx + 0x10]
xor al, byte [ecx + ebp]
add ecx, 1
sub edx, 1
mov byte [ecx - 1], al
jne 0x6bc572
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x208
ret 0xc
Function at 0x6bf420
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push edi
mov edi, ecx
cmp byte [edi + 4], 0
jne 0x6bf449
push 0x98a0fc
lea ecx, [esp + 8]
call fcn.0074c741
push 0x96b598
lea eax, [esp + 8]
push eax
call fcn.0074cb18
xor edx, edx
cmp dword [edi + 0x3cc], edx
jle 0x6bf476
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
lea esp, [esp]
mov cl, byte [esi]
xor byte [eax], cl
add edx, 1
add esi, 1
add eax, 1
cmp edx, dword [edi + 0x3cc]
jl 0x6bf460
pop esi
pop edi
add esp, 0xc
ret 8
Function at 0x6ee420
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xca
jne 0x6ee47d
mov eax, dword [ebp + 8]
push eax
call fcn.006f62f0
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0
je 0x6ee473
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xcf
mov eax, 1
jmp 0x6ee5af
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xcb
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcb
jne 0x6ee566
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1b4]
cmp dword [ecx + 0x10], 0
je 0x6ee552
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x6ee4c1
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
call dword [edx]
add esp, 4
cmp esi, esp
call fcn.00753501
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1b4]
call dword [edx]
add esp, 4
cmp esi, esp
call fcn.00753501
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6ee4ec
xor eax, eax
jmp 0x6ee5af
cmp dword [ebp - 8], 2
jne 0x6ee4f4
jmp 0x6ee552
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x6ee54d
cmp dword [ebp - 8], 3
je 0x6ee509
cmp dword [ebp - 8], 1
jne 0x6ee54d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
add edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [eax + 4]
cmp eax, dword [edx + 8]
jl 0x6ee54d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
add edx, dword [eax + 0x140]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [eax + 8], edx
jmp 0x6ee4a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x90]
mov dword [eax + 0x98], edx
jmp 0x6ee5a3
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x6ee5a3
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ecx + 0x14], 0x14
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x18], edx
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx]
add esp, 4
cmp esi, esp
call fcn.00753501
mov eax, dword [ebp + 8]
push eax
call fcn.006ee5d0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00753501
mov esp, ebp
pop ebp
ret
Function at 0x6ee5d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x6ee62c
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1a4]
call dword [edx]
add esp, 4
cmp esi, esp
call fcn.00753501
mov eax, dword [ebp + 8]
mov dword [eax + 0x8c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xcc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1a4]
cmp dword [ecx + 8], 0
je 0x6ee72b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x8c]
cmp edx, dword [ecx + 0x74]
jae 0x6ee6e2
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x6ee696
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x8c]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x74]
mov dword [ecx + 8], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
call dword [edx]
add esp, 4
cmp esi, esp
call fcn.00753501
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x8c]
mov dword [ebp - 8], ecx
mov esi, esp
push 0
mov eax, dword [ebp + 8]
add eax, 0x8c
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1a8]
call dword [eax + 4]
add esp, 0x10
cmp esi, esp
call fcn.00753501
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x8c]
cmp ecx, dword [ebp - 8]
jne 0x6ee6dd
xor eax, eax
jmp 0x6ee748
jmp 0x6ee63f
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1a4]
call dword [edx + 4]
add esp, 4
cmp esi, esp
call fcn.00753501
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1a4]
call dword [edx]
add esp, 4
cmp esi, esp
call fcn.00753501
mov eax, dword [ebp + 8]
mov dword [eax + 0x8c], 0
jmp 0x6ee62c
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x44], 0
setne cl
add ecx, 0xcd
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], ecx
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00753501
mov esp, ebp
pop ebp
ret
Function at 0x739dff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x739e24
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x739e3c
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x739e6b
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x739eaa
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x739f7e
sub edx, 0x10000
js 0x739f7e
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x739e90
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x739e90
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x739f01
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x739efe
add edx, 8
jne 0x739ee5
jmp 0x739f6f
add edx, 4
test eax, 0xffff
jne 0x739f0e
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x739f6f
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x739f42
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x739e90
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x739f7e
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x739e90
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x739f8f
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x74efd1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x74f00e
cmp dword [ebp + 0x14], edi
je 0x74f00e
cmp ecx, edi
jne 0x74f015
call fcn.007587a0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0074ca7a
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x74f029
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x74f04a
cmp ebx, 0xffffffff
je 0x74f039
push ebx
push edi
push ecx
call fcn.0074d440
add esp, 0xc
cmp esi, edi
je 0x74eff6
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x74eff6
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x74f066
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x74f06d
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x74f15e
test word [esi + 0xc], 0x10c
je 0x74f0c1
mov eax, dword [esi + 4]
test eax, eax
je 0x74f0c1
jl 0x74f1bf
cmp ebx, eax
mov edi, ebx
jb 0x74f092
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x74f166
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0074c65a
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x74f156
cmp ebx, dword [ebp - 0xc]
jb 0x74f12e
cmp dword [ebp - 0xc], 0
je 0x74f0eb
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x74f0e0
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x74f0e7
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x74f0f6
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x74f0f6
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x74f192
push eax
push dword [ebp - 8]
push esi
call fcn.0075e184
pop ecx
push eax
call fcn.0075f91a
add esp, 0xc
test eax, eax
je 0x74f1d1
cmp eax, 0xffffffff
je 0x74f1bf
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x74f156
push esi
call fcn.0075de24
cmp eax, 0xffffffff
pop ecx
je 0x74f1c3
cmp dword [ebp - 4], 0
je 0x74f192
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x74f075
mov eax, dword [ebp + 0x14]
jmp 0x74f010
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x74f17d
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0074d440
add esp, 0xc
call fcn.007587a0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x74f006
cmp dword [ebp + 0xc], 0xffffffff
je 0x74f1a8
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0074d440
add esp, 0xc
call fcn.007587a0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x74f006
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x74f010
or dword [esi + 0xc], 0x10
jmp 0x74f1c3
Function at 0x403e76
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b760
cmp edx, dword [eax]
je 0x403e98
add eax, 8
inc ecx
cmp eax, 0x40b7f0
jl 0x403e89
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b760]
jne 0x403fc6
mov eax, dword [0x40e6d8]
cmp eax, 1
je 0x403fa0
test eax, eax
jne 0x403ec9
cmp dword [0x40b694], 1
je 0x403fa0
cmp edx, 0xfc
je 0x403fc6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403f00
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00406370
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406460
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x403f43
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4098b8
push edi
call fcn.00407c30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00406370
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406380
lea eax, [ebp - 0xa0]
push 0x409898
push eax
call fcn.00406380
push dword [esi + 0x40b764]
lea eax, [ebp + 8]
lea esi, [esi + 0x40b764]
push 0
push eax
push dword [esi]
call fcn.00406460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x8ccbad
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8cc92e
sub edi, 1
sub ebx, 0xa49db075
call fcn.008ccbf8
and ebx, edi
xor dword [ecx], eax
dec ebx
inc ebx
push 0x84475af9
pop edi
add ecx, 1
or edi, ebx
mov ebx, 0x67a792d5
mov ebx, 0x3b39ea88
cmp ecx, edx
jne fcn.008ccbad
and edi, edi
sub edi, 0x6fadeef9
ret
Function at 0x986058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009861a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x98607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98606a
add dl, dl
jne 0x986089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9860dc
xor eax, eax
add dl, dl
jne 0x986096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98617d
add dl, dl
jne 0x9860a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9860b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9860bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9860c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9860d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x986075
mov eax, 1
add dl, dl
jne 0x9860ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9860f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9860e1
sub eax, ebx
mov ebx, 1
jne 0x986128
mov ecx, 1
add dl, dl
jne 0x98610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x986119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x986105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x986075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x98613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x98614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x986136
cmp eax, 0x7d00
jae 0x98616d
cmp eax, 0x500
jb 0x986168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x986075
cmp eax, 0x7f
ja 0x986170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x986075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x98619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x986075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10