joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40cbf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
push ebx
mov ebx, dword [0x43b2ec]
or eax, 0xffffffff
push esi
push edi
mov edi, edx
xor esi, esi
test edi, edi
je 0x40ccc7
nop dword [eax]
movzx ecx, byte [esi + ebx]
xor eax, ecx
mov ecx, eax
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
inc esi
xor eax, ecx
cmp esi, edi
jb 0x40cc10
pop edi
pop esi
not eax
pop ebx
pop ecx
ret
Function at 0x40dd90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp byte [0x43bcf0], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
jne 0x40ddf1
push 0xa
push 3
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov dword [0x43b2ec], edi
mov esi, dword [edi]
add edi, 4
mov dword [0x43b2ec], edi
mov edx, dword [edi]
add edi, 4
mov dword [0x43b2ec], edi
call fcn.0040cbf0
cmp eax, esi
jne 0x40dedb
mov byte [0x43bcf0], 1
jmp 0x40ddf7
mov edi, dword [0x43b2ec]
mov ecx, 0x42d64c
mov eax, ebx
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40de20
test dl, dl
je 0x40de1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40de20
add eax, 2
add ecx, 2
test dl, dl
jne 0x40de00
xor eax, eax
jmp 0x40de25
sbb eax, eax
or eax, 1
test eax, eax
je 0x40de34
call fcn.0040d1b0
mov edi, dword [0x43b2ec]
mov ecx, edi
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40de58
test dl, dl
je 0x40de54
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40de58
add eax, 2
add ecx, 2
test dl, dl
jne 0x40de38
xor edx, edx
jmp 0x40de5d
sbb edx, edx
or edx, 1
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40de62
sub ecx, esi
mov eax, dword [edi + ecx + 1]
lea esi, [edi + ecx]
add esi, 5
test edx, edx
je 0x40dec5
nop dword [eax]
add esi, eax
mov ecx, ebx
mov eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40dea6
test dl, dl
je 0x40dea2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40dea6
add ecx, 2
add eax, 2
test dl, dl
jne 0x40de86
xor edx, edx
jmp 0x40deab
sbb edx, edx
or edx, 1
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40deb0
sub ecx, edi
add esi, ecx
mov eax, dword [esi + 1]
add esi, 5
test edx, edx
jne 0x40de80
movzx eax, word [esi]
lea edx, [esi + 2]
push eax
mov ecx, ebp
call fcn.0040d360
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
push str.Error__corrupted_constants_object
call fcn.004146af
add esp, 4
call fcn.00411647
int3

Function at 0x411356
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x425598
push 0x425590
push 0x425598
push 0
call fcn.004112d6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411388
push dword [ebp + 8]
mov ecx, esi
call fcn.004106bb
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x4113ca
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4255bc
push 0x4255b4
push 0x4255bc
push 2
call fcn.004112d6
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x4113fb
mov ecx, esi
call fcn.004106bb
call esi
jmp 0x411401
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret
Function at 0x411404
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4255d0
push 0x4255c8
push 0x4255d0
push 3
call fcn.004112d6
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x411438
mov ecx, esi
call fcn.004106bb
call esi
jmp 0x41143e
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x4154f2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415531
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415531
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415531
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415531
cmp dword [ecx + 0x74], 0xe
jbe 0x415531
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x419269
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x427484
push str.FlsAlloc
push 0x1f
call fcn.00419128
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41929d
push dword [ebp + 8]
mov ecx, esi
call dword [0x425434]
call esi
jmp 0x4192a3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4192e7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x4274a8
push str.FlsGetValue
push 0x21
call fcn.00419128
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41931e
push dword [ebp + 8]
mov ecx, esi
call dword [0x425434]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x419326
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x4274bc
push str.FlsSetValue
push 0x22
call fcn.00419128
mov esi, eax
add esp, 0x10
test esi, esi
je 0x419360
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x425434]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41ab69
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41ac06
push ebx
push esi
call fcn.0041ab32
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041aac6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41abb3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ac05
push edi
push eax
call fcn.00415dc7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41abd3
call fcn.00415d8d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ac04
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041aac6
add esp, 0x20
test eax, eax
jne 0x41abf2
push edi
call fcn.00415d8d
jmp 0x41abfa
push ebx
call fcn.00415d8d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x437000
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x437006
or ebp, 0xffffffff
xor ebx, ebx
pop esi
lea edi, [esi - 0x36006]
push edi
add word [edi + 0x35810], 0
add esi, 0x1b3
jmp 0x43702e
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x437039
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x437028
mov eax, 1
add ebx, ebx
jne 0x43704b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x437040
jne 0x43705c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x437040
xor ecx, ecx
sub eax, 3
jb 0x4370ca
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4370e6
mov ebp, eax
add ebx, ebx
jne 0x43707b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x437088
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4370ac
inc ecx
add ebx, ebx
jne 0x437098
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x43708d
jne 0x4370a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43708d
add ecx, 2
cmp eax, 0xfffff300
adc ecx, 1
lea edx, [edi + eax]
cmp eax, 0xfffffffc
jle 0x4370d0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4370bc
jmp 0x43702e
mov eax, ebp
jmp 0x437070
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4370d0
add edi, ecx
jmp 0x43702e
pop esi
sub edi, dword [edi - 4]
push edi
lea edi, [esi]
mov ecx, 0x697
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4370f6
cmp byte [edi], 1
jne 0x4370f6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4370fb
pop edi
mov eax, dword [edi]
or eax, eax
je 0x437166
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x35000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x350a0]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x437123
push edx
mov ecx, edi
jns 0x437153
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [esi + 0x350a4]
pop edx
mov dword [ebx], eax
add ebx, 4
jmp 0x437140
lea ebx, [esi - 4]
add edi, 4
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x437197
cmp al, 0xef
ja 0x43718a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x43716c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x437179
popal
jmp 0x40f950
Function at 0x1000a7e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000a7f3
pop dword [ebp - 0x1c]
mov eax, 0xa8e5ce21
sub eax, 0x98e5262e
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x807c2102
add dword [ebp - 0x2c], 0xcdd62449
mov dword [ebp - 0x28], 0x240f3e6f
sub dword [ebp - 0x28], 0xf1dbf22a
mov dword [ebp - 0x24], 0xdf405534
add dword [ebp - 0x24], 0x6d0beefa
mov dword [ebp - 0x20], 0x37acbf28
add dword [ebp - 0x20], 0xc85340d8
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x5028557b
add eax, 0xbfd86aa9
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xb76a1629
add dword [ebp - 0x2c], 0xbd08532d
mov dword [ebp - 0x28], 0x3ffca3cc
sub dword [ebp - 0x28], 0xfe904257
mov dword [ebp - 0x24], 0xd3f5800f
add dword [ebp - 0x24], 0x8f79ec5d
mov dword [ebp - 0x20], 0x2afd91de
add dword [ebp - 0x20], 0xd5026e22
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xefedc343
sub eax, 0xdfed0317
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34cfc
push 0
call eax
mov ecx, 0x9080ba4d
add ecx, 0x6f7f80f3
xor ebx, ebx
add ebx, eax
mov edi, 0x10047400
add edi, dword [ebp - 0x1c]
mov edx, 0x8e2ae51d
add edx, 0x7091830
xor dword [ebp - 4], eax
mov esi, dword [edi]
mov dword [ebp - 0xc], 0x28d1df10
add esi, edx
xor dword [ebp - 0xc], 0x7589de60
mov dword [ebx], esi
sub dword [ebp - 0xc], 0x2234c9f3
add ebx, 4
add edi, 0xe4846858
sub edi, 0xe4846854
loop 0x1000a911
add eax, 0x7c72bc0b
add eax, 0x838e23c8
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb5e4c98e
add ecx, 0x5a1b3672
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40d0c0
Capabilities:
Encode data using xor

Disassembly:
pushal
pushal
pushal
call fcn.0040d08c
mov esi, eax
xor ebx, ebx
mov edi, 0x57b374
mov eax, esp
mov dx, 0x804d
call fcn.00421e64
mov edx, esi
call fcn.00421cf0
push eax
push dword [edi]
call fcn.00403bd8
dec esi
add edi, 0xffffffce
xor ebx, 1
jne 0x40d0d1
add esp, 0x40
popal
ret
Function at 0x40206a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4020a9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4020a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4020a9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4020a9
cmp dword [ecx + 0x74], 0xe
jbe 0x4020a9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10008520
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
inc byte [esi]
mov eax, dword [0x8c16476]
jl 0x10008588
cmp byte [eax + 0x6dc4c310], ch
push edi
les ebp, [ebp + 0x57]
jle 0x10008585
mov al, 0x14
push edx
test al, 0x66
inc esp
loop 0x10008573
push 0x54
invalid
pushal
mov edi, dword [eax - 0x18]
int 0xd8
popfd
int 0x4e
mov byte [ecx], ah
xor ecx, 0xffffffc4
into
push ebp
cmp cl, byte [edi + ebx*2 + 0x2f703983]
pop edi
cmp dword [ecx], 0x70
das
jo 0x100085b9
je 0x100085b9
inc ebp
sub ch, byte [edi]
test eax, 0x40c34207
sub al, 4
jo 0x1000857e
push eax
in eax, dx
pop esi
cmpsb byte [esi], byte es:[edi]
inc eax
in eax, dx
insd dword es:[edi], dx
pop ecx
in al, 7
mov dh, byte [ecx + 0x1c2603fe]
cmpsd dword [esi], dword es:[edi]
jge 0x1000852e
mov eax, dword [0x3b266826]
pop ds
push edi
push esp
sub ch, ch
lodsd eax, dword [esi]
lodsb al, byte [esi]
pop ds
iretd
std
dec esp
jne 0x100085e4
mov ch, byte [esi]
and al, 0x6c
cmpsb byte [esi], byte es:[edi]
int3
jecxz 0x10008643
pop ebp
jbe 0x10008628
add ecx, edx
aad 0x59
fnstsw word [0x91186654]
xchg edx, eax
test dh, cl
sbb al, 0x18
test byte [esi - 0xeb2d3d6], dh
lodsd eax, dword [esi]
inc ecx
daa
fild qword [ebx - 0x2934973a]
xchg ebx, eax
xor eax, 0x31d8b224
sub ch, cl
fstp qword [edi + 0x55b049eb]
ror ebp, 1
cdq
mov byte [ecx], ch
mov edx, 0xea295828
xor ebp, ebx
popal
out 0x90, al
mov bh, byte [edx]
lcall 0xd9de, 0xd97e4684
xchg byte [ecx - 0x7e8a35d2], ch
in al, 0x99
jecxz 0x100085e5
test byte [esi + 0x7e], al
fstpnce st(6), st(0)
fld dword [esi + 0x75ca2ea9]
and esp, 0xc4ade399
cmc
call 0x9a4cf256
adc edx, dword [ecx + 0x4a]
salc
invalid
das
mov word [eax], cs
lodsb al, byte [esi]
test byte [eax], 0xa9
in eax, 0x2a
enter 0xffffffffffffb398, 0x7d
add byte [ecx - 0x6737d51b], ch
mov bl, 0x7d
shr eax, 0xed
xchg edx, eax
add dword [ecx], esp
ja 0x1000869d
call edi
jmp 0x10008648
salc
sbb dword [ecx], ecx
push 0x4747deaa
mov edi, 0x6a6d02f
mov al, byte [edi]
hlt
Function at 0x11449058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.114491a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1144907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1144906a
add dl, dl
jne 0x11449089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x114490dc
xor eax, eax
add dl, dl
jne 0x11449096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1144917d
add dl, dl
jne 0x114490a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x114490b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x114490bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x114490c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x114490d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11449075
mov eax, 1
add dl, dl
jne 0x114490ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x114490f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x114490e1
sub eax, ebx
mov ebx, 1
jne 0x11449128
mov ecx, 1
add dl, dl
jne 0x1144910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11449119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11449105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11449075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1144913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1144914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11449136
cmp eax, 0x7d00
jae 0x1144916d
cmp eax, 0x500
jb 0x11449168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11449075
cmp eax, 0x7f
ja 0x11449170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11449075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1144919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11449075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001504
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa8
xor eax, eax
lea ecx, [esp + 0x78]
lea edx, [esp + 0x98]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x64], eax
jmp 0x10001553
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov esi, esp
mov dword [esi + 4], edx
mov dword [esi], ecx
mov ecx, dword [sym.imp.USER32.dll_WindowFromPoint]
call ecx
sub esp, 8
mov dword [esp + 0x60], eax
jmp 0x100015a6
mov eax, dword [esp + 0x64]
mov ecx, esp
mov dword [ecx], 0xa3a
mov ecx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x5c], eax
call ecx
sub esp, 4
xor eax, eax
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x58]
mov ecx, 0x4ec4ec4f
mov dword [esp + 0x54], eax
mul ecx
shr edx, 2
imul eax, edx, 0xd
mov ecx, dword [esp + 0x54]
sub ecx, eax
mov dword [esp + 0x50], ecx
je 0x10001532
jmp 0x10001597
mov eax, dword [esp + 0x50]
sub eax, 0xb
mov dword [esp + 0x4c], eax
je 0x10001532
jmp 0x100015a6
mov eax, dword [esp + 0x54]
add eax, 1
cmp eax, 0x1d9
mov dword [esp + 0x58], eax
jne 0x10001574
xor eax, eax
mov dword [esp + 0x70], 0x477
mov ecx, esp
lea edx, [esp + 0x70]
mov dword [ecx], edx
mov ecx, dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov dword [esp + 0x48], eax
call ecx
sub esp, 4
xor ecx, ecx
mov edx, dword [esp + 0x5c]
sub edx, 0xf
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], edx
je 0x1000160b
jmp 0x100015f4
mov eax, dword [esp + 0x5c]
sub eax, 0x4b
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ecx
jne 0x10001674
jmp 0x1000160b
mov dword [esp + 0x74], 0x42c
mov eax, esp
lea ecx, [esp + 0x74]
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
call eax
sub esp, 8
xor ecx, ecx
mov edx, 0x1c
mov esi, dword [esp + 0x6c]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1c
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
call fcn.102bbaa0
mov eax, esp
lea ecx, [esp + 0x78]
mov dword [eax + 4], ecx
mov dword [eax], 0x873412
call sub.KERNEL32.dll_Thread32Next
sub esp, 8
mov dword [esp + 0x24], eax
jmp 0x100016c7
mov eax, dword [esp + 0x34]
add eax, 1
mov ecx, esp
mov dword [ecx], 0x26
mov ecx, dword [sym.imp.KERNEL32.dll_DeleteAtom]
mov dword [esp + 0x20], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0xef2
mov dword [ecx], 0x8b5072
mov ecx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov word [esp + 0x1e], ax
call ecx
sub esp, 8
mov ecx, dword [esp + 0x20]
cmp ecx, 0xa
mov dword [esp + 0x18], eax
mov dword [esp + 0x34], ecx
jne 0x10001674
mov eax, dword [esp + 0x5c]
add eax, 1
mov ecx, dword [sym.imp.USER32.dll_DestroyCaret]
mov dword [esp + 0x14], eax
call ecx
mov ecx, dword [esp + 0x14]
cmp ecx, 0x105
mov dword [esp + 0x10], eax
mov dword [esp + 0x64], ecx
je 0x1000152c
jmp 0x10001553

Function at 0x102bbeac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102e59d0]
jne 0x102bbeb6
repz ret
jmp fcn.102bc15d
Function at 0x102bca90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x102e59a8]
add esi, 0x647
mov dword [0x102e59a4], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x102bcb08
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [0x102e59a4], 0x16fa
mov dword [0x102e59a8], 0xec7
mov dword [ebp - 0x34], eax
call fcn.102bc8fe
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.102bc45e
mov dword [0x102e59a4], 0x632
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x102bcabc
jmp 0x102bcb34
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x102be692]
mov dh, byte [eax + 0x102be663]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
je 0x102bcac4
jmp 0x102bcb08
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x102e59a4]
add ecx, 0xffffe677
mov dword [0x102e59a4], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.102bcf3f
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x50], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x44], ecx
mov dword [0x102e59a4], 0x828
add ecx, 0x1cda
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x102bcbd1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret