joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021d20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002cce4
call fcn.1002a133
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10021e65
cmp dword [ebp - 0x18], 1
jne 0x10021e65
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100201ed
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x10021e65
push dword [ebp - 0x14]
push ebx
push esi
call fcn.100201ed
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10021e5a
cmp dword [ebp - 0x18], 1
jne 0x10021e5a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100201ed
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10021e5a
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.100201ed
lea eax, [ebp - 0x20]
push eax
push 0x10032338
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10021e3e
push ebx
call fcn.100201ed
pop ecx
test al, al
je 0x10021e3e
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10021e5a
push dword [edi]
call fcn.1002a647
and dword [edi], 0
pop ecx
jmp 0x10021e5a
test esi, esi
je 0x10021e65
push esi
call fcn.1002a647
pop ecx
call fcn.1002a091
ret

Function at 0x100225b9
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10032094
xor esi, esi
call fcn.100201ed
pop ecx
test eax, eax
jne 0x100225da
push 0x100320ac
call fcn.100201ed
pop ecx
test eax, eax
je 0x100225dd
xor esi, esi
inc esi
cmp byte [0x1003cde0], 0
je 0x1002260c
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d628
push edi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002260b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret
Function at 0x100246d8
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cde0], 0
je 0x10024738
movzx eax, bl
mov esi, 0x1003e190
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10024738
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cde0], 0
je 0x10024768
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e190
push esi
call fcn.100201ed
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10024768
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, 1
pop esi
ret
Function at 0x10025de4
Capabilities:
Print debug messages

Disassembly:
push 0xac4
mov eax, 0x1002ce82
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, 0x1003e190
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xad0], eax
je 0x10025e33
push str._ACTWinBrowser__SendAcroIPCMessage
push ebx
call fcn.100201ed
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025e33
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xac8]
call fcn.10025dc7
mov eax, dword [ebp - 0xacc]
lea edi, [ebp - 0xac8]
test eax, eax
cmovne edi, eax
test esi, esi
je 0x1002602b
cmp dword [esi + 0x400], ebx
jne 0x10025e8a
push ebx
push ebx
push ebx
push ebx
call fcn.10022610
add esp, 0x10
test eax, eax
je 0x1002602b
push dword [esi + 0x400]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.AcroSBL
push str._s__lu__lu
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100201ed
add esp, 0x18
test eax, eax
jle 0x1002602b
lea ecx, [ebp - 0x6bc]
call fcn.10025da7
push dword [ebp + 0x14]
lea eax, [ebp - 0x6bc]
push dword [ebp - 0xad0]
push 1
push 1
push dword [ebp + 0xc]
push eax
call fcn.100201ed
add esp, 0x18
test eax, eax
jne 0x10026002
push ebx
lea eax, [ebp - 0x218]
push eax
push 1
lea ecx, [ebp - 0x2ac]
call fcn.10029305
push dword [esi + 0x400]
lea eax, [ebp - 0x6bc]
mov dword [ebp - 4], ebx
push 0x1388
push edi
push eax
lea ecx, [ebp - 0x2ac]
call fcn.1002952a
test eax, eax
jne 0x10025f6a
cmp dword [edi + 4], eax
sete bl
cmp byte [0x1003cde0], al
je 0x10025ff5
push dword [edi + 4]
mov esi, 0x1003e190
push str._ACTWinBrowser__SendAcroIPCMessage_IPC_call_success_status___lu
push esi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025ff5
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10025ff5
cmp byte [0x1003cde0], 0
mov esi, 0x1003e190
je 0x10025f95
push str.IPC_Error:_AIPC_ERR
push esi
call fcn.100201ed
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025f95
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xacc], ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageA]
cmp byte [0x1003cde0], 0
je 0x10025fe9
push dword [ebp - 0xacc]
push str._ACTWinBrowser__IPC_Error_:__s
push esi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025fe9
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 0xacc]
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2ac]
call fcn.100201ed
jmp 0x1002602b
cmp byte [0x1003cde0], bl
je 0x1002602b
push str.IPC_CreateMessage_Error:_CreateMessage_failed
mov esi, 0x1003e190
push esi
call fcn.100201ed
pop ecx
pop ecx
cmp byte [0x1003cde0], bl
je 0x1002602b
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
call fcn.1002a0a6
ret
Function at 0x100277eb
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10027808
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278ec
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5e0
push edi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Uns32____d
push edi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_void____d
push edi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret

Function at 0x1002795e
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002cf70
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov edi, dword [ebp + 8]
je 0x1002799d
lea eax, [edi + 4]
mov esi, 0x1003e5e0
push eax
push str.ASM_Release__s
push esi
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002799d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100279d3
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100201ed
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002a0a6
ret
Function at 0x100279e9
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002cf9d
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
je 0x10027a48
call fcn.100201ed
test al, al
mov edx, 0x1002ea51
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5e0
call fcn.100201ed
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10027a48
push 0x1003e5e0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100201ed
test ebx, ebx
jne 0x10027aae
cmp byte [0x1003cde0], bl
je 0x10027b0f
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5e0
push ebx
call fcn.100201ed
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10027b0f
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10027b0f
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10027ad5
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10027a8f
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10027aff
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10027a8f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002a0a6
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x36c403b4
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x7e24789e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x10005a7a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x100079b4
call fcn.100078a2
mov ebx, ecx
lea eax, [ebp - 0x14]
xor ecx, ecx
push eax
push 0x20019
push ecx
push str.CLSID
mov dword [ebp - 4], ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x80000000
mov dword [ebp - 0x14], ecx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10005b22
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
and dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x14]
call edi
push 4
pop ebx
test eax, eax
jne 0x10005b14
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push str.InsecureQI
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005b14
cmp dword [ebp - 0x18], ebx
jne 0x10005b14
mov edi, dword [ebp - 0x1c]
cmp edi, 3
ja 0x10005b14
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], eax
je 0x10005b24
push dword [ebp - 0x10]
call esi
jmp 0x10005b24
mov byte [ebp - 4], bl
cmp dword [ebp - 0x10], 0
je 0x10005b22
push dword [ebp - 0x10]
call esi
xor edi, edi
mov dword [ebp - 4], 5
cmp dword [ebp - 0x14], 0
je 0x10005b36
push dword [ebp - 0x14]
call esi
mov eax, edi
call fcn.10007880
ret
Function at 0x10005e4e
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x10007a20
call fcn.100078a2
cmp byte [0x1000b945], 0
je 0x10005e6d
mov eax, dword [0x1000b948]
jmp 0x10005f43
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
mov dword [ebp - 4], esi
push 0x80000001
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005ebd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x1000b948
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005ebd
cmp dword [ebp - 0x14], 4
je 0x10005f16
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x10005ece
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005f1e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x1000b948
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005f1e
cmp dword [ebp - 0x14], 4
jne 0x10005f1e
mov esi, dword [0x1000b948]
jmp 0x10005f24
mov dword [0x1000b948], esi
mov byte [0x1000b945], 1
mov dword [ebp - 4], 3
cmp dword [ebp - 0x10], 0
je 0x10005f41
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.10007880
ret
Function at 0x42f710
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d000]
push edi
or ebp, 0xffffffff
jmp 0x42f732
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42f739
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42f728
mov eax, 1
add ebx, ebx
jne 0x42f74b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42f740
jne 0x42f75c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42f740
xor ecx, ecx
sub eax, 3
jb 0x42f770
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42f7e2
mov ebp, eax
add ebx, ebx
jne 0x42f77b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42f788
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42f7ac
inc ecx
add ebx, ebx
jne 0x42f798
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42f78d
jne 0x42f7a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42f78d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42f7cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42f7bd
jmp 0x42f72e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42f7cc
add edi, ecx
jmp 0x42f72e
pop esi
mov edi, esi
mov ecx, 0x761
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42f7ea
cmp byte [edi], 5
jne 0x42f7ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42f7ef
lea edi, [esi + 0x2c000]
mov eax, dword [edi]
or eax, eax
je 0x42f867
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2fbd4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2fc60]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42f81c
mov ecx, edi
jns 0x42f84b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2fc64]
or eax, eax
je 0x42f861
mov dword [ebx], eax
add ebx, 4
jmp 0x42f839
call dword [esi + 0x2fc68]
popal
jmp 0x40adcf
Function at 0x4027cd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x85bd78]
mov ecx, dword [0x85acc8]
sub esp, 0x800
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x402870
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x85bd78], 0x959
jne 0x402862
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
call fcn.0040262e
add edi, 8
dec ebx
jne 0x4027f5
pop edi
pop ebx
pop esi
leave
ret
Function at 0x404e03
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403cf9
and dword [ebp - 4], 0
cmp dword [0x43d700], 0
mov ebx, eax
jne 0x404eb4
push 0x401920
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404f65
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401914
push edi
call esi
test eax, eax
je 0x404f65
push eax
call fcn.00403c87
mov dword [esp], 0x401904
push edi
mov dword [0x43d700], eax
call esi
push eax
call fcn.00403c87
mov dword [esp], 0x4018f0
push edi
mov dword [0x43d704], eax
call esi
push eax
call fcn.00403c87
mov dword [esp], 0x4018d4
push edi
mov dword [0x43d708], eax
call esi
push eax
call fcn.00403c87
pop ecx
mov dword [0x43d710], eax
test eax, eax
je 0x404eb4
push 0x4018bc
push edi
call esi
push eax
call fcn.00403c87
pop ecx
mov dword [0x43d70c], eax
mov eax, dword [0x43d70c]
cmp eax, ebx
je 0x404f0c
cmp dword [0x43d710], ebx
je 0x404f0c
push eax
call fcn.00403d02
push dword [0x43d710]
mov esi, eax
call fcn.00403d02
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404f0c
test edi, edi
je 0x404f0c
call esi
test eax, eax
je 0x404f03
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404f03
test byte [ebp - 0xc], 1
jne 0x404f0c
or dword [ebp + 0x10], 0x200000
jmp 0x404f45
mov eax, dword [0x43d704]
cmp eax, ebx
je 0x404f45
push eax
call fcn.00403d02
pop ecx
test eax, eax
je 0x404f45
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404f45
mov eax, dword [0x43d708]
cmp eax, ebx
je 0x404f45
push eax
call fcn.00403d02
pop ecx
test eax, eax
je 0x404f45
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43d700]
call fcn.00403d02
pop ecx
test eax, eax
je 0x404f65
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404f67
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406c6e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c9f8]
jne 0x406c78
repz ret
jmp fcn.00408395
Function at 0xaebf20
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aec070
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaebf46
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaebf32
add dl, dl
jne 0xaebf51
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaebfa4
xor eax, eax
add dl, dl
jne 0xaebf5e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaec045
add dl, dl
jne 0xaebf6d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaebf78
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaebf83
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaebf8e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaebf9a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaebf3d
mov eax, 1
add dl, dl
jne 0xaebfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaebfbd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaebfa9
sub eax, ebx
mov ebx, 1
jne 0xaebff0
mov ecx, 1
add dl, dl
jne 0xaebfd6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaebfe1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaebfcd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaebf3d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaec007
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaec012
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaebffe
cmp eax, 0x7d00
jae 0xaec035
cmp eax, 0x500
jb 0xaec030
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaebf3d
cmp eax, 0x7f
ja 0xaec038
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaebf3d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaec066
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaebf3d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10