joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f22e
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f2cb
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f2cb
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f2cb
push 4
push 0xffffffffffffffff
push esi
push 0x40f9e5
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f2cb
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f296
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f2cb
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f2d1
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f2cd

Function at 0x41399f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4139ae
pop dword [ebp - 0x40]
mov eax, 0xa833511f
add eax, 0x580de88f
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x43e8a
push 0
mov eax, 0xb1632c9a
sub eax, 0xb120699e
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xd0a2006f
sub ecx, 0xd0a1b40d
xor esi, esi
add esi, eax
mov edx, 0x38b5801a
add edx, 0xc78f07e6
add edx, dword [ebp - 0x40]
mov ebx, 0x3aa8720b
sub ebx, 0x9cb0c571
xor dword [ebp - 0x14], edx
mov edi, dword [edx]
add dword [ebp - 0x20], ebx
xor edi, ebx
add dword [ebp - 0x34], 0xe8be265c
mov dword [esi], edi
xor dword [ebp - 8], 0xcb021a46
add esi, 0x786867a8
add esi, 0x8797985c
add edx, 4
loop 0x413a0f
add eax, 0x42ee24f5
add eax, 0xbd12ff66
xor ebx, ebx
add ebx, eax
add eax, 0x1cc756c1
add eax, 0xe338a944
mov ecx, 0xed497140
sub ecx, 0xed097140
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x413ca1
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413cb1
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x413cb7
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x413cdf
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x413cc6
mov esi, ecx
jmp 0x413ce2
movzx esi, si
pop edi
cmp cx, si
je 0x413cff
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x413ce3
mov eax, 0x437338
jmp 0x413d07
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40288e
pop dword [ebp - 8]
mov eax, 0x46a51104
add eax, 0xb99b178a
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xb53689e
add dword [ebp - 0x18], 0x42fedcad
mov dword [ebp - 0x14], 0x1c921c37
sub dword [ebp - 0x14], 0xea5ecff2
mov dword [ebp - 0x10], 0xa6a41f04
sub dword [ebp - 0x10], 0x5a57dad6
mov dword [ebp - 0xc], 0xc8bc1e9a
add dword [ebp - 0xc], 0x3743e166
lea eax, [ebp - 0x18]
push eax
mov eax, 0xe528dbe3
add eax, 0x1b17a4a9
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x999a60d0
sub dword [ebp - 0x18], 0x2527f77a
mov dword [ebp - 0x14], 0x29fc5dec
sub dword [ebp - 0x14], 0xe88ffc77
mov dword [ebp - 0x10], 0xfaa81f3e
sub dword [ebp - 0x10], 0x9738b2d2
mov dword [ebp - 0xc], 0x48775a11
add dword [ebp - 0xc], 0xb788a5ef
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x6bd63f69
add eax, 0x946a416b
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3957a
push 0
call eax
mov ecx, 0x27346780
sub ecx, 0x27341484
xor edx, edx
add edx, eax
mov ebx, 0x97164b0a
add ebx, 0x692ac4f6
add ebx, dword [ebp - 8]
mov esi, 0xb26a6f22
add esi, 0x72a3b580
mov dword [ebp - 4], 0x845f2ee7
mov edi, dword [ebx]
mov dword [ebp - 4], 0xf80c4423
add edi, esi
add dword [ebp - 4], 0xeb4d0b04
mov dword [edx], edi
xor dword [ebp - 4], 0xd396ca39
add edx, 4
add ebx, 4
loop 0x4029b2
add eax, 0x2a5156ae
add eax, 0xd5afe815
mov ebx, eax
add eax, 5
mov ecx, 0x10119eca
add ecx, 0xf02e6136
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d2c
nop
sub eax, 0x403cd2
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00405630
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00405630
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00405630
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00405630
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00405630
mov dword [0x41203c], eax
call fcn.00405630
test eax, eax
jge 0x402550
push 8
call fcn.00405630
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00405630
pop ecx
push 1
call fcn.00405630
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00405630
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00405630
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00405630
jmp 0x402495
Function at 0xa01970
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1ab000]
push edi
jmp 0xa0198a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa01991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa01980
mov eax, 1
add ebx, ebx
jne 0xa019a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa019b4
jne 0xa019d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa019d3
dec eax
add ebx, ebx
jne 0xa019c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa01998
add ebx, ebx
jne 0xa019cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa01a25
xor ecx, ecx
sub eax, 3
jb 0xa019eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa01a5a
sar eax, 1
mov ebp, eax
jmp 0xa019f6
add ebx, ebx
jne 0xa019f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa019c4
inc ecx
add ebx, ebx
jne 0xa01a04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa019c4
add ebx, ebx
jne 0xa01a11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa01a06
jne 0xa01a22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa01a06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa01a44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa01a36
jmp 0xa01986
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa01a44
add edi, ecx
jmp 0xa01986
pop esi
mov edi, esi
mov ecx, 0x4f1c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa01a62
cmp byte [edi], 0x22
jne 0xa01a62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa01a67
lea edi, [esi + 0x5cd000]
mov eax, dword [edi]
or eax, eax
je 0xa01adf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x61289c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6129b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa01a94
mov ecx, edi
jns 0xa01ac3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6129b8]
or eax, eax
je 0xa01ad9
mov dword [ebx], eax
add ebx, 4
jmp 0xa01ab1
call dword [esi + 0x6129c8]
mov ebp, dword [esi + 0x6129bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa01b13
sub esp, 0xffffff80
jmp 0x4b04e0
Function at 0x40a060
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x448d68]
jne 0x40a06a
repz ret
jmp fcn.0040c2dc

Function at 0x40b672
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448d68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040584e
and dword [ebp - 0x14], 0
cmp dword [0x44c2e0], 0
mov dword [ebp - 0x18], eax
jne 0x40b725
push 0x402aec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b7cd
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ae0
push ebx
call edi
test eax, eax
je 0x40b7cd
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402ad0
push ebx
mov dword [0x44c2e0], eax
call edi
push eax
call esi
push 0x402abc
push ebx
mov dword [0x44c2e4], eax
call edi
push eax
call esi
push 0x402aa0
push ebx
mov dword [0x44c2e8], eax
call edi
push eax
call esi
mov dword [0x44c2f0], eax
test eax, eax
je 0x40b725
push 0x402a88
push ebx
call edi
push eax
call esi
mov dword [0x44c2ec], eax
mov eax, dword [0x44c2ec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b77e
cmp dword [0x44c2f0], ecx
je 0x40b77e
push eax
call esi
push dword [0x44c2f0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b77e
test ebx, ebx
je 0x40b77e
call edi
test eax, eax
je 0x40b775
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b775
test byte [ebp - 8], 1
jne 0x40b77e
or dword [ebp + 0x10], 0x200000
jmp 0x40b7b1
mov eax, dword [0x44c2e4]
cmp eax, dword [ebp - 0x18]
je 0x40b7b1
push eax
call esi
test eax, eax
je 0x40b7b1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b7b1
mov eax, dword [0x44c2e8]
cmp eax, dword [ebp - 0x18]
je 0x40b7b1
push eax
call esi
test eax, eax
je 0x40b7b1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44c2e0]
call esi
test eax, eax
je 0x40b7cd
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b7cf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a060
leave
ret
Function at 0x430640
Capabilities:
Accept command line arguments
Delete directory
Get common file path
Write file on windows

Disassembly:
mov eax, 0x1820
call fcn.0040c520
cmp dword [0x2285288], 0x37
jne 0x4306ff
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x4032a8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
lea eax, [esp + 0x824]
push eax
push 0x4032e0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x1020]
push edx
push 0
push 0x403374
push 0x4033a4
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x4033c4
push 0x4033cc
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov eax, dword [0x228528c]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x4513ec]
mov byte [eax + esi], dl
add esp, 0x1820
ret

Function at 0x430730
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x60
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
mov edx, dword [0x448f44]
push ebx
push ebp
push esi
mov esi, dword [ecx + 4]
mov ecx, dword [0x448f40]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x448f48]
mov dword [esp + 0x20], edx
mov edx, dword [0x448f4c]
push edi
mov dword [esp + 0x14], eax
mov edi, 0xc6ef3720
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov ebp, 0x20
jmp 0x430784
mov eax, dword [esp + 0x14]
mov ecx, eax
shr ecx, 5
add ecx, dword [esp + 0x18]
mov edx, eax
shl edx, 4
add edx, dword [esp + 0x1c]
add eax, edi
xor ecx, edx
xor ecx, eax
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov dword [0x228420c], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], eax
cmp dword [0x2285288], 0x1be
lea ebx, [edi + esi]
jne 0x4307d9
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x24]
mov dword [0x2284210], 0xff6b3619
xor eax, ebx
xor dword [esp + 0x10], eax
mov dword [0x2284214], 0xffffffff
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add edi, 0x61c88647
dec ebp
jne 0x430780
cmp dword [0x2285288], 0x8d4
jne 0x43083f
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], edx
pop ebx
add esp, 0x60
ret 4
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x60
ret 4
Function at 0x4439f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2f000]
push edi
jmp 0x443a0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x443a11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x443a00
mov eax, 1
add ebx, ebx
jne 0x443a23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x443a34
jne 0x443a53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x443a53
dec eax
add ebx, ebx
jne 0x443a40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x443a18
add ebx, ebx
jne 0x443a4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x443aa5
xor ecx, ecx
sub eax, 3
jb 0x443a6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x443ada
sar eax, 1
mov ebp, eax
jmp 0x443a76
add ebx, ebx
jne 0x443a76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x443a44
inc ecx
add ebx, ebx
jne 0x443a84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x443a44
add ebx, ebx
jne 0x443a91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x443a86
jne 0x443aa2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x443a86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x443ac4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x443ab6
jmp 0x443a06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x443ac4
add edi, ecx
jmp 0x443a06
pop esi
mov edi, esi
mov ecx, 0x2d3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x443ae2
cmp byte [edi], 1
jne 0x443ae2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x443ae7
lea edi, [esi + 0x41000]
mov eax, dword [edi]
or eax, eax
je 0x443b5f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x43704]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4377c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x443b14
mov ecx, edi
jns 0x443b43
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x43780]
or eax, eax
je 0x443b59
mov dword [ebx], eax
add ebx, 4
jmp 0x443b31
call dword [esi + 0x43790]
mov ebp, dword [esi + 0x43784]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x443b93
sub esp, 0xffffff80
jmp 0x40b10f
Function at 0x42b106
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0042b0af
test eax, eax
je 0x42b25f
lea ecx, [esp + 0x18]
call fcn.0042b0af
lea ecx, [esp + 0x18]
test eax, eax
je 0x42b1ce
call fcn.0042b0af
test eax, eax
je 0x42b190
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0042b0af
lea edi, [eax + edi*2]
dec ebx
jne 0x42b166
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x42b187
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x42b18a
mov byte [edx], 0
inc edx
jmp 0x42b271
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x42b1c6
test ecx, ecx
je 0x42b25a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42b1b8
jmp 0x42b256
xor ebp, ebp
inc ebp
jmp 0x42b25a
call fcn.0042b0e5
test edi, edi
jne 0x42b203
cmp eax, 2
jne 0x42b1fe
lea ecx, [esp + 0x18]
call fcn.0042b0e5
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x42b25a
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x42b1f3
jmp 0x42b256
sub eax, 3
jmp 0x42b206
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0042b0e5
mov ecx, eax
cmp esi, 0x7d00
jb 0x42b22d
inc ecx
cmp esi, 0x500
jb 0x42b236
inc ecx
cmp esi, 0x80
jae 0x42b241
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x42b25a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42b24d
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x42b277
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x42b136
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b3fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x42b42e
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x42b40f
jmp 0x42b432
mov eax, dword [esp + 0x10]
test edi, edi
je 0x42b43c
xor byte [esi], al
inc esi
dec edi
jne 0x42b436
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x408933
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
inc ebx
call fcn.00408957
add ebx, 0x805aecdd
xor dword [eax], esi
add ebx, 0x763c0ac3
add eax, 1
cmp eax, edi
jne fcn.00408933
ret
Function at 0x4333d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4333e2
pop dword [ebp - 0x1c]
mov eax, 0xf69d013
add eax, 0xf0d963cf
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x2d9622a7
sub dword [ebp - 0x2c], 0xdf43dd5c
mov dword [ebp - 0x28], 0x44fd503c
add dword [ebp - 0x28], 0xed35fc09
mov dword [ebp - 0x24], 0xb1654d71
sub dword [ebp - 0x24], 0x65190943
mov dword [ebp - 0x20], 0x940186cc
sub dword [ebp - 0x20], 0x940186cc
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xa5782d4a
add dword [ebp - 0x2c], 0xcefa3c0c
mov dword [ebp - 0x28], 0x7f9dfedf
sub dword [ebp - 0x28], 0x3e319d6a
mov dword [ebp - 0x24], 0x93def597
sub dword [ebp - 0x24], 0x306f892b
mov dword [ebp - 0x20], 0xe40d1da6
sub dword [ebp - 0x20], 0xe40d1da6
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x4e6f6bd2
sub eax, 0x4e2bb962
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x47798
push 0
call eax
mov ecx, 0xb9a2ed1
sub ecx, 0xb99dae8
mov edi, eax
mov ebx, 0x464e00
add ebx, dword [ebp - 0x1c]
mov esi, 0xe5ed8c5e
add esi, 0x3ff0c738
sub dword [ebp - 0x14], edi
mov edx, dword [ebx]
xor edx, esi
sub dword [ebp - 0xc], 0x530f9a3a
mov dword [edi], edx
xor dword [ebp - 4], 0x7ea0f798
add edi, 4
add ebx, 0xa9297b42
sub ebx, 0xa9297b3e
loop 0x4334f9
add eax, 0x458093
sub eax, 0x443e1c
xor ebx, ebx
add ebx, eax
add eax, 0x2f9e208a
sub eax, 0x2f9e2085
mov ecx, 0x4d2ca4f2
sub ecx, 0x4ceca4f2
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret