joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100113e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100113f0
pop dword [ebp - 0x1c]
mov eax, 0x100113f0
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x9ed03ba5
sub dword [ebp - 0x2c], 0x507df65a
mov dword [ebp - 0x28], 0xb0434a08
sub dword [ebp - 0x28], 0x7e0ffdc3
mov dword [ebp - 0x24], 0xa8ee8379
sub dword [ebp - 0x24], 0x5ca23f4b
mov dword [ebp - 0x20], 0xbe7ee559
sub dword [ebp - 0x20], 0xbe7ee559
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xe4efab4
sub dword [ebp - 0x2c], 0x99dc915e
mov dword [ebp - 0x28], 0x4a167df8
sub dword [ebp - 0x28], 0x8aa1c83
mov dword [ebp - 0x24], 0x9d3f835d
sub dword [ebp - 0x24], 0x39d016f1
mov dword [ebp - 0x20], 0x21d88f39
add dword [ebp - 0x20], 0xde2770c7
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x36bea
push 0
call eax
mov ecx, 0x5806f595
sub ecx, 0x5806aca1
xor esi, esi
add esi, eax
mov edx, 0x5a34a54
add edx, 0xa5e2fac
add edx, dword [ebp - 0x1c]
mov edi, 0x1a104cff
add dword [ebp - 8], esi
mov ebx, dword [edx]
xor dword [ebp - 0xc], 0x3fd4024f
sub ebx, edi
sub dword [ebp - 0x14], 0xa978b3eb
mov dword [esi], ebx
xor dword [ebp - 0x14], ebx
add esi, 4
add edx, 0x2381cc5b
sub edx, 0x2381cc57
loop 0x100114ff
add eax, 0x116a3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, sym.clearkey.dll_Ordinal_0
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00405630
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00405630
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00405630
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00405630
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00405630
mov dword [0x41203c], eax
call fcn.00405630
test eax, eax
jge 0x402550
push 8
call fcn.00405630
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00405630
pop ecx
push 1
call fcn.00405630
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00405630
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00405630
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00405630
jmp 0x402495

Function at 0x405630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40563f
pop dword [ebp - 0x34]
mov eax, 0x47fa62da
add eax, 0xb845f365
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3918a
push 0
mov eax, 0xa124aa2c
sub eax, 0xa0e3c954
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0xcd7da347
add ecx, 0x3282a448
xor edi, edi
add edi, eax
mov ebx, 0x5032e72b
add ebx, 0xb00e5499
add ebx, dword [ebp - 0x34]
mov esi, 0xbf0ffb7f
add esi, 0x1c52b8a
sub dword [ebp - 0x30], 0x12cc9226
mov edx, dword [ebx]
xor dword [ebp - 4], edi
xor edx, esi
sub dword [ebp - 8], 0x4d8de8a3
mov dword [edi], edx
add dword [ebp - 8], eax
add edi, 0xa72ebd4c
add edi, 0x58d142b8
add ebx, 4
loop 0x4056a0
add eax, 0xd7c8e35b
sub eax, 0xd7c7d24c
mov ebx, eax
add eax, 0xaa3f7e35
sub eax, 0xaa3f7e30
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x403594
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xb40008], 0x8088405
inc edx
mov dword [ebx + 0xb40008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41c7c0
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41c7f1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c7d9
add dl, dl
jne 0x41c7fc
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c84d
xor eax, eax
add dl, dl
jne 0x41c809
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c8ea
add dl, dl
jne 0x41c818
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c823
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c82e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c839
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41c843
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41c7e8
mov eax, 1
add dl, dl
jne 0x41c85b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c866
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c852
sub eax, ebx
mov ebx, 1
jne 0x41c899
mov ecx, 1
add dl, dl
jne 0x41c87f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c88a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c876
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c7e8
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41c8b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c8bb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c8a7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c7e8
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41c90b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41c7e8
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d488
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x41d49b
add esp, 0xfffffff0
call fcn.00403d90
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00403b18
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x41d4c1
cmp dword [esi + 0x58], 0x40
jb 0x41d6a7
jmp 0x41d4c7
jl 0x41d6a7
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.00406e68
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.0041d040
cmp word [ebx + 0xc], 0x5a4d
jne 0x41d6a7
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x41d6a7
cmp ecx, 0x10000
jge 0x41d6a7
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d522
cmp eax, dword [esi + 0x58]
ja 0x41d6a7
jmp 0x41d528
jg 0x41d6a7
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.00406e68
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.0041d040
cmp dword [ebx + 0x4c], 0x4550
jne 0x41d6a7
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.00406e68
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.0041d040
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x41d5df
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d5a3
cmp eax, dword [esi + 0x58]
ja 0x41d630
jmp 0x41d5a9
jg 0x41d630
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.00406e68
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.0041d040
mov byte [ebx + 4], 1
jmp 0x41d630
cmp ax, 0x14c
jne 0x41d630
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d600
cmp eax, dword [esi + 0x58]
ja 0x41d630
jmp 0x41d602
jg 0x41d630
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.00406e68
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.0041d040
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x41d6a7
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d661
cmp eax, dword [esi + 0x58]
ja 0x41d6a7
jmp 0x41d663
jg 0x41d6a7
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0xb29f58]
call fcn.00405b5c
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.0041d040
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x41d6be
call fcn.00403de8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41e3bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xb2b87b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e46d
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e456
test esi, esi
jbe 0x41e46d
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040888c
test eax, eax
jne 0x41e448
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e46d
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e425
jmp 0x41e46d
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e46d
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb2b882
ret
Function at 0x41eccc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0xb2c27b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cb8
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41ed07
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41ed20
lea eax, [ebp - 0x10]
mov edx, dword [0xb41edc]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d18
jmp 0x41ed33
lea eax, [ebp - 0x10]
mov edx, dword [0xb41edc]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d18
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ed3f
adc edx, 0
mov edx, dword [edx*4 + 0xb40cac]
call fcn.00404f08
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404eec
push eax
call fcn.00406adc
mov esi, eax
cmp esi, 0xffffffff
je 0x41ee4d
mov eax, 0x40
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d24
test eax, eax
je 0x41ee40
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ee40
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d7c
mov eax, edi
call fcn.00403270
mov eax, 0x18
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d24
test eax, eax
je 0x41ee40
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ee40
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ee40
cmp dx, 0x150
ja 0x41ee40
mov eax, edi
call fcn.00403270
mov eax, 0xe0
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d24
test eax, eax
je 0x41ee40
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ee40
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404cf4
mov eax, edi
call fcn.00403270
push esi
call fcn.00406a94
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00405014
jne 0x41ee65
inc ebx
cmp ebx, 0x19
jne 0x41ecf9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb2c282
lea eax, [ebp - 0x10]
call fcn.00404cb8
ret
Function at 0x401855
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401894
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401894
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401894
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401894
cmp dword [ecx + 0x74], 0xe
jbe 0x401894
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002e1a0
Capabilities:
Encode data using xor

Disassembly:
pop ebp
cmpsb byte [esi], byte es:[edi]
clc
mov dh, dh
mov ah, 0xd4
clc
loop 0x1002e1e8
add ebx, ecx
mov cl, dh
int 0xcd
cmp dword [esi], esp
sub al, 0x7c
leave
pop es
sahf
or eax, 0x9c34869c
ja 0x1002e1d8
cld
outsd dx, dword [esi]
imul ecx, dword [edi + 0x7f], 0xffffff8f
push ecx
aas
invalid
test eax, 0x14479b31
mov ecx, dword [ecx]
xchg esi, edx
insd dword es:[edi], dx
mov ch, 0x30
and byte [esi - 0x1dc9d14f], al
in eax, dx
loop 0x1002e1d8
scasd eax, dword es:[edi]
sub dword [esi - 0x72e73cab], ecx
jne 0x1002e25a
jns 0x1002e1a7
rol dword [ebx], cl
out dx, al
scasb al, byte es:[edi]
das
js 0x1002e256
mov eax, dword [0xf3e6f919]
nop
popal
cwde
jae 0x1002e23f
rcl dword [eax + eax*2], cl
xor bh, cl
inc ecx
and dword [ebp + 0x1a], esi
push 0x4e
mov byte [ecx + 2], bh
cmp bl, byte [ebp]
mov esi, 0xe3d1dd29
in eax, 0x60
pushal
loopne 0x1002e21f
adc byte [eax + 0x4b8ce924], dl
pop edi
stosb byte es:[edi], al
std
mov bh, 0xc3
add eax, 0xdecf0a1f
insd dword es:[edi], dx
push ebx
cmp edx, dword [edx + 0xddbc7b1]
jbe 0x1002e1c4
cmp byte [eax - 0x51], cl
xchg esi, eax
xchg ebp, eax
inc ebp
adc edi, ecx
invalid
jl 0x1002e2c3
pop esp
arpl word [ecx + eax*2 + 0x26], si
arpl word [ecx + eax*2 + 0x26], si
adc al, 0xc1
and dword [edi], edx
das
jo 0x1002e2a2
dec ebx
cwde
push es
xchg ebx, eax
loope 0x1002e2e2
int1
add esp, ebx
xor byte [edi], 0xe6
div dword [edi + 0x74e165e8]
mov esi, dword [esp + eax*2 + 0x76]
and dword [eax + 0xa101d47], eax
add al, 0x87
mov bh, 0xeb
invalid
int3
sbb dh, byte [eax + 0x66]
and byte [ebx - 0x27], dh
mov edi, 0x25c01de
fidiv dword [ebx + 0x7dc1c417]
cdq
inc esp
cld
push ecx
ror esi, 1
aas
je 0x1002e2c4
popal
dec eax
outsb dx, byte [esi]
enter 0xffffffffffffae36, 0xfffffffffffffff8
jmp 0x1002e290
retf
adc eax, 0xe148f208
movsb byte es:[edi], byte [esi]
dec esp
test byte [ecx + 0x7c798617], al
or ecx, dword [ecx + 0x6dd4f42b]
push esi
xor byte [ecx - 0x11a834c3], ch
push edi
push esi
add esi, esp
out dx, eax
popal
mov ecx, fs
test al, 0xd5
cmp eax, 0x4b310e09
salc
popal
vmptrst qword [ebp - 0xe4fbdd9]
shl byte [eax - 0x3a], 1
mov gs, word [edi + 5]
jp 0x1002e2e2
invalid
Function at 0x100385b0
Capabilities:
Encode data using xor

Disassembly:
add dh, byte [edx]
push eax
and ecx, dword [edx]
lahf
push edi
fst dword [ecx]
cli
int 0x99
popal
dec ecx
cdq
mov eax, dword [0xa94c51c6]
mov al, byte [0x56b1b959]
popal
adc al, 7
xchg ecx, eax
cmp ecx, 0x5e
outsb dx, byte [esi]
sbb ch, al
lds esi, [ebp + 0x4b]
js 0x100384f9
pop ebp
rep stosb byte es:[edi], al
out dx, al
push eax
sar dword [eax + 0x205dc229], 1
dec edx
mov dh, 0x93
and byte [edx - 0x4a], cl
xchg ebx, eax
pop ebp
or esi, ebx
sub byte [edi + edx*8 + 0x2b0f7e5], dl
wait
rcl dword [edx - 0x2f]
mov ebp, 0x90658fa9
mov ah, 0x41
inc ecx
mov dword [ecx], ecx
aas
imul eax, dword [ebx + 0x6ff73f54], 0x1498c1c0
xchg edx, eax
xchg ebx, eax
cmp eax, 0xda58e2a2
aas
rcr ch, 1
aam 0x46
push esp
and edi, ebx
sub al, 2
xor byte [eax + 0x792dc0dd], bh
and al, 0xe2
cmpsd dword [esi], dword es:[edi]
mov al, 0x38
shr dword [eax], cl
sbb dword [edi + esi*2 - 0x677b6f8b], ecx
jl 0x10038537
nop
test byte [eax + 0x5a10a77c], bl
pop edi
adc byte [edx + 0x5f], bl
jae 0x100385a8
push edi
jbe 0x1003855b
daa
loope 0x10038618
movsd dword es:[edi], dword [esi]
dec esi
invalid
leave
aam 0xad
xlatb
xor eax, 0x49a42065
dec ecx
dec ecx
add ch, byte [eax + esi*2 - 0x5fea7e8e]
arpl word [eax - 0x3855963e], cx
mov ah, dh
cmpsb byte [esi], byte es:[edi]
jns 0x10038543
pop edx
adc edi, dword [ecx]
cmpsd dword [esi], dword es:[edi]
and eax, edx
xor eax, 0xc0333c34
leave
jns 0x1003858b
add dword [ebx], 8
sub bh, byte [bp + si - 0x3b]
or dword [ecx - 0x1f4bae98], 0xb
push ss
or al, 0xf7
mov cl, 0x65
mov eax, dword [eax - 0x4b]
dec esp
mov word [ebx], cs
pop ebp
jecxz 0x10038662
dec eax
into
shufps xmm6, xmmword [ebx + 0x7f11b155], 0xb4
arpl word [edx + 0x21], bp
dec ecx
sbb dword [ebx], edi
ret 0x662c
inc esp
scasb al, byte es:[edi]
mov edi, 0x88b74182
je 0x10038655
sti
invalid
pop ds
inc eax
cmp al, 0x68
loop 0x1003860d
repne insb byte es:[edi], dx
mov ebp, 0x21ef0824
adc al, 0x18
retf 0x1c2
mov byte [0xedf5366e], al
sub al, 0x6c
dec esi
aad 0xcc
mov ebp, 0x23945a49
imul esi, dword [eax - 0x64bf606f], 0x46
xchg esp, eax
and ebp, dword [ebx - 0x50]
xchg ecx, eax
lahf
inc eax
wait
inc esi
adc byte [ebx + eax*8 + 0x26], 0xfe
jo 0x100386de
adc eax, 0x40e808a4
jmp 0xd8e20191
invalid
ror byte [esi - 0x5f509132], cl
mov word [edi - 0x6cb5388e], cs
scasd eax, dword es:[edi]
mov al, byte [0xc7728f8c]
dec edx
xchg ebx, eax
ja 0x1003871d
bound esp, qword [ecx]
test ax, 0xcec3
jp 0x100386bd
stosb byte es:[edi], al
clc
idiv byte [edx - 0x5e137534]
push ds
xchg edi, eax
leave
push eax
xchg edx, eax
shr byte [esi - 0x36be4da0], 0x59
adc eax, 0xb9199318
push cs
push cs
xchg esp, eax
pop es
mov ecx, 0x7940e0e
dec esi
add al, 0x9a
pop ebx
xor edx, eax
jg 0x1003870c
adc edi, ecx
test al, 0x29
inc ecx
xchg ebx, eax
aas
xchg ah, al
jae 0x10038711
jge 0x100386e2
outsd dx, dword [esi]
add dword [ecx - 0x40], eax
or esp, dword [eax]
pop edx
aam 0xde
sbb ebx, 9
out dx, al
retf
Function at 0x10cd0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10cd01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10cd007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10cd006a
add dl, dl
jne 0x10cd0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10cd00dc
xor eax, eax
add dl, dl
jne 0x10cd0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10cd017d
add dl, dl
jne 0x10cd00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10cd00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10cd00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10cd00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10cd00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10cd0075
mov eax, 1
add dl, dl
jne 0x10cd00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10cd00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10cd00e1
sub eax, ebx
mov ebx, 1
jne 0x10cd0128
mov ecx, 1
add dl, dl
jne 0x10cd010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10cd0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10cd0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10cd0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10cd013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10cd014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10cd0136
cmp eax, 0x7d00
jae 0x10cd016d
cmp eax, 0x500
jb 0x10cd0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10cd0075
cmp eax, 0x7f
ja 0x10cd0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10cd0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10cd019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10cd0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406284
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4062ea
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004045f8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402eec
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4062d4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4062f1
lea eax, [ebp - 0x10]
call fcn.00404388
ret

Function at 0x40ba28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ba61
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404478
jmp 0x40ba6a
mov eax, ebx
mov edx, esi
call fcn.004043dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ba74
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ba95
mov al, byte [esp]
jmp 0x40ba97
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c268
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c0e0
mov eax, dword [0x499e4c]
cmp byte [eax], 0
je 0x40c2e4
mov eax, dword [0x499bf4]
call fcn.00402c24
call fcn.00402898
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004090f0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c32c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c31a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x499ba0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x49a664]
call fcn.00405798
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret