joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a14c4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, eax
lea esi, [ebp - 9]
mov dl, 1
mov eax, dword [0x41830c]
call fcn.0040330c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a1613
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
jmp 0x4a15d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, ebx
call fcn.0041bef8
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4a152d
cmp eax, 0x100000
jb 0x4a1542
jmp 0x4a152f
jl 0x4a1542
push 0
push 0x100000
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0041c194
jmp 0x4a156e
mov eax, dword [ebp - 8]
call fcn.0041c678
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, ebx
call fcn.0041bef8
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0041c194
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x14]
jmp 0x4a15ac
mov edx, esi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.0041c124
xor eax, eax
mov al, byte [esi]
mov edx, dword [ebp - 4]
and edx, 0xff
xor eax, edx
mov eax, dword [eax*4 + 0x4bad04]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.0041bef8
cmp edx, dword [esp + 4]
jne 0x4a15cc
cmp eax, dword [esp]
pop edx
pop eax
jb 0x4a157c
jmp 0x4a15d0
pop edx
pop eax
jl 0x4a157c
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, ebx
call fcn.0041bef8
cmp edx, dword [esp + 4]
jne 0x4a15f2
cmp eax, dword [esp]
pop edx
pop eax
jb 0x4a14fb
jmp 0x4a15fa
pop edx
pop eax
jl 0x4a14fb
not dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a161a
mov eax, dword [ebp - 8]
call fcn.0040333c
ret
Function at 0x4a4fa8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x4a4fd2
cmp dword [ebx + 0x64], 0
jne 0x4a4fd2
cmp dword [ebx + 0x6c], 0
jne 0x4a4fd2
mov edi, esi
jmp 0x4a5059
cmp edi, 0xffffffff
jne 0x4a4fda
dec edi
jmp 0x4a5059
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x4a5059
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004a41fc
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4a5027
mov cx, word [esp]
sub cx, si
jmp 0x4a5029
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4a5010
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4a504f
mov cx, word [esp]
sub cx, si
jmp 0x4a5051
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4a5038
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4a50b6
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.004a4d44
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4a50a1
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4a50b6
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4a4fb2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a9844
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x4a9853
or edx, 0x200
test eax, 0x20000000
je 0x4a9887
test eax, 0x40000000
je 0x4a9872
test eax, 0x80000000
je 0x4a986d
or edx, 0x40
jmp 0x4a98ae
or edx, 0x20
jmp 0x4a98ae
test eax, 0x80000000
je 0x4a9881
or edx, 0x80
jmp 0x4a98ae
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x4a989f
test eax, 0x80000000
je 0x4a989a
or edx, 4
jmp 0x4a98ae
or edx, 2
jmp 0x4a98ae
test eax, 0x80000000
je 0x4a98ab
or edx, 8
jmp 0x4a98ae
or edx, 1
mov eax, edx
ret
Function at 0x413245
Capabilities:
Encode data using xor

Disassembly:
neg ebx
test eax, eax
mov dword [esp], ebx
je 0x413272
xor eax, eax
mov edx, dword [esi + 4]
mov ecx, dword [edi + 4]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esp]
and ecx, edx
mov edx, dword [edi + 4]
xor dword [edx + eax*4], ecx
mov edx, dword [esi + 4]
xor dword [edx + eax*4], ecx
inc eax
cmp eax, dword [edi]
jb 0x413250
add esp, 4
pop esi
pop edi
pop ebx
ret

Function at 0x413603
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x41367f
mov eax, dword [eax + 4]
mov dword [esp + 4], 0
mov dword [esp], ecx
mov dword [esp + 8], eax
xor eax, eax
xor ebx, ebx
xor ebp, ebp
dec eax
mov edx, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov esi, edx
mov eax, dword [eax + ebp*4]
mov edi, ecx
mov edx, eax
or edi, eax
and eax, 1
shr edx, 1
xor edi, esi
or eax, edx
neg eax
mov edx, eax
shr edx, 0x1f
neg edx
sbb ecx, ecx
and edx, edi
mov edi, dword [esp + 0xc]
sar eax, 0x1f
and ecx, ebx
xor edx, esi
xor ebx, ecx
mov ecx, ebp
inc ebp
xor ecx, edi
and eax, ecx
xor eax, edi
cmp dword [esp], ebp
jne 0x41362f
shl eax, 5
or eax, 1
jmp 0x413687
xor edx, edx
mov eax, 0xffffffe1
dec edx
mov ecx, 0x10
xor esi, esi
mov edi, edx
shr edi, cl
mov ebx, edi
xor edi, edx
neg ebx
sar ebx, 0x1f
and edi, ebx
and ebx, ecx
xor edx, edi
add esi, ebx
shr ecx, 1
jne 0x41368e
add eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41ab24
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x11c
mov eax, dword [0x4b507c]
mov ebp, dword [esp + 0x134]
mov edi, dword [esp + 0x130]
xor eax, esp
mov dword [esp + 0x118], eax
push 1
push 0x49dd7f
push edi
call fcn.0046b5c4
add esp, 0xc
xor eax, eax
push eax
push ebp
call fcn.004031c6
add esp, 8
push eax
push 0x4a361e
push edi
call fcn.0046b594
add esp, 0xc
push 0x7a
push ebp
call fcn.0040349e
add esp, 8
push eax
push 0x4a3635
push edi
call fcn.0046ba1d
cmc
push cs
add eax, 0xcc48300
push 0x7b
push ebp
call fcn.00403081
add esp, 8
push eax
push 0x4a3381
push edi
call fcn.0046b5c4
add esp, 0xc
push 0x7c
push ebp
call fcn.00403081
add esp, 8
push eax
push 0x4a2507
push edi
call fcn.0046b5c4
add esp, 0xc
push 0x7d
push ebp
call fcn.00402fe1
add esp, 8
movzx eax, al
push eax
push 0x4a24d9
push edi
call fcn.0046b5c4
add esp, 0xc
push 0x7e
push ebp
call fcn.00402fe1
add esp, 8
movzx eax, al
push eax
push 0x4a08de
push edi
call fcn.0046b5c4
add esp, 0xc
push 0x7f
push ebp
call fcn.00402fe1
add esp, 8
movzx eax, al
push eax
push 0x49f57c
push edi
call fcn.0046b5c4
add esp, 0xc
push 0x80
push ebp
call fcn.00402fe1
add esp, 8
movzx eax, al
push eax
push 0x4a58b7
push edi
call fcn.0046b5c4
add esp, 0xc
push 2
push ebp
call fcn.00403081
add esp, 8
mov edx, dword [0x48e060]
mov ecx, 0x49d602
test edx, edx
je 0x41ac08
mov esi, 0x48e064
cmp dword [edx + 0x44], eax
je 0x41ac05
mov edx, dword [esi]
add esi, 4
test edx, edx
jne 0x41abf5
jmp 0x41ac08
mov ecx, dword [edx + 0x40]
push ecx
push 0x4a1ded
push edi
Function at 0x4472d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ecx
xor ecx, ecx
xor edi, edi
mov esi, edx
mov eax, 8
inc edi
push ecx
push eax
push edi
call fcn.00410d50
add esp, 0xc
mov ebp, eax
xor eax, eax
mov ecx, ebx
dec eax
shl eax, cl
mov ecx, dword [esp + 0x30]
shl edi, cl
mov dword [esp + 4], eax
xor eax, eax
push eax
mov eax, 8
push eax
push edi
call fcn.00410d50
add esp, 0xc
lea edx, [edi - 1]
test edi, edi
mov dword [ebp + 4], eax
mov dword [ebp], edx
jle 0x447370
mov word [eax + 2], 0xffff
mov eax, dword [ebp + 4]
mov byte [eax], 0
mov eax, dword [ebp + 4]
mov dword [eax + 4], 0
mov edx, dword [ebp]
test edx, edx
jle 0x447370
xor eax, eax
mov ecx, dword [ebp + 4]
mov word [ecx + eax*8 + 0xa], 0xffff
mov ecx, dword [ebp + 4]
mov byte [ecx + eax*8 + 8], 0
mov ecx, dword [ebp + 4]
mov dword [ecx + eax*8 + 0xc], 0
inc eax
mov edx, dword [ebp]
cmp eax, edx
jl 0x44734b
cmp dword [esp + 0x24], 0
jle 0x4473fb
add byte [eax], al
invalid
xor eax, eax
mov ebx, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 0xc], ebp
mov ebx, dword [esp + 0x2c]
Function at 0x4560d8
Capabilities:
Encode data using base64

Disassembly:
movsx ebx, byte [ecx + edx + 4]
mov eax, ebx
add al, 0xbf
cmp al, 0x19
ja 0x4560d6
add ebx, 0xffffffbf
jmp 0x456113
mov eax, ebx
add al, 0x9f
cmp al, 0x19
ja 0x4560e3
add ebx, 0xffffffb9
jmp 0x456113
mov eax, ebx
add al, 0xd0
cmp al, 9
ja 0x4560f0
add ebx, 4
jmp 0x456113
cmp bl, 0x2b
je 0x45610a
cmp bl, 0x3d
je 0x456111
cmp bl, 0x2f
jne 0x456195
mov ebx, 0x3f
jmp 0x456113
mov ebx, 0x3e
jmp 0x456113
mov ebx, esi
mov dword [esp + edx*4 + 0x10], ebx
inc edx
jne 0x4560c4
mov eax, dword [esp]
xor esi, esi
cmp eax, 0xffffffff
je 0x456197
mov edx, dword [esp + 4]
cmp edx, 0xffffffff
je 0x456197
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
cmp ecx, 0xffffffff
je 0x45614b
mov ebp, 3
cmp ebx, 0xffffffff
jne 0x456156
mov ebp, 2
jmp 0x456153
cmp ebx, 0xffffffff
jne 0x456197
xor ebp, ebp
inc ebp
xor ebx, ebx
dec ebx
shl eax, 0x12
shl edx, 0xc
or eax, edx
shr eax, 0x10
cmp ebp, 2
mov byte [edi], al
jb 0x456190
shl ecx, 6
mov esi, 2
mov eax, ecx
and eax, 0xf00
or eax, edx
cmp ebp, 3
mov byte [edi + 1], ah
jne 0x456197
xor esi, esi
inc esi
jmp 0x456197
xor esi, esi
Function at 0x458b89
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x540
mov eax, dword [0x4b507c]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
xor eax, ebp
mov dword [esp + 0x538], eax
mov eax, dword [edi + 4]
mov esi, dword [ecx]
test eax, eax
je 0x458c43
cmp byte [eax], 0
je 0x458ccd
mov edi, esi
xor esi, esi
xor eax, eax
inc eax
push esi
push 0x20
push eax
call fcn.00410d50
add esp, 0xc
mov dword [eax], esi
mov dword [esp + 0x14], edi
mov dword [eax + 4], edi
mov edi, dword [ebp + 0x14]
mov ecx, 1
mov dword [eax + 8], ecx
mov dword [eax + 0x10], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x18], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x1c], esi
push eax
push dword [ebp + 0xc]
call fcn.00458ac8
add esp, 8
mov eax, dword [edi + 8]
mov ecx, dword [ebx + 0xc]
test eax, eax
lea edx, [ecx - 4]
cmovne edx, ecx
mov dword [ebx + 0x18], edx
je 0x458c20
add ecx, 8
mov dword [ebx + 0xc], ecx
add ecx, 4
mov dword [ebx + 0xc], ecx
add dword [ebx + 0x10], 0xfffffff2
add dword [ebx + 0x14], 7
mov esi, dword [esp + 0x14]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], eax
inc esi
cmp dword [edi + 4], 0
jne 0x458ccd
cmp dword [edi + 8], 0
je 0x458ccd
xor edi, edi
xor ebx, ebx
inc ebx
push edi
push 0x20
push ebx
call fcn.00410d50
add esp, 0xc
mov dword [esp + 0x14], esi
mov esi, eax
mov dword [eax], edi
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
push dword [eax + 8]
call fcn.00455b15
add esp, 4
mov dword [esi + 0x1c], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
push esi
mov esi, dword [esp + 0x18]
push dword [ebp + 0xc]
call fcn.00458ac8
add esp, 8
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
lea edx, [eax + 0xf]
mov dword [ebx + 0xc], edx
mov edx, 0xc
push esi
push edi
push edi
push 0x5000000d
push 0x4a6ca4
push edx
push ecx
push eax
push 3
push ebx
call fcn.004579eb
add esp, 0x28
inc esi
mov dword [esp + 0x14], esi
lea edi, [esp + 0x2f8]
mov ecx, 9
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x14]
cmp dword [esi + 0x10], 0
je 0x4596d5
xor edi, edi
xor ebx, ebx
inc edi
mov dword [esp + 0x20], edi
xor edi, edi
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
Function at 0x45d233
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00460f31
push dword [0x4b6cac]
call fcn.00410dcd
add esp, 4
mov eax, dword [0x4b6ca8]
test eax, eax
je 0x45d257
push eax
call dword [0x4b2cd0]
mov esi, dword [esp + 8]
call fcn.00467c90
push 2
push dword [0x4b7678]
call fcn.00403281
add esp, 8
cmp eax, 3
jne 0x45d27a
call fcn.0043ec58
call fcn.00465ef5
call dword [0x4b2f58]
push esi
call fcn.0047a10b
Function at 0x46be64
Capabilities:
Encode data using xor

Disassembly:
inc esp
and al, 8
push eax
push ecx
push esi
mov dword [esp + 0x18], ebx
push dword [ebx]
push dword [esp + 0x38]
call dword [0x4b2fac]
test eax, eax
mov dword [esp + 0x10], eax
je 0x46bff1
add byte [eax], al

Function at 0x485d57
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00485d62

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x707b3013
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x225c108f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40d2ce
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407cfb
mov dword [ebp - 0x14], eax
cmp dword [0x4ad618], esi
jne 0x40d3c1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d34e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d4a1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d4a1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d4a1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ad618], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ad61c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ad620], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad628], eax
test eax, eax
je 0x40d3be
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad624], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d3e6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d3d9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d3fb
push 4
pop eax
jmp 0x40d4a3
cmp dword [ebp - 0x14], esi
je 0x40d3fb
push dword [0x4ad618]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d3e0
mov eax, dword [0x4ad624]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d459
cmp dword [0x4ad628], edi
je 0x40d459
push eax
call ebx
push dword [0x4ad628]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d459
test eax, eax
je 0x40d459
call ecx
test eax, eax
je 0x40d44e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d44e
test byte [ebp - 8], 1
jne 0x40d459
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d489
mov eax, dword [0x4ad61c]
cmp eax, edi
je 0x40d486
push eax
call ebx
test eax, eax
je 0x40d486
call eax
mov esi, eax
test esi, esi
je 0x40d486
mov eax, dword [0x4ad620]
cmp eax, edi
je 0x40d486
push eax
call ebx
test eax, eax
je 0x40d486
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ad618]
call ebx
test eax, eax
je 0x40d4a1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d4a3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040440e
mov esp, ebp
pop ebp
ret
Function at 0x410535
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xaaaa8b98
mov byte [edx - 0x67], ch
push 0xffffffffffffff99

Function at 0x4189ed
Capabilities:
Encode data using xor

Disassembly:
div bh
cmp byte [ebx + 0x5c42bf3d], dh
xlatb
fidivr dword [edx - 0x54]
dec ebp
int3
pop ds
sub dword [esi - 0x4995f747], 0xee584f7c
pop ecx
and bh, byte [0xa2d6efe2]
invalid
cmp edi, dword [edx + 0x9e468fd]
popal
salc
shl dword gs:[ecx + 0x39a893bd], 1
mov ah, 0x45
je 0x418a77
mov ds, esi
dec ebp
movsd dword es:[edi], dword [esi]
cmp bl, cl
sal dword [0x8e739546], cl
inc esi
xchg ebp, eax
jae 0x41899a
push esp
push edi
or bl, dh
sbb byte [ebp - 0x33], bl
int1
loope 0x418a08
sub byte [ebx - 0x58], 0x8a
in eax, 0xd2
jecxz 0x418a52
xchg esp, eax
stc
mov al, byte [0x1ad4521c]
ljmp 0xe91d
pop esp
loope 0x418a90
clc
rcl dword [ebx]
outsb dx, byte [esi]
pop edi
xor dl, bh
pushal
out 0xe0, al
and byte [edi + 0x1f], cl
ja 0x4189d7
fnstsw word [ecx + ecx*4 - 0x5ec3f298]
loopne 0x418ac3
sub ebx, dword [0xc9b55bbd]
hlt
mov ebp, 0xf4c9b55b
and eax, dword [esi + 0x249a2635]
inc edi
sub cl, 0x77
int1
call 0xacafe6e8
not byte [edi]
outsd dx, dword [esi]
mov esi, dword [edi + 0x7d]
jle 0x418a34
and esi, dword [ebx]
fstp st(5)
lds esi, [ecx + 0x46]
je 0x418abc
inc esp
loopne 0x418ae6
xchg edi, eax
dec esp
test byte [edi + ebp*8 + 0x55], 0x8e
in al, 0x64
pop edx
xchg byte [esi + 0x2c19b67e], bh
mov esp, 0x606415a6
mov edx, dword [ebx + 0x54757c96]
xchg ebx, eax
xchg esi, eax
jl 0x418b09
push esp
push 0xe2423429
fld xword [0xb4e2e0fe]
ja 0x418ab6
sub byte [ebx], ah
and al, 0xc2
pop edx
inc edx
push ds
loop 0x418b1a
push edi
cmp esp, dword gs:[esi + 0x42]
pop edi
sahf
in al, dx
jle 0x418a5d
pop edx
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
sub byte [ebx + 0x40], bh
daa
inc ebx
push eax
push ds
invalid
add dword [ecx + 0x34], esp
pushal
xor al, 0x60
xor ebp, edi
invalid
dec edx
loop 0x418ac5
fld st(4)
fst dword [edx + 0x5c]
push ds
add ch, 0x21
push ecx
xchg ecx, eax
sti
lodsb al, byte [esi]
or byte [ebx], dl
xor dword [ebp + 0x7c], ebx
salc
sar dword [esi + 0x798f70d8], 1
retf
retf 0xab25
sar dword [ebp + 0x2211159d], 1
stosb byte es:[edi], al
mov ebp, 0x111edf24
add al, 0x43
leave
xor dword [edi + 0x466565a4], 0xffffffc8
xchg ecx, eax
xchg esi, eax
nop
int1
loop 0x418b45
mov dword [0x26524243], eax
jne 0x418b6c
mov byte gs:[0xdbc33c86], al
push ds
pop ss
ret
adc dword [ebp - 0x4f6aa448], 0x6dc992fa
mov cl, 2
scasb al, byte es:[edi]
dec ebp
mov cl, dl
and byte [0x22cd9491], bl
mov bl, 0xe
inc esp
mov eax, 0x9a070988
sub dword [0x6b46dd76], 0xffffffac
mov esi, dword [esi - 0x6f]
retf
Function at 0x12f4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x12f41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x12f407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x12f406a
add dl, dl
jne 0x12f4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x12f40dc
xor eax, eax
add dl, dl
jne 0x12f4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x12f417d
add dl, dl
jne 0x12f40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12f40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12f40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12f40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x12f40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x12f4075
mov eax, 1
add dl, dl
jne 0x12f40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x12f40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12f40e1
sub eax, ebx
mov ebx, 1
jne 0x12f4128
mov ecx, 1
add dl, dl
jne 0x12f410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x12f4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12f4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12f4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x12f413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x12f414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12f4136
cmp eax, 0x7d00
jae 0x12f416d
cmp eax, 0x500
jb 0x12f4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12f4075
cmp eax, 0x7f
ja 0x12f4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12f4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x12f419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x12f4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx