joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424a70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x424a92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x424a99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x424a88
mov eax, 1
add ebx, ebx
jne 0x424aab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x424aa0
jne 0x424abc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x424aa0
xor ecx, ecx
sub eax, 3
jb 0x424ad0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x424b42
mov ebp, eax
add ebx, ebx
jne 0x424adb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x424ae8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x424b0c
inc ecx
add ebx, ebx
jne 0x424af8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x424aed
jne 0x424b09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x424aed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x424b2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x424b1d
jmp 0x424a8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x424b2c
add edi, ecx
jmp 0x424a8e
pop esi
mov edi, esi
mov ecx, 0x505
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x424b4a
cmp byte [edi], 0xc
jne 0x424b4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x424b4f
lea edi, [esi + 0x22000]
mov eax, dword [edi]
or eax, eax
je 0x424bc7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x26a34]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x26ae8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x424b7c
mov ecx, edi
jns 0x424bab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x26aec]
or eax, eax
je 0x424bc1
mov dword [ebx], eax
add ebx, 4
jmp 0x424b99
call dword [esi + 0x26af0]
popal
jmp 0x4139ec
Function at 0x4030bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4030ca
pop dword [ebp - 0x10]
mov eax, 0xcfe58109
sub eax, 0xcfa5503f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x964c823e
sub dword [ebp - 0x20], 0x47fa3cf3
mov dword [ebp - 0x1c], 0x2b2cac25
add dword [ebp - 0x1c], 0x706a020
mov dword [ebp - 0x18], 0x217f4e7b
sub dword [ebp - 0x18], 0xd5330a4d
mov dword [ebp - 0x14], 0x961f63b
sub dword [ebp - 0x14], 0x961f63b
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x4dfd8c2c
add dword [ebp - 0x20], 0x2674dd2a
mov dword [ebp - 0x1c], 0x4c234d4b
sub dword [ebp - 0x1c], 0xab6ebd6
mov dword [ebp - 0x18], 0xf21c9891
sub dword [ebp - 0x18], 0x8ead2c25
mov dword [ebp - 0x14], 0x8a96fc03
add dword [ebp - 0x14], 0x756903fd
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x792a4f42
add eax, 0x871631be
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x365ec
push 0
call eax
mov ecx, 0xe5751f53
add ecx, 0x1a8b2635
mov edi, eax
mov ebx, 0x136ad530
sub ebx, 0x1325d130
add ebx, dword [ebp - 0x10]
mov edx, 0x5a0a18dd
xor dword [ebp - 0xc], 0x8ce2d9cf
mov esi, dword [ebx]
xor dword [ebp - 0xc], edx
xor esi, edx
add dword [ebp - 0xc], 0x584a3f56
mov dword [edi], esi
xor dword [ebp - 8], 0x375da9c7
add edi, 0xfa342eaf
add edi, 0x5cbd155
add ebx, 4
loop 0x4031e1
add eax, 0x781b13d5
add eax, 0x87e5f51e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x408431
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
stosd dword es:[edi], eax
cmp byte [esi], 0x58
mov cl, byte [edi + 0x3f88b4fa]
mov byte [edi], bh
int3
dec ecx
outsb dx, byte [esi]
jnp 0x4083a1
movsd dword es:[edi], dword [esi]
jecxz 0x4083a3
jae 0x4083aa
push ebx
mov bh, 0xa2
aam 0x32
dec esi
or al, 0xd0
cmp al, cl
sub bh, bh
sub al, 0x38
xchg edx, eax
or byte [ecx + 0x27], bh
mov esp, dword [edi - 0x1386bce3]
mov cl, 0xe2
push ebx
xor dl, cl
loopne 0x408410
loop 0x408464
jbe 0x408430
or dword [edi], eax
sub ah, byte [ebp - 0x3d]
loop 0x40847f
dec ebp
das
add al, ch
mov bh, 8
dec ecx
mov eax, edi
js 0x4083fe
pop ebx
rcr dword [eax - 0x447cc8bf], 0xba
sbb edi, dword ss:[ecx - 0x111d5c4f]
out 0xc2, al
mov es, word [esi - 0x209d73d0]
or eax, 0x1d76fa90
ret 0x49d4
sbb eax, 0xf399cf9c
sar dword [ebx + 0x22], cl
retf 0xeed5
test dh, dh
pop edx
inc edx
jnp 0x40843c
push esi
lahf
adc eax, dword [esi + esi*8]
add al, 0xf6
mov edi, 0xfca27f7
mov ebx, 0x6e97cdd0
movsb byte es:[edi], byte [esi]
rol byte [ebx - 0x254da500], cl
xor dl, byte [ebx]
or dh, dl
aad 0x40
loope 0x40850b
stosb byte es:[edi], al
jle 0x408511
clc
push ebp
inc ebx
js 0x4084bd
mov esi, 0x570842aa
int 0xd4
cdq
mov byte [0x43de1001], al
xor esp, dword [eax + 0x2a]
xor ch, byte [edx - 0x5a8e6deb]
pushal
fiadd word [ebx + 0x33]
pushal
sub dh, byte [edx]
stosb byte es:[edi], al
adc eax, 0x60a57192
stosd dword es:[edi], eax
inc edx
xchg dword [edx], ebp
movnti dword [ebx + 0x4da2bad2], esp
mov eax, 0xfdf2ceda
bound esi, qword [edx]
mov dword [ebx - 0x1ec04f50], ebx
and ch, byte [ecx - 0x142cfc82]
pop ds
lcall 0x74f1, 0xa5df71ac
sub dword [edx], eax
jo 0x408476
sub cl, byte [edi]
ret
pop esp
salc
scasb al, byte es:[edi]
push 0x2a
inc ecx
shl bl, 1
pop edx
add eax, 0xffffffd4
jge 0x40847a
and bl, ch
inc ecx
fisttp dword [esi + 0x6c]
mov ebp, 0x516cc38e
mov dword [edx - 0x51d97569], ebp
wait
mov edi, 0x163ca6e0
cmpsb byte [esi], byte es:[edi]
cmp al, 0x16
mov edx, 0x99849e7f
invalid
jg 0x4084ab
test byte [ecx + 0x22673f8e], bl
invalid
and al, dh
mov al, byte [0x2d26bb1a]
add al, 0x43
push esi
jle 0x4084ae
pop ss
in al, 0x36
popfd
fisub word [ecx]
daa
xchg esi, eax
out dx, al
fisubr word [ebx - 0x4149ba3a]
adc ecx, dword [0xed8eb93d]
sar dword [edx - 0x157e02b9], 0x16
jp 0x408556
mov eax, dword [0x3b63f5d3]
xchg ebx, eax
invalid
pop es
pop ds
bound eax, qword [esi]
sub dword [0xa5c4ac08], 0x71
dec esp
inc esp
cmpsd dword [esi], dword es:[edi]
pop dword [esi - 0x5dc92a5c]
jo 0x408507
jmp 0x1bc31a38
Function at 0x44a210
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, 0x190
push edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a2e2
lea ecx, [esp + 0x20]
push ebp
mov ebp, 4
push ecx
push edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a290
mov ebx, dword [esp + 0x1c]
xor esi, esi
test edi, edi
mov dword [esp + 0x14], ebp
je 0x44a2a9
mov eax, dword [0x65bb1c]
push 0x65b838
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop ebp
jne 0x44a2d7
or esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov edx, ebx
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x4c1441
Capabilities:
Encode data using xor

Disassembly:
jno 0x4c149c
cmc
ret
aaa
stc
pop eax
jb 0x4c145d
push esp
popal
daa
popal
pop esp
push esi
mov esp, 0x5f87b1c5
hlt
push ebp
sbb esp, dword [ebx - 0x1283a2ff]
mov dword [0xed7c5d01], eax
pop ebx
dec ecx
imul edi, dword [ebx + edi*2 - 0x1d], 7
mov es, esp
daa
clc
mov ebp, 0x7ac4895d
cmc
scasb al, byte es:[edi]
aad 0x25
add dword [eax - 0x687aa06b], esp
mov byte [edx - 0x5c], ah
ja 0x4c1459
salc
xchg esp, eax
push ss
sar esi, 1
add ebp, ebp
xor edx, eax
or edi, dword [ebx + edi]
jecxz 0x4c146c
xor ecx, dword [ebx]
arpl word [edi - 0x25fafe16], sp
xor byte [esi + 0x61], al
fisttp dword [edx + ebx*4 - 0x5a92a9be]
xchg dword [esp + ebp], esp
cmpsd dword [esi], dword es:[edi]
outsb dx, byte [esi]
or edx, dword [ecx]
adc byte [0x87d59725], cl
cmp edx, dword [ebx + 0x14]
shl dword [edi], 0x25
fidiv dword [ebp + 0x61]
cmp esp, esp
or eax, 0xd034d496
fst st(5)
xchg esp, eax
xor eax, 0x2ea5bc97
jae 0x4c146a
pop ss
mov esp, 0x6e7ff377
dec esp
pop ss
frstor dword [edi]
xchg dword [ebx + 0x6b7f9f77], esp
cmpsd dword [esi], dword es:[edi]
mov bh, 0xf4
mov cl, 0x32
push edx
lodsb al, byte ds:[esi]
xlatb
scasd eax, dword es:[edi]
les eax, [edx - 0x31bb6db3]
rcr dword [ecx + esi*8 + 0x4746b40a], 0x8d
insb byte es:[edi], dx
mov ebp, 0xa6ad153b
out 0x4b, eax
mov dh, ah
invalid
Function at 0x4e3c31
Capabilities:
Encode data using xor

Disassembly:
dec edx
invalid
push 0x29
push ebp
sub dl, byte [edx]
cmp eax, 0x9293d4c6
or al, al
invalid
mov dh, 0x78
daa
movsb byte es:[edi], byte [esi]
arpl word [esi], di
cmp byte [edx - 0x1e], 0x59
jnp 0x4e3b96
inc ebp
out dx, al
sbb edx, dword [ebx - 0x7ffd0bfe]
jno 0x4e3bb0
dec ecx
add ch, byte [esi - 0x5ce8a6da]
cli
aas
xchg edx, eax
ficomp word [edx]
imul ebp, eax, 0x68f6eb2b
dec edx
mov ch, 0xcc
xchg edi, eax
xor byte [ebx + 0x21], 0xd6
invalid
jb 0x4e3c7e
jecxz 0x4e3bef
dec ecx
mov cl, cl
sub edi, dword [eax]
add byte [edx], ah
imul edx, dword [ebx + 0x6a], 0x1b
wait
push ds
retf 0x8276
jmp 0x4e3cc3
jecxz 0x4e3cf7
adc byte [ecx + 0x36fbd74f], 0
retf 0x3d36
xor eax, 0xe34e12f8
dec ebx
dec eax
add al, ah
mov edi, edx
in eax, dx
add eax, 0x24856f2
jle 0x4e3cb2
push 0x13
or al, 0x93
cmp esi, ebx
xor dh, byte [esi + 0x3b]
ret 0xe657
mov bl, byte [edi - 0x39c45da3]
fld dword [0x6b70bbcb]
adc dl, ch
in al, dx
into
sal cl, 1
into
jmp 0xc6fbcea1

Function at 0x4e3ff1
Capabilities:
Encode data using xor

Disassembly:
retf 0x93af
jns 0x4e3fe5
les eax, [esi - 0xff66e72]
and byte [esi + edi*8], bl
sbb al, 0xfe
adc ebx, 0xc01d72a4
and dword [eax + 0x5942eb72], ebp
inc edx
pop ecx
jb 0x4e4009
shl byte [ecx], 0xa8
jb 0x4e3fdc
inc edx
pop ecx
jp 0x4e405a
pop ds
xchg byte [edi + 0x3d], dl
cmp ebp, dword [ecx - 0x3a]
push 8
pop es
add ecx, esi
lds edi, [ebx + 0x65]
xor eax, esp
fcmovnb st(0), st(1)
jne 0x4e3fa5
wait
or esp, dword [edx + 0x68]
push es
lodsb al, byte [esi]
jne 0x4e401f
pushal
shr dword [esi + 0x2a], 1
push cs
push cs
lcall 0x27a7, 0x93b7860e
xlatb
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
inc byte [esi - 0x35]
dec edi
dec edx
test byte [ebx], al
sbb dword [ebx + 0xe], 0x6b
xchg esi, eax
mov bh, 0x53
push 0xbfb04762
inc ebp
not byte [eax + 9]
mov bh, bh
xor byte [ebx + 0x5a8e720e], cl
jecxz 0x4e4023
inc esi
retf
xor dword [ecx], 0x27
sbb bh, byte [ebx]
stosb byte es:[edi], al
xchg esp, eax
add eax, 0xbb95daed
cmp bh, dl
pushal
ljmp 0x425b
xor al, 2
mov ebx, 0xc9033a17
or ecx, 0xffffff8a
dec ecx
mov dl, 0xa
jl 0x4e3fea
mov bl, 0xdd
ret
Function at 0x54bac1
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
popal
mov byte [ebx + 0x3b7b2287], al
push ss
fnstcw word [esi + 0x1e834d24]
jno 0x54bb4b
retf 0x50d5
jmp 0x20e6a3f3
movsb byte es:[edi], byte [esi]
int1
das
cmpsb byte [esi], byte es:[edi]
push ss
imul ecx, dword [ebx], 0x143863b0
xchg dword [edx + 0x73eb0bbb], edx
sti
xchg edi, eax
or byte [edi + 0x37], dl
inc eax
jg 0x54bb8a
add ebp, edx
push esi
mov dword [0x1ac27e57], eax
add eax, 0x75d324ff
or eax, 0x6493b3d1
ret
dec eax
and al, 0xb2
jg 0x54bbcf
loopne 0x54baed
sub byte [ebp + 0x32682096], dh
lahf
cdq
jns 0x54bb13
dec eax
dec ebx
dec edx
inc edi
movsd dword es:[edi], dword [esi]
xchg edx, eax
cmp cl, byte [ebx]
mov al, byte [0xc4563e06]
or esp, dword [eax - 0x3ba9c1fa]
push es
push esi
les esp, [edx + 0x60d81084]
mov byte [0x60d81084], al
mov ebx, 0x1bed0fc7
jnp 0x54bb66
loope 0x54bb64
mov ebp, 0x662821
arpl word [esi + 0x559e4632], dx
xchg esi, eax
xor al, byte [esi - 0x62]
push ebp
cmp esp, esi
test dword [esi], eax
inc ebp
push ds
mov al, byte [0xb347d4a6]
mov edi, 0xf3d2d66b
inc ecx
cmpsb byte [esi], byte es:[edi]
aam 0x47
mov bl, 0xbf
imul edx, esi, 0xffffffd2
inc ecx
shl byte [0xe56e3be9], cl
bound edi, qword [edi]
mov dh, 0xc5
call 0x3a6a1a91
xor al, 0x73
popfd
ja 0x54bb7e
xor dword [ebx + 0x58], ebx
inc eax
inc ecx
pop es
sub dword [esi - 0x47e7927], esi
push edx
push eax
push ds
push ebp
inc eax
jns 0x54bbcf
sub esi, dword [ebp + esi*2 + 0x23]
invalid
inc ebx
aam 0xcd
invalid

Function at 0x5950d1
Capabilities:
Encode data using xor

Disassembly:
sub dword [edi + 0x5fb966bd], edx
push ds
jmp 0xc887fb8d
popal
adc bh, bl
push ds
cmp dh, bl
mov ecx, 0xcd6ee11b
sbb dword [eax], ebx
mov ch, 0xa
push esp
ja 0x595105
int 0x19
sbb byte [ebp + 0x7277540a], dh
push es
sal byte [esi + 0x4f], 1
xlatb
mov cl, 0x10
sbb al, 0x58
pop esp
pop es
sbb ebp, dword [ebx + 0x3a]
adc dword [eax - 0x38964474], ebx
xchg dword [esi + 0x15], edx
sub byte [edi], ch
sahf
loop 0x595038
sbb eax, 0xe76d355e
shl ah, cl
retf 0x3686
pop ecx
std
invalid
mov eax, dword [0xa8f76a28]
jne 0x595081
mov dword [0xaf2b88ea], eax
mov ebp, fs
pop ecx
fidivr word [eax]
xor al, 0x79
ja 0x5950ce
push es
test al, 0x9e
scasb al, byte es:[edi]
xchg edx, eax
fild word [eax]
sbb dl, byte [esi + 0x72809e8c]
sub eax, 0x477784c
xchg edi, eax
jns 0x59508b
retf
shl byte [ecx + ebx*2 - 0x48e9a671], 1
mov byte ds:[edx + 0x669c818a], bl
cmp al, 0x27
inc ebx
and byte [ebx - 0x68bb9d1], dl
out 0x98, al
outsb dx, byte [esi]
cdq
sub eax, 0x38a7196d
fisub word [ebx - 0x38]
adc al, 0xdd
imul eax, eax, 0x4225caf
or byte [esi - 0x42f32598], al
iretd
Function at 0x59c981
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
out 0xb9, al
mov ds, word [ecx - 0x4a]
dec eax
fcom dword ds:[esi]
push cs
wait
das
aaa
inc eax
and ch, byte [ebx - 6]
mov dword [edx + 3], ebp
jns 0x59c9e2
shr dword [eax + ebx*2 - 0x59e61bc5], 1
fist dword [ebx]
pop edi
inc ebp
xchg esi, eax
in eax, dx
cdq
inc esi
scasb al, byte es:[edi]
dec ecx
sub al, 0xea
xor eax, 0xcad23486
jmp 0x59ca2a
and byte [esp + esi*2 - 0x30], al
retf 0x658
push cs
movsd dword es:[edi], dword [esi]
fiadd word [eax + edi*4 - 0x246ce9ed]
nop
push es
test al, 0xf5
insb byte es:[edi], dx
sub eax, 0x28c88a35
invalid

Function at 0x59caf1
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
test dh, 0x19
sub byte [esi + 0x51909f03], dl
test byte [eax + 0x8e77cc7], 0x9b
outsd dx, dword [esi]
pop dword [esi]
lodsb al, byte [esi]
adc dword [ebx + 0x47ead739], ebp
imul edx, dword [edi], 0x1bd56069
sub al, 7
and eax, 0xc89698c2
inc ebp
cdq
scasb al, byte es:[edi]
invalid
push 0xffffffffffffffd7
add eax, 0x8b1ca6f7
xchg esi, eax
not byte [edi - 0x239019d7]
dec edi
js 0x59ca85
and byte [eax + 0x3d], ch
mov ecx, 0x2b46e864
push ss
rol dword [0xc36d637b], cl
lahf
mov ecx, 0x38588e88
push esi
mov ebx, 0xc7499614
pop eax
inc edi
test esp, ecx
mov eax, dword [0xc2679168]
shr byte [ebx - 0x370897e2], 0x26
imul esi, dword [edi], 0xc6955679
ror dword [ecx], 0x6a
sub eax, 0xe7339549
push 0x6926c8f7
aaa
jns 0x59cb87
xchg ebp, eax
mov cl, 9
push 0x2d
dec ecx
xchg ebp, eax
xor esp, edi
pop eax
xchg byte [ebp - 0x1408008b], bh
dec ebp
mov al, byte [0xe867f8db]
cmp byte [ecx], 0x1e
jb 0x59cb29
pop edi
add edx, dword [ebp + 0x1d2848f4]
inc ebx
sbb bl, ch
pop es
inc esp
and cl, byte [ecx]
dec edx
push edi
cmp byte [esi - 0x6a], dh
pop edi
stc
xor al, 0xb1
xor ah, byte [edi + edx*2 - 0x59]
mov ch, 0xa4
inc ecx
test eax, 0x2b1f2208
xor cl, cl
salc
popal
mov ch, 0xbf
enter 0x6943, 0xffffffffffffffb7
xchg esi, eax
push eax
or dword ds:[edx + 0x3c083e03], esp
xor dword [esi - 0x14328834], 0x18498fab
lodsb al, byte [esi]
aaa
or al, 0xac
dec edx
lea esi, [edx - 0x49]
pop edx
mov dl, 0x89
invalid
int 0xeb
stosd dword es:[edi], eax
invalid

Function at 0x5d1b15
Capabilities:
Encode data using xor

Disassembly:
dec edi
aas
leave
fsub dword [esi - 0x23b7521e]
outsd dx, dword [esi]
invalid
jne 0x5d1b48
jl 0x5d1b39
invalid
jae 0x5d1b07
or al, 0xfa
cld
pop ss
sbb bh, byte [edi - 0x31]
fsubr qword [edx]
or bh, byte [edx + ecx*2]
sbb byte es:[ecx + esi*2 + 0x37847f01], 0x42
sbb byte [ecx + esi*2 + 0x37847f01], 0x42
imul dword [ebp - 0xd]
pushfd
mov ch, 0x46
in al, dx
push edx
mov dh, ch
sbb dh, byte [edx]
out 0x31, eax
stosd dword es:[edi], eax
in al, dx
fptan
call [ebx]
shl dword [edi], 0x34
salc
invalid
Function at 0x984058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009841a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x98407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98406a
add dl, dl
jne 0x984089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9840dc
xor eax, eax
add dl, dl
jne 0x984096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98417d
add dl, dl
jne 0x9840a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9840b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9840bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9840c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9840d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x984075
mov eax, 1
add dl, dl
jne 0x9840ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9840f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9840e1
sub eax, ebx
mov ebx, 1
jne 0x984128
mov ecx, 1
add dl, dl
jne 0x98410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x984119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x984105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x984075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x98413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x98414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x984136
cmp eax, 0x7d00
jae 0x98416d
cmp eax, 0x500
jb 0x984168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x984075
cmp eax, 0x7f
ja 0x984170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x984075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x98419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x984075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406273
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406298
mov eax, dword [0x40a8a0]
cmp eax, 0xffffffff
je 0x40628f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a0], 0xffffffff
jmp 0x40630b
cmp dword [0x440a40], ebx
je 0x40630b
cmp byte [0x440640], bl
je 0x4062d7
cmp dword [0x40a8a0], 0xffffffff
jne 0x4062e0
push 4
push 0x40000000
push 0x440640
call fcn.00405c27
cmp eax, 0xffffffff
mov dword [0x40a8a0], eax
je 0x40630b
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a0], 0xffffffff
je 0x40630b
push esi
mov esi, 0x444a60
push 0x40aae8
push esi
call fcn.00405f75
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f68
push eax
push esi
push dword [0x40a8a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4064bd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44023c], esi
push edi
jne 0x4064f7
mov ecx, 0x440238
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4064d3
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440638
jl 0x4064ce
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40652c
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440238]
xor eax, esi
inc ecx
dec edx
jne 0x40650f
pop edi
pop esi
not eax
ret 0xc

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret