joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461068
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461213
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4611f4
mov dl, 1
mov eax, dword [0x417934]
call fcn.00403ad8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404934
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4611e3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00452750
test al, al
je 0x4611d6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x461224
lea eax, [ebp - 0x254]
call fcn.00409cdc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4611d6
xor eax, eax
push ebp
push 0x4611cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x46125c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4611b8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404ba4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4611b8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404ba4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4611d6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4610d9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041bdbc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46121a
lea eax, [ebp - 0x260]
call fcn.00404934
ret

Function at 0x461b8c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x47acd0]
cmp byte [eax + 0xad], 0
jne 0x461bfd
cmp dword [0x47acec], 0
jne 0x461bbe
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x461b48
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x47acec], eax
cmp dword [0x47ace8], 0
jne 0x461bd9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x47ace8], eax
cmp dword [0x47acf0], 0
jne 0x461bfd
push esp
push 0
push 0
push 0x461aec
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x47acf0], eax
pop edx
ret
Function at 0x461e00
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x461e17
add esp, 0xfffffff0
call fcn.00403e2c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041ff10
mov eax, dword [0x474de4]
cmp word [eax + 2], 0
jne 0x461e3f
mov eax, dword [0x474de4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00463af0
mov eax, dword [0x474ea4]
cmp word [eax + 2], 0
jne 0x461e59
mov eax, dword [0x474ea4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00463cfc
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417384]
call fcn.00403ad8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417384]
call fcn.00403ad8
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x417384]
call fcn.00403ad8
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x424854]
call fcn.0042c4a8
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x462010
mov eax, dword [0x474cec]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042c87c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4643c0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x474cec]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d540
test eax, eax
je 0x461f60
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409694
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d574
test eax, eax
je 0x461f74
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404ba4
mov byte [ebx + 0xd4], 0
push ebx
push 0x46357c
call fcn.0042108c
mov dword [ebx + 0xc8], eax
mov eax, dword [0x474bac]
cmp byte [eax], 0
jne 0x461fc5
mov eax, ebx
call fcn.00462154
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004645d4
mov eax, ebx
call fcn.00465138
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x462005
call fcn.00403e84
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4623d4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x462473
cmp dword [ebx + 0x94], 0
jne 0x46246d
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46235c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46246d
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x462433
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46246d
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004198b4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x462442
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46268c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x47acd0]
cmp dword [eax + 0x30], 0
je 0x4627e9
test bl, bl
jne 0x46273a
cmp dword [esi + 0x9c], 0
jne 0x46272f
mov eax, esi
call fcn.00464fb4
push eax
push 0x4625b8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x462700
mov eax, dword [0x47acd0]
call fcn.00465694
test al, al
je 0x462700
mov eax, dword [0x47acf4]
call fcn.00405c5c
mov edi, eax
cmp edi, 0
jl 0x462700
push 0
mov eax, dword [0x47acf4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4626ea
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46272f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004198b4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46270f
inc dword [esi + 0x9c]
jmp 0x4627e9
cmp dword [esi + 0x9c], 0
jle 0x4627e9
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4627e9
cmp dword [esi + 0x44], 0
je 0x462795
mov eax, dword [0x47acd0]
call fcn.00465694
test al, al
je 0x462795
mov eax, dword [0x47acf4]
call fcn.00405c5c
mov edi, eax
cmp edi, 0
jl 0x462795
push 5
mov eax, dword [0x47acf4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46277f
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4627c4
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004198b4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4627a4
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x47acf4
mov ecx, 1
mov edx, dword [0x462598]
call fcn.00405e10
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4632d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x46333a
mov eax, ebx
call fcn.00465694
test al, al
jne 0x46333a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a24
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x463327
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x463347
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404988
jmp 0x463347
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404988
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4647b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x464826
mov eax, esi
call fcn.0044d380
test al, al
je 0x464826
mov eax, dword [ebx + 0x84]
call fcn.0044cfe0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x464826
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46481a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044cfe0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00444e18
jmp 0x464826
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004645f4
pop esi
pop ebx
ret
Function at 0x467ccc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407830]
call fcn.00405404
xor eax, eax
push ebp
push 0x467e6d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x474a40], 0
jne 0x467d27
mov ecx, dword [0x474bbc]
mov dl, 1
mov eax, dword [0x407e1c]
call fcn.0040c788
call fcn.0040437c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.0040343c
mov eax, ebx
call fcn.00405274
mov dword [ebp - 0x24], eax
mov esi, 0x467e7c
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004064f4
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405284
test eax, eax
jle 0x467e10
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x467dfc
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404ba4
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x467da2
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404bbc
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x467db8
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404bbc
mov eax, dword [ebp - 0x54]
call fcn.00404dc4
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404ba4
mov eax, dword [ebp - 0x58]
call fcn.00404dc4
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x467dfe
xor eax, eax
test al, al
je 0x467e09
mov ebx, 0x15
jmp 0x467e15
mov ebx, 0x10
jmp 0x467e15
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x474a40]
call fcn.00467b4c
mov eax, dword [ebp - 4]
call fcn.00467b4c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040650c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467e74
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404958
lea eax, [ebp - 0xc]
mov edx, dword [0x407830]
call fcn.004054d4
ret
Function at 0x406fc0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x406ffe
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x406ff6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407000
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x406fe6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4070d0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407101
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407101
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407101
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x40c7d0
nop
mov ecx, 0x65c8763c
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x42f314
mov ecx, 0x778f067b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x5ae2d1
Capabilities:
Encode data using xor

Disassembly:
lds ebp, [esi + 0x1f]
imul ebx, dword [edi - 0x5b], 0xffffffb6
sbb eax, eax
and eax, 0xf5e887c1
call 0x6e57f0cb
movsd dword es:[edi], dword [esi]
mov al, byte [0xb5d9a188]
enter 0x2b3e, 0x48
sbb dword [edi], esi
call 0x6e57f0cb
movsd dword es:[edi], dword [esi]
mov al, byte [0xb5d9a188]
enter 0x2b3e, 0x48
sbb dword [edi], esi
xlatb
or bl, 0x40
inc esi
aas
fxam
mov ch, 0x66
xchg ebp, eax
rol dword [ecx], 1
sub dword [esi + 0x3cb0568], eax
or eax, 0x8488a4dd
mov cl, 0x3b
out 0x69, eax
sub dh, byte [edi]
adc edx, 0xb17a01bf
shr byte [ebx - 0x45], 0xbe
outsd dx, dword [esi]
xor byte [edi], 0x50
jge 0x5ae30b
in al, dx
neg dword [edx + 0x147168ce]
push cs
mov dl, 0xf1
push ecx
cwde
popfd
out 0x11, eax
sal byte [esi - 0x2e], 0x45
sbb al, 0xb
daa
add bl, byte ds:[ecx - 0x49]
jae 0x5ae2c5
add ah, byte [ebx - 0x418fe023]
xor eax, 0x7faee18b
mov edi, 0x61ca4ba8
mov edx, cr5
shr dword [eax + 0x4e764527], 0xba
pop ecx
div byte [edx]
dec ebx
add al, 0xe5
call 0x44485906
salc
loop 0x5ae366
and dword [ebp - 0x1e1822dd], ebx
ret 0x2671
in eax, 0xfd
add ecx, ecx
bound ecx, qword [edx + 0x1ff6bf77]
xchg esi, eax
shr dword [eax + esi*8 + 0x25f63ca], 0xef
retf 0xf3a7

Function at 0x7701d1
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor al, 0
add eax, 0xf758081
xor byte [ebp + 0xf], 0x86
adc dh, al
push esi
shr eax, 1
add eax, edx
sar byte [ecx - 0x6d5da8f8], 1
jne 0x7701d7
xchg byte [eax], dl
invalid
sar byte [ecx - 0x6d5da8f8], 1
push cs
inc esp
push ebx
cmp dl, byte [edx + 0x26]
sbb ah, 0x8e
cmp edx, dword [edx]
call 0x3ec98b39
cmpsb byte [esi], byte es:[edi]
inc ebp
std
scasb al, byte es:[edi]
add byte [esi + 0x1e], dl
les ecx, [esi]
push 0xb61bb693
and edi, dword [ebx + 0x633057c]
adc ch, byte [ebx]
add eax, 0x2b120633
mov al, byte [0x52574919]
adc dword [ebp - 0x5f], 0x86038e96
loopne 0x7701c1
test al, 0x11
cmpsb byte [esi], byte es:[edi]
and dword [edx - 0x4f], edx
bound esi, qword [ecx - 0x59cf0dcb]
jb 0x7701c5
push cs
daa
mov edx, 0xdca135a1
push eax
out 0xa6, al
mov dword [esi + 4], 0xf786c574
and dword [ebp - 0x29d698cd], esp
lds eax, [esi + 0x33a521f7]
sub esi, edx
jno 0x7701c6
push ecx
lcall 0x4711, 0x4663f6c7
jecxz 0x770228
jmp 0x770240
xchg edx, eax
rol dword [bx + si], cl
adc byte [ebx], ah
jne 0x77029f
mov cl, 0x20
sal byte [edx - 0x3f], 0x55
add esp, dword [edx + 0x23]
adc dword [esi + eax + 9], eax
popfd
arpl bx, dx
lodsb al, byte [esi]
test edi, eax
fcom dword [edi - 0x39]
bound eax, qword [edi]
ror dword [eax + 0x7e], 1
push es
daa
outsb dx, byte [esi]
scasb al, byte es:[edi]
aaa
xor dword [ebx - 0x571198ee], esp
ja 0x7701f8
in al, dx
push 0x33fd9237
and eax, esi
sub byte [eax - 0x1490eca2], 0xce
dec ebx
inc ebx
add byte [esi - 0x26], bh
invalid
scasd eax, dword es:[edi]
cdq
cdq
invalid
Function at 0xd07058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d071a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd0707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0706a
add dl, dl
jne 0xd07089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd070dc
xor eax, eax
add dl, dl
jne 0xd07096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0717d
add dl, dl
jne 0xd070a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd070b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd070bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd070c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd070d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd07075
mov eax, 1
add dl, dl
jne 0xd070ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd070f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd070e1
sub eax, ebx
mov ebx, 1
jne 0xd07128
mov ecx, 1
add dl, dl
jne 0xd0710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd07119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd07105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd07075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd0713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd0714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd07136
cmp eax, 0x7d00
jae 0xd0716d
cmp eax, 0x500
jb 0xd07168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd07075
cmp eax, 0x7f
ja 0xd07170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd07075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd0719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd07075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405a1d
Capabilities:
Parse pe header

Disassembly:
push 8
push 0x42c320
call fcn.00414d40
mov esi, ecx
or dword [0x42f0fc], 0x398
and dword [ebp - 4], 0
lea edi, [esi + 0x28]
push dword [ebp + 0xc]
push 0x40
push 0
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x405b17
or dword [ebp - 4], 0xffffffff
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x405b06
cmp dword [esi + 0x64], 0
je 0x405b06
mov dword [ebp - 4], 1
lea edi, [esi + 0x68]
push dword [ebp + 0xc]
push pe_nt_image_headers32
push dword [esi + 0x64]
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x405b17
or dword [ebp - 4], 0xffffffff
cmp dword [edi], 0x4550
jne 0x405b06
mov eax, 0x10b
cmp word [esi + 0x80], ax
jne 0x405b06
movzx eax, word [esi + 0x6e]
test ax, ax
je 0x405b06
mov edi, eax
imul edi, edi, 0x28
movzx ecx, word [esi + 0x7c]
mov ebx, dword [esi + 0x64]
add ecx, 0x18
add ebx, ecx
push edi
call fcn.004170dd
pop ecx
mov dword [esi + 0x160], eax
test eax, eax
jne 0x405adb
push 8
jmp 0x405b1d
mov dword [ebp - 4], 2
push dword [ebp + 0xc]
push edi
push ebx
push eax
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x405b17
or dword [ebp - 4], 0xffffffff
lea eax, [ebx + edi]
mov dword [esi + 0x10], eax
xor eax, eax
jmp 0x405b1e
push 0xb
jmp 0x405b1d
or dword [ebp - 4], 0xffffffff
push 0x1e
pop eax
call fcn.00414d7b
ret 8
Function at 0x4067cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x4220e7
call fcn.00414d1c
mov eax, dword [0x42f0fc]
or eax, 0x1a3
sub esp, 0x40
inc eax
mov ecx, 0xb4
cmove eax, ecx
push esi
mov esi, dword [esp + 0x58]
or eax, 0x1c7
mov dword [0x42f0fc], eax
test esi, esi
jne 0x406807
xor eax, eax
jmp 0x4068e2
push edi
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi + 0x7c], 0
jne 0x40681a
xor eax, eax
jmp 0x4068e1
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [edi + 0x78]
add ebp, esi
mov dword [esp + 0x14], ebp
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x20]
add eax, esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x24]
add eax, esi
add ecx, esi
cmp byte [ebx], 0xff
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
je 0x40689d
push 7
push ebx
push str._:hash:
call fcn.00416f58
add esp, 0xc
test eax, eax
je 0x40688a
push 7
push ebx
push str._:text:
call fcn.00416f58
add esp, 0xc
test eax, eax
je 0x40688a
push 0
push ebx
call fcn.00414490
pop ecx
push eax
push ebx
call fcn.00407e1e
mov ecx, dword [esp + 0x1c]
add esp, 0xc
jmp 0x4068a0
push 0
push ebx
call fcn.00414490
pop ecx
sub eax, 7
push eax
lea eax, [ebx + 7]
push eax
jmp 0x40687c
mov eax, dword [ebx + 1]
xor ebx, ebx
mov dword [esp + 0x64], eax
cmp dword [ebp + 0x18], ebx
jbe 0x4068dd
mov eax, ebp
mov ebp, dword [ecx + ebx*4]
test ebp, ebp
je 0x4068d7
add ebp, esi
push 0
push ebp
call fcn.00414490
pop ecx
push eax
push ebp
call fcn.00407e1e
add esp, 0xc
cmp dword [esp + 0x64], eax
je 0x4068f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
inc ebx
cmp ebx, dword [eax + 0x18]
jb 0x4068ad
xor eax, eax
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x44]
pop esi
mov dword fs:[0], ecx
leave
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
movzx eax, word [eax + ebx*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, dword [edi + 0x78]
jb 0x4069e1
mov eax, dword [edi + 0x7c]
add eax, dword [edi + 0x78]
cmp ecx, eax
jae 0x4069e1
lea eax, [ecx + esi]
push eax
lea ecx, [esp + 0x24]
call fcn.00401391
xor ebx, ebx
mov dword [esp + 0x58], ebx
push 1
push ebx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], 0x2e
call fcn.00404fda
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
je 0x4069cf
push esi
push ebx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
call fcn.004065a8
mov byte [esp + 0x58], 1
cmp dword [eax + 0x14], 0x10
jb 0x406969
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov byte [esp + 0x58], bl
lea ecx, [esp + 0x38]
call fcn.0040150a
test edi, edi
je 0x4069cf
push ebp
lea ecx, [esi + 1]
push ecx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
call fcn.004065a8
mov byte [esp + 0x58], 2
cmp dword [eax + 0x14], 0x10
jb 0x4069a3
mov eax, dword [eax]
push eax
push edi
call fcn.004067cd
pop ecx
pop ecx
mov esi, eax
mov byte [esp + 0x58], bl
lea ecx, [esp + 0x38]
call fcn.0040150a
mov dword [esp + 0x58], ebp
lea ecx, [esp + 0x20]
call fcn.0040150a
mov eax, esi
jmp 0x4068df
mov dword [esp + 0x58], ebp
lea ecx, [esp + 0x20]
call fcn.0040150a
jmp 0x4068dd
lea eax, [ecx + esi]
jmp 0x4068df