joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x308
cmp byte [0x406460], 0
push esi
mov esi, dword [esp + 0x310]
jne 0x401400
push esi
call fcn.00401180
add esp, 4
push 0x4050fc
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x401455
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push eax
push 0x40510c
call fcn.00401d60
add esp, 8
test eax, eax
jne 0x401500
push str.Could_not_load_python_dll
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call section..text
add esp, 8
xor eax, eax
pop esi
add esp, 0x308
ret
lea eax, [esp + 4]
push eax
mov eax, 0x405e20
call fcn.00401350
mov esi, eax
add esp, 4
test esi, esi
je 0x4014a4
push edi
push 0xb
push 0x405138
push esi
xor edi, edi
call dword [sym.imp.MSVCR90.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x401498
lea ecx, [esi + 0xf]
push ecx
push 0x405144
call fcn.00401d60
add esp, 8
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
test edi, edi
pop edi
jne 0x401500
push str.PYTHON27.DLL
push 0x406460
push 0x405164
lea edx, [esp + 0x14]
push 0x304
push edx
call dword [sym.imp.MSVCR90.dll__snprintf]
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00401d60
add esp, 0x1c
test eax, eax
jne 0x401500
push str.LoadLibrary_pythondll__failed
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call section..text
lea ecx, [esp + 0x10]
push ecx
push 0
call section..text
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x308
ret
mov eax, 1
pop esi
add esp, 0x308
ret

Function at 0x401540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x304
push esi
mov esi, dword [esp + 0x30c]
push str.ZLIB.PYD
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x4015ac
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x401654
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push eax
push 0x40518c
call fcn.00402520
add esp, 8
test eax, eax
je 0x401654
push 0x405198
push eax
call fcn.00402230
add esp, 8
test eax, eax
je 0x401654
pop esi
add esp, 0x304
jmp eax
push str.zlib.pyd
push 0x406460
push 0x4051bc
lea eax, [esp + 0x10]
push 0x304
push eax
call dword [sym.imp.MSVCR90.dll__snprintf]
add esp, 0x14
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x4015f7
push str.initzlib
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x4015f7
call eax
pop esi
add esp, 0x304
ret
push edi
push 0
mov eax, 0x405e20
call fcn.00401350
mov esi, eax
add esp, 4
mov edi, esi
test esi, esi
je 0x401653
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_strncmp]
push 0xb
push str._pythondll_
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x40162e
mov edx, dword [esi + 0xb]
lea edi, [esi + edx + 0xf]
push 0xa
push str._zlib.pyd_
push edi
call ebx
add esp, 0xc
pop ebx
test eax, eax
jne 0x40164c
add edi, 0xe
push edi
call fcn.00401510
add esp, 4
push esi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
pop edi
pop esi
add esp, 0x304
ret
Function at 0x401cb0
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, edi
mov esi, 0x4056a8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401cc1
sub eax, edx
add eax, edi
cmp eax, edi
je 0x401cda
cmp byte [eax], 0x5c
je 0x401cdf
dec eax
cmp eax, edi
jne 0x401cd0
cmp byte [eax], 0x5c
jne 0x401ce0
inc eax
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x401cfa
push edi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x401d54
cmp dword [0x4056a8], 0
je 0x401d25
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea esp, [esp]
mov eax, dword [esi]
push eax
push ebx
call edi
mov dword [esi + 4], eax
test eax, eax
je 0x401d2e
add esi, 8
cmp dword [esi], 0
jne 0x401d10
pop edi
pop esi
mov eax, 1
pop ebx
ret
push 0x405874
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ecx, dword [esi]
push ecx
push 0x405884
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x401d60
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, 0x4056a8
test eax, eax
jne 0x401d7d
mov eax, dword [esp + 8]
push eax
call fcn.00401cb0
add esp, 4
pop esi
ret
mov ecx, dword [esp + 8]
push edi
push eax
push ecx
call fcn.00402520
mov edi, eax
add esp, 8
test edi, edi
je 0x401de9
cmp dword [0x4056a8], 0
je 0x401dbb
jmp 0x401da0
mov edx, dword [esi]
push edx
push edi
call fcn.00402230
add esp, 8
mov dword [esi + 4], eax
test eax, eax
je 0x401dc3
add esi, 8
cmp dword [esi], 0
jne 0x401da0
pop edi
mov eax, 1
pop esi
ret
push str.undef_symbol
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov eax, dword [esi]
push eax
push str.undefined_symbol__s____exit__1__n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0xc
pop edi
xor eax, eax
pop esi
ret
Function at 0x401f60
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
xor edx, edx
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 8], 0
cmp dx, word [eax + 6]
jae 0x402007
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
push edi
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x401fc2
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x401feb
mov ecx, dword [esi - 4]
push 4
push 0x1000
push edi
add ecx, ebx
push ecx
call ebp
push edi
push 0
push eax
mov dword [esi - 8], eax
call sub.MSVCR90.dll_memset
jmp 0x401fe8
mov edx, dword [esi - 4]
push 4
push 0x1000
push eax
add edx, ebx
push edx
call ebp
mov ecx, dword [esi + 4]
add ecx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esi]
push eax
push ecx
push edi
call sub.MSVCR90.dll_memcpy
mov dword [esi - 8], edi
add esp, 0xc
mov edx, dword [esp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x401f93
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x402010
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor edx, edx
xor ebp, ebp
lea eax, [ecx + ebx + 0x18]
cmp dx, word [ebx + 6]
jae 0x4020c7
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x402067
mov eax, dword [edi - 0x14]
mov ecx, dword [edi - 0x1c]
push 0x4000
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x4020af
lea edx, [edx + ecx*2]
lea ecx, [esi + edx*2]
mov esi, dword [ecx*4 + 0x4058dc]
test eax, 0x4000000
je 0x402081
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40209c
test al, 0x40
je 0x402093
mov ecx, dword [ebx + 0x20]
jmp 0x40209a
test al, al
jns 0x4020af
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x4020af
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
inc ebp
add edi, 0x28
cmp ebp, eax
jl 0x402034
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x402520
Capabilities:
Parse pe header

Disassembly:
push ecx
push esi
mov esi, dword [0x405dfc]
push edi
test esi, esi
je 0x40254c
mov edi, dword [sym.imp.MSVCR90.dll__stricmp]
mov eax, dword [esi + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call edi
add esp, 8
test eax, eax
je 0x40256b
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x402533
push ebp
mov ebp, dword [esp + 0x18]
mov edx, 0x5a4d
cmp word [ebp], dx
je 0x402574
push 0xb
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop ebp
pop edi
xor eax, eax
pop esi
pop ecx
ret
inc dword [esi + 0x1c]
pop edi
mov eax, esi
pop esi
pop ecx
ret
push ebx
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
je 0x402592
push 0xb
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x34]
mov esi, dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call esi
mov edi, eax
test edi, edi
jne 0x4025d3
mov edx, dword [ebx + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov edi, eax
test edi, edi
jne 0x4025d3
push 8
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
pop ecx
ret
push 0x28
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x18]
push eax
mov dword [esi + 4], edi
mov dword [esi + 0x1c], 1
call dword [sym.imp.MSVCR90.dll__strdup]
add esp, 4
push 4
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov ecx, dword [ebx + 0x50]
push 0x1000
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edx, dword [ebx + 0x54]
push 4
push 0x1000
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ecx, dword [ebp + 0x3c]
add ecx, dword [ebx + 0x54]
mov dword [esp + 0x10], eax
push ecx
push ebp
push eax
call sub.MSVCR90.dll_memcpy
mov edx, dword [ebp + 0x3c]
mov eax, dword [esp + 0x1c]
push esi
add eax, edx
push ebx
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], edi
call fcn.00401f60
mov eax, edi
add esp, 0x18
sub eax, dword [ebx + 0x34]
je 0x40267a
push eax
mov eax, esi
call fcn.004020d0
add esp, 4
push esi
call fcn.004023a0
add esp, 4
test eax, eax
je 0x4026b2
push esi
call fcn.00402010
mov ecx, dword [esi]
mov eax, dword [ecx + 0x28]
add esp, 4
test eax, eax
je 0x4026d4
add eax, edi
jne 0x4026a7
push 0xb
call dword [sym.imp.KERNEL32.DLL_SetLastError]
jmp 0x4026b2
push 0
push 1
push edi
call eax
test eax, eax
jne 0x4026cd
mov edx, dword [esi + 0x18]
push edx
call dword [sym.imp.MSVCR90.dll_free]
push esi
call fcn.004022c0
add esp, 8
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov dword [esi + 0x10], 1
mov eax, esi
call fcn.00401df0
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1fe6521
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7b0f7a1c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4210f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x49af52d
xchg edx, eax
mov bh, byte [edx - 0x28]
cdq
xchg ecx, eax
push edx
into
sub eax, 0xbaf5158c
lodsd eax, dword [esi]
loopne 0x4210ab
mov al, byte [0x31b8b700]
dec eax
sub ebp, dword [eax - 6]
dec esi
pop ebx
daa
dec ecx
xlatb
fdiv st(5)
jns 0x4210bb
retf
cmp cl, byte [edx]
call dword [ecx]
invalid
out 0xd0, eax
inc eax
mov al, byte [0xd6b8c564]
cli
int1
sbb bh, byte [ebp - 0xd]
jge 0x4210c9
enter 0x3f35, 0xfffffffffffffff9
inc ecx
inc ebp
xchg ecx, eax
jb 0x421116
loopne 0x421082
push 0xf2c0fbc7
cmc
xor al, 0xf3
add dword [0xb3487036], ebp
xchg ebx, eax
lodsb al, byte [esi]
inc esi
mov al, byte [0xfdeec3e5]
dec ecx
pop esp
insb byte es:[edi], dx
jl 0x42113c
xchg ecx, eax
push 0xe3d2473d
jae 0x421116
jb 0x421095
dec ebx
fidivr word [eax + 0x630ab6cb]
xchg dword [ecx - 8], ecx
mov byte [edi + 0x6a6d8d07], dl
clc
xchg esi, eax
mov word [edi + 0x20], ss
stosb byte es:[edi], al
js 0x4210ef
xchg esi, eax
loop 0x421199
daa
adc eax, 0x2245eb0d
mov edx, 0xa66b71d8
cmpsb byte [esi], byte es:[edi]
loopne 0x4210d4
ror dword [eax + 8], 1
adc eax, 0x186cc895
pop edx
push esi
invalid
jl 0x4211ac
mov ch, 0x56
jmp 0x16d4bb4d
dec ebx
sbb dword [edi], esp
mov dl, 0xa5
push ebp
push ebx
push ds
popfd
cmp al, 0x2d
sbb dl, dh
dec ecx
mov ss, word ss:[esi - 0x6c]
scasb al, byte es:[edi]
rol byte [eax + 0x14], cl
and eax, 0xebdee7c0
call 0xe404606e
js 0x421193
and eax, 0x1ae41954
add dword [esi + 0x60], 0x715f7faf
sahf
or edi, 0xd9d347b7
enter 0x7305, 0xffffffffffffffbc
invalid
ffree st(6)
outsb dx, byte [esi]
push di
fistp dword [0xcbae2e84]
sbb eax, 0xcbae2e84
inc esp
pop ebx
bound ebp, qword [0x48320748]
sbb al, 0x17
xor esp, dword [ebx - 0x1eba59f1]
mov dword [0x47509127], eax
inc ebp
loope 0x421152
daa
xchg ecx, eax
push eax
inc edi
arpl word [esi - 0x27668718], dx
test dword [edx - 0x70], ecx
xchg ebx, eax
xchg edi, eax
aam 0x55
dec ebx
push edx
pop ecx
sbb al, 0x25
or byte [ecx + 0xe], 0x13
outsd dx, dword [esi]
mov dword [eax], 0xba29a8aa
pop es
and dword [eax - 0x68154cc], edx
xor al, 0xab
jle 0x4211d0
pop esp
mov al, 0xc2
pop ss
xchg edx, eax
dec edx
mov byte [0x9cbb753c], al
sub byte [ecx - 0x3a], 0x32
mov dword [ebx + 0x7e9cdcb1], edx
leave
sub bh, al
jb 0x4211d3
add dword [edi - 0x66], esi
inc edi
dec edi
sub dword [ecx - 0x3a], ebx
cmpsd dword [esi], dword es:[edi]
sahf
inc esp
insb byte es:[edi], dx
add byte [esi + ecx*8 - 0x54], ah
pop esp
sahf
mov byte [ecx], bl
pop ds
out dx, al
jbe 0x42121a
add ah, dh
pop edi
sahf
lodsd eax, dword [esi]
jle 0x42126b
in al, dx
lodsb al, byte [esi]
jge 0x421210
add dword [ecx - 0x60ab6457], esi
push esp
lahf
fstp dword [ecx - 0x51914a68]
jmp 0x421210
mov ch, 0x7b
out 0x81, eax
call 0x4a0e4b29
xor eax, 0x1390e52b
dec ecx
ljmp 0x53a1
push ebx
cld
cld
out 0x75, eax
daa
mov ecx, 0x776ec991
scasb al, byte es:[edi]
inc edi
fisub word [esi + 0x27d9d79c]
enter 0x1120, 0xffffffffffffffc7
mov ch, 0x8b
leave
ja 0x421256
sub eax, 0x2de0cde0
and byte [edi - 0x17bf9618], bh
or dword [eax + 0x21], 0x7e
rcl byte [eax], cl
invalid
Function at 0xe81058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00e811a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe8107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe8106a
add dl, dl
jne 0xe81089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe810dc
xor eax, eax
add dl, dl
jne 0xe81096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe8117d
add dl, dl
jne 0xe810a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe810b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe810bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe810c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe810d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe81075
mov eax, 1
add dl, dl
jne 0xe810ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe810f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe810e1
sub eax, ebx
mov ebx, 1
jne 0xe81128
mov ecx, 1
add dl, dl
jne 0xe8110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe81119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe81105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe81075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe8113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe8114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe81136
cmp eax, 0x7d00
jae 0xe8116d
cmp eax, 0x500
jb 0xe81168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe81075
cmp eax, 0x7f
ja 0xe81170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe81075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe8119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe81075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xb62058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b621a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb6207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb6206a
add dl, dl
jne 0xb62089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb620dc
xor eax, eax
add dl, dl
jne 0xb62096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb6217d
add dl, dl
jne 0xb620a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb620b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb620bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb620c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb620d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb62075
mov eax, 1
add dl, dl
jne 0xb620ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb620f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb620e1
sub eax, ebx
mov ebx, 1
jne 0xb62128
mov ecx, 1
add dl, dl
jne 0xb6210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb62119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb62105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb62075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb6213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb6214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb62136
cmp eax, 0x7d00
jae 0xb6216d
cmp eax, 0x500
jb 0xb62168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb62075
cmp eax, 0x7f
ja 0xb62170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb62075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb6219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb62075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x11027a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x11519f8]
sub esp, 0xc
mov edx, 2
mov dword [0x11ebd60], edx
push ebx
mov ebx, dword [0x11519a2]
push esi
mov esi, eax
sub esi, dword [0x1151998]
add esi, 3
push edi
movzx edi, byte [0x11519a4]
mov dword [0x1151990], esi
nop word [eax + eax]
cmp eax, edi
je 0x1102802
movzx ecx, byte [edx + 0x11519a0]
add esi, 0xfffea69a
add eax, ecx
movzx ecx, bl
add esi, eax
mov dword [0x1151990], esi
cmp eax, ecx
je 0x110280a
add edx, 2
cmp edx, 0x2f
jl 0x11027e0
mov dword [0x11ebd60], edx
mov edx, dword [0x1151998]
mov dword [0x11519f8], eax
lea ecx, [edx*8]
sub ecx, edx
add ecx, eax
mov dword [0x1151994], ecx
movzx ecx, byte [0x11519b4]
call fcn.01101f50
mov ecx, dword [0x1151990]
push 0x7a8
sub ecx, eax
mov dword [0x1151998], eax
push 0x11ebd70
sub ecx, 6
mov dword [0x115199c], 0
push str.kill
mov dword [0x11519f8], ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, dword [0x1151994]
mov edx, str.langua
sub eax, dword [0x11519f8]
mov ecx, 0x1151f90
add eax, 3
mov dword [0x115199c], 0
push 0
push eax
sub esp, 8
mov dword [0x1151998], eax
call fcn.011048c0
add esp, 4
mov ecx, eax
call fcn.01102dc0
mov ecx, eax
call fcn.01102c50
mov edx, 0x1130558
mov ecx, eax
call fcn.011048c0
mov eax, dword [0x1151990]
mov ecx, 2
mov ebx, dword [0x11519b0]
sub eax, ebx
mov esi, dword [0x115199c]
add eax, 3
mov edi, dword [0x1151998]
mov dword [esp + 0x10], eax
movzx eax, byte [0x11519a4]
mov dword [0x11ebd60], ecx
mov dword [esp + 0x14], eax
cmp ebx, eax
je 0x1102926
movzx eax, byte [ecx + 0x11519a0]
cdq
add edi, eax
mov eax, dword [esp + 0x10]
adc esi, edx
add eax, 0xfffea69a
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [0x11519a2]
movzx eax, al
cdq
cmp edi, eax
jne 0x1102922
cmp esi, edx
je 0x110292e
mov eax, dword [esp + 0x14]
add ecx, 2
cmp ecx, 0x2f
jl 0x11028f2
lea eax, [ebx - 0x2371]
mov dword [0x1151998], edi
add eax, edi
mov dword [0x115199c], esi
pop edi
pop esi
mov dword [0x11519f8], eax
mov eax, dword [0x1151994]
mov dword [0x11ebd60], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1113cd8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01113b57
Function at 0x1001fba
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x30c
push 0x50
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov cl, byte [ebp + eax - 0xcc]
mov byte [ebp + eax - 0x7c], cl
inc eax
test cl, cl
jne 0x1001fd6
xor eax, eax
mov cl, byte [ebp + eax - 0xcc]
mov byte [ebp + eax - 0x2c], cl
inc eax
test cl, cl
jne 0x1001fe8
push esi
push edi
lea edi, [ebp - 0x7c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1001ffe
mov esi, 0x10011c8
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002012
mov esi, 0x10011b8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x294]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x2c]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0x74], eax
je 0x100213f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenFile]
xor eax, eax
mov cl, byte [ebp + eax - 0x7c]
mov byte [ebp + eax + 0x24], cl
inc eax
test cl, cl
jne 0x100204a
lea eax, [ebp - 0x268]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100205f
lea edi, [ebp + 0x24]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100206c
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.VEN_1039DEV_0900
lea eax, [ebp + 0x24]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.01001f0a
test eax, eax
je 0x1002126
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10020bb
test al, 1
je 0x10020bb
and eax, 0xfffffffe
push eax
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x200
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp + 0x24]
push eax
call ebx
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + 0x24]
sub ecx, 3
lea edi, [ebp + 0x24]
mov byte [eax + ecx], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10020e5
lea eax, [ebp + 0x24]
mov esi, 0x10011b4
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1002114
test al, 1
je 0x1002114
and eax, 0xfffffffe
push eax
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x200
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp + 0x24]
push eax
call ebx
lea eax, [ebp - 0x294]
push eax
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002048
pop ebx
pop edi
pop esi
add ebp, 0x78
leave
ret