joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419ed0
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x443f85f5]
test dword [ebp - 0x5d], ebp
lodsb al, byte [esi]
pushfd
je 0x419ee3
test eax, 0x6878d311
mov byte [0x389f0722], al
xchg edx, eax
mov dh, 0xb2
sar byte [ebp + ecx - 0x8dd6dd0], 1
and al, byte [edi]
pop es
lahf
cmp byte [edx - 0x432f4d4a], dl
or eax, 0xf7229230
mov cl, 4
mov edi, 0x6c0bcd8b
adc al, 0x3a
jns 0x419efc
invalid
call 0xa329ca4c
push esi
insb byte es:[edi], dx
wait
mov dh, 0x63
fmul st(6)
test eax, 0xafd4f35
imul dword [esi + 0x795bb000]
lahf
mov dh, 0x91
enter 0xffffffffffffb329, 0xc
pop ecx
loope 0x419f40
salc
mov ebx, 0xd1606467
js 0x419f0e
wait
and dl, byte [eax - 0x11]
or byte [edx], bh
ja 0x419f66
neg byte [eax]
wait
call 0x4cc1daa4
push edi
or bh, ah
dec edx
pop esi
ret
shl byte [0xb5693450], 0xfc
into
lds edx, [0xd849721e]
sub al, 0xf5
pop ds
mul dl
dec esi
push es
rcl byte [ebp + 0x7a943221]
xchg ecx, ebx
cli
xchg esp, eax
jp 0x419ee4
fsqrt
cwde
sub cl, byte [edx + edi]
imul edi, dword [edi + 0x75fb0ff2], 0x2d
psubq mm6, qword [ebp + 0x2d]
in al, dx
sbb byte [ebx + esi*2], bh
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0x366d257e]
sub dword [esi - 0x2b], eax
mov ecx, 0x5cdb2480
add dword [ecx], eax
mov esp, 0x5179ba4a
sub al, 0xe1
xor dword [ecx - 0x1c], esi
xchg dword [ecx + edi*2], ecx
jbe 0x419f5a
out 0x51, al
or al, 0xa6
and byte [eax], al
push es
inc ecx
jl 0x419fc5
and dword [eax - 0x4d28f124], 0x3c18779e
mov dh, 0x5c
rcl byte [edx], cl
invalid
mov dword [eax + ebp*4], ebx
jb 0x41a032
jp 0x419fef
out dx, eax
adc al, byte [esi + 4]
sub al, byte [eax]
int1
pop es
adc dword [ecx], 0x2d
mov edx, 0x65af42a5
in eax, dx
mov edx, 0x4edf6e21
stosb byte es:[edi], al
add byte [edx], al
in eax, 0xb
pop ebp
lahf
fld xword [esi]
add dword [esi - 0x7e], eax
xor byte [edx], 0x2b
xor ch, byte [ebx]
das
int 0x2d
cli
lodsb al, byte [esi]
and byte [esi + 0x56eec975], ch
mov edx, 0x161b204f
xchg edx, eax
lodsd eax, dword [esi]
inc edx
mov bl, 0x67
xchg byte [edx + 0x3005ea97], bh
les ebx, [edi + 0x78d4ec50]
mov esp, 0xbf635764
sbb ecx, dword [ecx + 0x733feca3]
in al, 0xa1
cmp eax, 0x4e8dcc1b
pop ebx
popfd
cmp al, 0x9c
sub eax, 0xfa2503b8
insd dword es:[edi], dx
lea ebx, [eax - 0x4a]
mov esi, 0xb6f73a5
adc dl, byte [eax + 0x15]
bound edx, qword [esi + esi*2 + 0x66]
movsd dword es:[edi], dword [esi]
jae 0x41a0a4
or edx, dword [edx]
push eax
adc eax, 0x66765462
xor al, 0x27
pop ebp
cmp ecx, dword [bx + si + 0x3d1e]
invalid
or al, 0xcd
jo 0x41a109
cmp dword [ecx + 0x57], 0x13
mov ebx, 0x55db6a93
shl dword [edi], 1
mov edx, 0x3ffec66c
jecxz 0x41a115
xor dh, byte [ebx]
invalid
or eax, 0xa48928c1
push cs
xchg ecx, eax
push 0xadc1282a
mov esi, 0x3102b8ba
cli
inc edx
cmp cl, bl
outsd dx, dword fs:[esi]
and ebp, dword [ecx]
stosd dword es:[edi], eax
invalid
or cl, byte [ebp + 0x17]
sal byte [ebp - 0x1d], 0xaa
in al, dx
hlt
add eax, dword [edi]
stc
and dword [esi - 0x26], 0x61c1ec5a
xchg dword [ebx + 0x64], ebp
sub al, 0x72
mov ecx, dword [edi - 0x24]
mov eax, 0x60de486b
jns 0x41a0c4
fcom qword [esi + 0x6f8f38e4]
scasd eax, dword es:[edi]
mov word [0x1edc9dc1], ax
dec edx
cli
cdq
mov ch, 0x90
invalid
Function at 0x42d120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x4c0014]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x42d212
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
mov eax, dword [eax]
mov dword [esp + 0x60], eax
sar eax, 0x1f
mov dword [esp + 0x64], eax
xor eax, eax
dec eax
lea ecx, [esp + 0x48]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp], ecx
call fcn.00445200
mov eax, dword [0x4d2568]
mov ecx, dword [0x4c3b28]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42d28e
mov dword [esp], 0x4b370c
call fcn.00445b60
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp], edi
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x4b2120]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.0042f720
sub esp, 0x44
cmp byte [edi], 0
jne 0x42d276
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.004537c3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x42d282
lea ecx, [esi + 0x5c]
call fcn.00439850
lea ecx, [esi + 0x28]
call fcn.00436840
mov ecx, esi
call fcn.004399d0
mov dword [esp], esi
call fcn.00452d4c
jmp 0x42d282
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x42d282
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov dword [esp], 1
mov ecx, esi
call edi
sub esp, 4
mov al, byte [esp + ebx + 0x51]
jmp 0x42d27e
mov al, byte [esp + ebx + 0x51]
cmp al, 8
je 0x42d24e
cmp al, 9
je 0x42d225
inc ebx
movzx eax, byte [esp + 0x50]
cmp ebx, eax
jae 0x42d212
jmp 0x42d276
mov dword [esp], 0x4d2568
call fcn.00452dc7
cmp dword [0x4d2568], 0xffffffff
jne 0x42d1ac
mov dword [esp], 0
mov ecx, 0x4d2368
call fcn.0042b8f0
sub esp, 4
mov dword [esp], 0x4d2568
call fcn.00452e3d
jmp 0x42d1ac
Function at 0x42d2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x4c0014]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x42d3c1
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x701
mov dword [esp + 0x54], ecx
cmp byte [eax + 0xb], 0
jns 0x42d31f
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x60], eax
xor eax, eax
dec eax
lea ecx, [esp + 0x48]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp], ecx
call fcn.00445200
mov eax, dword [0x4d2568]
mov ecx, dword [0x4c3b28]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42d43d
mov dword [esp], 0x4b370c
call fcn.00445b60
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp], edi
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x4b2120]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.0042f720
sub esp, 0x44
cmp byte [edi], 0
jne 0x42d425
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.004537c3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x42d431
lea ecx, [esi + 0x5c]
call fcn.00439850
lea ecx, [esi + 0x28]
call fcn.00436840
mov ecx, esi
call fcn.004399d0
mov dword [esp], esi
call fcn.00452d4c
jmp 0x42d431
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x42d431
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov dword [esp], 1
mov ecx, esi
call edi
sub esp, 4
mov al, byte [esp + ebx + 0x51]
jmp 0x42d42d
mov al, byte [esp + ebx + 0x51]
cmp al, 8
je 0x42d3fd
cmp al, 9
je 0x42d3d4
inc ebx
movzx eax, byte [esp + 0x50]
cmp ebx, eax
jae 0x42d3c1
jmp 0x42d425
mov dword [esp], 0x4d2568
call fcn.00452dc7
cmp dword [0x4d2568], 0xffffffff
jne 0x42d35b
mov dword [esp], 0
mov ecx, 0x4d2368
call fcn.0042b8f0
sub esp, 4
mov dword [esp], 0x4d2568
call fcn.00452e3d
jmp 0x42d35b
Function at 0x43a660
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x43a675
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jb 0x43a6a6
nop dword [eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x43a680
cmp edx, 1
je 0x43a6c9
cmp edx, 3
je 0x43a6b7
cmp edx, 2
je 0x43a6c0
jmp 0x43a6d4
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x445460
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 8]
mov eax, dword [0x4c0014]
xor eax, ebp
mov dword [esp + 0x38], eax
lea eax, [esp + 0x24]
push eax
call fcn.00440110
add esp, 4
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
call dword [0x4bc478]
movsd xmm0, qword [0x4d22f8]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x4454ba
jnp 0x44551f
ucomisd xmm0, xmm1
jne 0x4454c6
jnp 0x445620
movsd xmm1, qword [esp + 0x28]
unpcklps xmm1, xmmword [0x4b7550]
subpd xmm1, xmmword [0x4b7560]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x4b7578]
movsd qword [esp], xmm2
fld qword [esp]
fisttp qword [esp]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.004537c3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [0x4bc394]
call edi
push eax
call dword [0x4bc414]
mov dword [esp + 0x14], eax
call edi
push 2
push eax
call dword [0x4bc4b0]
mov eax, dword [0x4d2308]
mov ecx, dword [0x4c3b28]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x445629
mov eax, dword [0x4d2318]
mov ecx, dword [0x4c3b28]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x445662
rdtsc
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
xor eax, eax
lea edi, [esp + 0x30]
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [0x4bc470]
mov eax, dword [edi]
mov dword [esp + 0x10], eax
mov ebx, dword [edi + 4]
call dword [0x4bc394]
push dword [esp + 0x14]
push eax
call dword [0x4bc4b0]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [0x4bc474]
mov eax, dword [esp + 0x10]
sub eax, dword [0x4d2310]
sbb ebx, dword [0x4d2314]
movd xmm0, ebx
movd xmm1, eax
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x4b7550]
subpd xmm1, xmmword [0x4b7560]
haddpd xmm1, xmm1
fild qword [esp + 0x30]
fstp qword [esp + 0x18]
divsd xmm1, qword [esp + 0x18]
pxor xmm0, xmm0
movsd xmm2, qword [0x4b7570]
ucomisd xmm2, xmm1
jbe 0x4456b0
xorpd xmm1, xmm1
jmp 0x4454ba
xor eax, eax
xor ecx, ecx
jmp 0x445505
push 0x4d2308
call fcn.00452dc7
add esp, 4
cmp dword [0x4d2308], 0xffffffff
jne 0x44555e
rdtsc
mov dword [0x4d2300], eax
mov dword [0x4d2304], edx
push 0x4d2308
call fcn.00452e3d
add esp, 4
jmp 0x44555e
push 0x4d2318
call fcn.00452dc7
add esp, 4
cmp dword [0x4d2318], 0xffffffff
jne 0x44557f
xor eax, eax
lea edi, [esp + 0x30]
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [0x4bc470]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [0x4d2314], ecx
mov dword [0x4d2310], eax
push 0x4d2318
call fcn.00452e3d
add esp, 4
jmp 0x44557f
mov eax, dword [esp + 0xc]
sub eax, dword [0x4d2300]
mov ecx, dword [esp + 8]
sbb ecx, dword [0x4d2304]
movd xmm2, ecx
movd xmm0, eax
punpckldq xmm0, xmm2
punpckldq xmm0, xmmword [0x4b7550]
subpd xmm0, xmmword [0x4b7560]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x4d22f8], xmm0
jmp 0x445617
Function at 0x477640
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047764b
Function at 0x497f60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.00452d1c
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x497fb0
push ecx
push ecx
call fcn.0046293a
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x497f9f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [0x4bc3c0]
Function at 0x40f197
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a16b
mov dword [ebp - 0x14], eax
cmp dword [0x47bffc], esi
jne 0x40f28a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40f217
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f36a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40f36a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f36a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x47bffc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x47c000], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x47c004], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47c00c], eax
test eax, eax
je 0x40f287
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47c008], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40f2af
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f2a2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40f2c4
push 4
pop eax
jmp 0x40f36c
cmp dword [ebp - 0x14], esi
je 0x40f2c4
push dword [0x47bffc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40f2a9
mov eax, dword [0x47c008]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40f322
cmp dword [0x47c00c], edi
je 0x40f322
push eax
call ebx
push dword [0x47c00c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40f322
test eax, eax
je 0x40f322
call ecx
test eax, eax
je 0x40f317
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40f317
test byte [ebp - 8], 1
jne 0x40f322
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40f352
mov eax, dword [0x47c000]
cmp eax, edi
je 0x40f34f
push eax
call ebx
test eax, eax
je 0x40f34f
call eax
mov esi, eax
test esi, esi
je 0x40f34f
mov eax, dword [0x47c004]
cmp eax, edi
je 0x40f34f
push eax
call ebx
test eax, eax
je 0x40f34f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x47bffc]
call ebx
test eax, eax
je 0x40f36a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40f36c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040482b
mov esp, ebp
pop ebp
ret
Function at 0x4fda30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa6000]
push edi
jmp 0x4fda4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fda51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fda40
mov eax, 1
add ebx, ebx
jne 0x4fda63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fda74
jne 0x4fda93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fda93
dec eax
add ebx, ebx
jne 0x4fda80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fda58
add ebx, ebx
jne 0x4fda8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fdae5
xor ecx, ecx
sub eax, 3
jb 0x4fdaab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fdb1a
sar eax, 1
mov ebp, eax
jmp 0x4fdab6
add ebx, ebx
jne 0x4fdab6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fda84
inc ecx
add ebx, ebx
jne 0x4fdac4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fda84
add ebx, ebx
jne 0x4fdad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fdac6
jne 0x4fdae2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fdac6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fdb04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fdaf6
jmp 0x4fda46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fdb04
add edi, ecx
jmp 0x4fda46
pop esi
mov edi, esi
mov ecx, 0x55a5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fdb22
cmp byte [edi], 0x12
jne 0x4fdb22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fdb27
lea edi, [esi + 0xfb000]
mov eax, dword [edi]
or eax, eax
je 0x4fdb9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xfd634]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xfd6c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fdb54
mov ecx, edi
jns 0x4fdb83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xfd6d0]
or eax, eax
je 0x4fdb99
mov dword [ebx], eax
add ebx, 4
jmp 0x4fdb71
call dword [esi + 0xfd6cc]
mov ebp, dword [esi + 0xfd6d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fdbd3
sub esp, 0xffffff80
jmp 0x401194
Function at 0x8c2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008c21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8c207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c206a
add dl, dl
jne 0x8c2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c20dc
xor eax, eax
add dl, dl
jne 0x8c2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c217d
add dl, dl
jne 0x8c20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8c20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8c2075
mov eax, 1
add dl, dl
jne 0x8c20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c20e1
sub eax, ebx
mov ebx, 1
jne 0x8c2128
mov ecx, 1
add dl, dl
jne 0x8c210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8c213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c2136
cmp eax, 0x7d00
jae 0x8c216d
cmp eax, 0x500
jb 0x8c2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c2075
cmp eax, 0x7f
ja 0x8c2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8c219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8c2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000e430
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x8c
push 0xffffffffffffffff
push 0x102b4c03
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1036a00c]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0x94]
mov dword [ebp - 0x1c], edi
mov dword [ebp + 0x84], 0
mov dword [ebp + 0x84], 0
mov dword [ebp - 4], 0
push dword [edi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
mov dword [ebp - 0x14], esi
push 0x84
push 0
lea eax, [ebp]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp], 0
mov byte [ebp - 4], 1
test esi, esi
jle 0x1000e59a
mov byte [ebp - 4], 2
lea eax, [esi + 1]
mov ecx, 2
mul ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
test edx, edx
ja 0x1000e5f2
jb 0x1000e4fd
cmp eax, 0xffffffff
ja 0x1000e5f2
cmp eax, 0x80
jbe 0x1000e516
push eax
lea ecx, [ebp]
call fcn.1000e9e0
mov dword [ebp - 4], 1
jmp 0x1000e53b
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x1000e53b
mov ecx, dword [ebp]
test ecx, ecx
jne 0x1000e560
mov byte [ebp - 4], cl
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x1000e555
lea ecx, [ebp]
call fcn.1000e8e0
mov dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x1000e5cd
lea eax, [esi + 1]
push eax
push ecx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1000e59a
mov byte [ebp - 4], al
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x1000e584
lea ecx, [ebp]
call fcn.1000e8e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x84]
call fcn.1000e870
xor eax, eax
jmp 0x1000e5cd
push dword [ebp]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
xor ebx, ebx
test esi, esi
je 0x1000e5b0
test eax, eax
setne bl
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x1000e5c4
lea ecx, [ebp]
call fcn.1000e8e0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
call fcn.102af935
lea esp, [ebp + 0x8c]
pop ebp
ret 4
push 0x80070216
call fcn.1000cb10
int3