joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479ba0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push 0
mov dword [0x113b264], eax
call esi
push 0
push 0
push 1
push 0
mov dword [0x113b25c], eax
call esi
push 0x113b260
push 0
push 0
mov dword [0x113b24c], eax
mov eax, dword [esp + 0x14]
push 0x479b80
push 0
push 0
mov dword [0x113b258], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [0x113b254], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
ret

Function at 0x48b8d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x48b900
push esi
call fcn.0049c7b0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x48b8f9
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x48b933
mov eax, dword [esi + 0x18c]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x48b928
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x2d
mov edx, dword [esi]
call dword [edx]
add esp, 4
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x48b953
cmp eax, 0xcc
je 0x48b953
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x11
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
cmp dword [esi + 0x10], 0xcc
je 0x48b976
mov edx, dword [esi + 0x17c]
push esi
call dword [edx]
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x10], 0xcc
mov eax, dword [esi + 0x17c]
mov cl, byte [eax + 8]
test cl, cl
je 0x48b9a1
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x2d
mov edx, dword [esi]
call dword [edx]
mov eax, dword [esi + 0x17c]
add esp, 4
mov cl, byte [eax + 8]
test cl, cl
jne 0x48b983
mov dl, byte [esi + 0x41]
xor ecx, ecx
test dl, dl
setne cl
add ecx, 0xcd
mov al, 1
mov dword [esi + 0x10], ecx
pop esi
ret
Function at 0x48bdb0
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x12241fc]
sub esp, 0x694
test eax, eax
je 0x48bf42
mov eax, dword [0x122258c]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x48bf42
mov eax, dword [0x113b224]
test eax, eax
je 0x48bf42
mov eax, dword [esp + 0x69c]
push ebx
push ebp
mov ebp, dword [esp + 0x6a8]
push esi
push edi
mov edi, dword [esp + 0x6a8]
lea esi, [esp + 0x2a4]
sub edi, eax
sub ebp, eax
mov edx, 0x100
movzx cx, byte [edi + eax]
xor ebx, ebx
add esi, 2
mov bh, cl
or ebx, ecx
movzx cx, byte [eax]
mov word [esi - 0x202], bx
xor ebx, ebx
mov bh, cl
or ebx, ecx
movzx cx, byte [eax + ebp]
mov word [esi - 2], bx
xor ebx, ebx
mov bh, cl
or ebx, ecx
inc eax
mov word [esi + 0x1fe], bx
dec edx
jne 0x48be09
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x14], 5
jne 0x48bec5
cmp dword [esp + 0x20], 2
jne 0x48bec5
push str.performing_W2K_gamma_clamp._n
call fcn.0041e3c0
add esp, 4
lea esi, [esp + 0x1a2]
mov edi, 3
xor edx, edx
mov eax, 0x8000
lea ecx, [esi - 0xfe]
xor ebx, ebx
mov bx, word [ecx]
cmp ebx, eax
jle 0x48be9e
lea ebx, [edx + 0x80]
shl ebx, 8
mov word [ecx], bx
add eax, 0x100
inc edx
add ecx, 2
cmp eax, 0x10000
jl 0x48be89
cmp word [esi], 0xfe00
jbe 0x48beba
mov word [esi], 0xfe00
add esi, 0x200
dec edi
jne 0x48be7c
jmp 0x48bed2
push str.skipping_W2K_gamma_clamp._n
call fcn.0041e3c0
add esp, 4
lea esi, [esp + 0xa6]
mov edi, 3
mov eax, esi
mov edx, 0xff
mov cx, word [eax - 2]
cmp word [eax], cx
jae 0x48bef1
mov word [eax], cx
add eax, 2
dec edx
jne 0x48bee5
add esi, 0x200
dec edi
jne 0x48bede
mov eax, dword [0x12223b4]
pop edi
pop esi
pop ebp
pop ebx
lea edx, [esp + 0x94]
test eax, eax
push edx
je 0x48bf25
mov ecx, dword [0x113b224]
push ecx
call eax
add esp, 0x694
ret
mov eax, dword [0x113b224]
push eax
call dword [sym.imp.GDI32.dll_SetDeviceGammaRamp]
test eax, eax
jne 0x48bf42
push str.SetDeviceGammaRamp_failed._n
call fcn.0041e210
add esp, 4
add esp, 0x694
ret
Function at 0x4aa190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb8
mov eax, dword [esp + 0xc4]
push ebx
push ebp
push esi
mov esi, dword [eax + 4]
push edi
lea ecx, [esp + 0x50]
push 0
lea edx, [esp + 0x60]
push ecx
lea eax, [esp + 0x34]
and esi, 0xffff
push edx
push eax
push esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x28], 0xc1800000
mov dword [esp + 0x2c], 0xc1800000
mov dword [esp + 0x30], 0xc1000000
mov dword [esp + 0x4c], 0x41800000
mov dword [esp + 0x50], 0x41800000
mov dword [esp + 0x54], 0x41000000
mov dword [esp + 0x24], esi
call fcn.004c2540
lea ecx, [esp + 0x7c]
push ecx
push esi
call fcn.004b35b0
add esp, 0x1c
test eax, eax
jne 0x4aa23d
push esi
push str.no_entity_with_model__d_n
push 1
call dword [0x122fa00]
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov edx, dword [esp + 0xcc]
lea ebx, [esp + 0x50]
lea esi, [esp + 0x68]
lea ebp, [esp + 0x5c]
xor edi, edi
sub ebx, edx
sub esi, edx
mov ecx, edx
sub ebp, edx
fld dword [ebx + ecx]
fadd dword [esi + ecx]
fadd dword [0x4e03b8]
fcomp dword [ecx]
fnstsw ax
test ah, 1
jne 0x4aa230
fld dword [ecx + ebp]
fadd dword [esi + ecx]
fsub dword [0x4e03b8]
fcomp dword [ecx]
fnstsw ax
test ah, 0x41
je 0x4aa230
inc edi
add ecx, 4
cmp edi, 2
jl 0x4aa25a
fld dword [edx + 8]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
fadd dword [0x4e084c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x48], ecx
push 0x10001
lea eax, [esp + 0x48]
fstp dword [esp + 0x2c]
fld dword [edx + 8]
mov edx, dword [esp + 0xd4]
lea ecx, [esp + 0x3c]
fsub dword [0x4e0850]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x30]
push edx
fstp dword [esp + 0x60]
lea ecx, [esp + 0x88]
push eax
push ecx
call fcn.004c2440
mov ecx, 0x15
mov esi, eax
lea edi, [esp + 0x90]
add esp, 0x1c
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x78]
test eax, eax
jne 0x4aa230
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x4aa230
mov eax, dword [esp + 0xc4]
cmp eax, 0x3ff
je 0x4aa230
push eax
call fcn.004b3560
mov ecx, dword [esp + 0x14]
add esp, 4
cmp eax, ecx
jne 0x4aa230
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xb8
ret
Function at 0x4aacd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
mov ebx, dword [esp + 0x6c]
push ebp
push esi
mov edx, dword [ebx + 8]
mov eax, dword [ebx]
fld dword [ebx + 8]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x7c]
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
fsub dword [0x4e150c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ecx
push edx
lea eax, [esp + 0x18]
push 4
lea ecx, [esp + 0x28]
fstp dword [esp + 0x24]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
call fcn.004c3280
mov ecx, 9
mov esi, eax
lea edi, [esp + 0x40]
add esp, 0x14
rep movsd dword es:[edi], dword [esi]
fld dword [esp + 0x30]
fcomp dword [0x4e03d0]
fnstsw ax
test ah, 1
jne 0x4aad4e
fld dword [0x4e03d0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
fld dword [esp + 0x3c]
fadd dword [0x4e03d0]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x78], 0x41000000
fstp dword [esp + 0x10]
fld dword [esp + 0x78]
fmul dword [ebp]
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x14]
push ecx
push 4
fadd dword [ebx]
push edx
lea ecx, [esp + 0x5c]
fst dword [esp + 0x2c]
fld dword [esp + 0x84]
fmul dword [ebp + 4]
fadd dword [ebx + 4]
fstp dword [esp + 0x30]
fld dword [esp + 0x1c]
fadd dword [0x4e084c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c]
push eax
push ecx
fstp dword [esp + 0x3c]
fstp dword [esp + 0x28]
fld dword [esp + 0x3c]
fld dword [0x122a924]
fadd dword [0x4e0850]
fsubp st(1)
fstp dword [esp + 0x30]
call fcn.004c3280
mov ecx, 9
mov esi, eax
lea edi, [esp + 0x40]
add esp, 0x14
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4aae0f
fld dword [esp + 0x10]
fsub dword [0x122a928]
fsub dword [0x4e03bc]
fcomp dword [esp + 0x3c]
fnstsw ax
test ah, 0x41
je 0x4aae3c
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
fld dword [esp + 0x78]
fadd dword [0x4e03bc]
fst dword [esp + 0x78]
fcomp dword [0x4e0588]
fnstsw ax
test ah, 0x41
jne 0x4aad68
fld dword [0x4e0398]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
fld dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
fsub dword [0x4e0b08]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
push edx
mov dword [esp + 0x1c], ecx
fstp dword [esp + 0x20]
call fcn.004c2490
add esp, 4
test al, 0x30
jne 0x4aae2e
fld dword [esp + 0x78]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x4b9fb0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x122f7b8]
push ebx
push esi
mov edx, dword [ecx + 0xc4]
mov ecx, dword [esp + 0x10]
lea eax, [eax + eax*2]
xor esi, esi
mov dword [ecx + 8], esi
mov dword [ecx + 4], esi
lea ebx, [edx + eax*8]
mov dword [ecx], esi
cmp dword [ebx + 8], esi
jle 0x4ba0a6
push edi
mov edi, dword [0x122f7b8]
mov eax, dword [ebx + 0xc]
add eax, esi
mov edx, dword [edi + 0xbc]
mov eax, dword [edx + eax*4]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [edi + 0xb4]
mov edi, dword [edi + 0xa4]
inc esi
lea eax, [edx + eax*8]
mov edx, dword [eax]
lea edx, [edx + edx*2]
fld dword [edi + edx*4]
fadd dword [ecx]
fstp dword [ecx]
mov edx, dword [eax]
mov edi, dword [0x122f7b8]
mov edi, dword [edi + 0xa4]
lea edx, [edx + edx*2]
fld dword [edi + edx*4 + 4]
fadd dword [ecx + 4]
fstp dword [ecx + 4]
mov edx, dword [eax]
mov edi, dword [0x122f7b8]
mov edi, dword [edi + 0xa4]
lea edx, [edx + edx*2]
fld dword [edi + edx*4 + 8]
fadd dword [ecx + 8]
fstp dword [ecx + 8]
mov edx, dword [eax + 4]
mov edi, dword [0x122f7b8]
mov edi, dword [edi + 0xa4]
lea edx, [edx + edx*2]
fld dword [edi + edx*4]
fadd dword [ecx]
fstp dword [ecx]
mov edx, dword [eax + 4]
mov edi, dword [0x122f7b8]
mov edi, dword [edi + 0xa4]
lea edx, [edx + edx*2]
fld dword [edi + edx*4 + 4]
fadd dword [ecx + 4]
fstp dword [ecx + 4]
mov eax, dword [eax + 4]
mov edx, dword [0x122f7b8]
mov edx, dword [edx + 0xa4]
lea eax, [eax + eax*2]
fld dword [edx + eax*4 + 8]
fadd dword [ecx + 8]
fstp dword [ecx + 8]
cmp esi, dword [ebx + 8]
jl 0x4b9fe0
pop edi
fild dword [ebx + 8]
pop esi
pop ebx
fdivr qword [0x4e03e8]
fld st(0)
fmul dword [ecx]
fstp dword [ecx]
fld st(0)
fmul dword [ecx + 4]
fstp dword [ecx + 4]
fmul dword [ecx + 8]
fstp dword [ecx + 8]
ret
Function at 0x4c54b0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor ecx, ecx
test edi, edi
jle 0x4c54d4
push esi
mov esi, dword [esp + 0xc]
mov al, cl
mov dl, 0x77
imul dl
mov dl, byte [ecx + esi]
xor dl, al
mov byte [ecx + esi], dl
inc ecx
cmp ecx, edi
jl 0x4c54c0
pop esi
pop edi
ret

Function at 0x4cdd06
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4cdd31
test byte [esp + 8], 0x80
je 0x4cdd20
and al, 0xfe
jmp 0x4cdd22
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4cdd42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004d44c7
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x4d5f7e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x504b18
cmp edx, dword [eax]
je 0x4d5fa0
add eax, 8
inc ecx
cmp eax, 0x504ba8
jl 0x4d5f91
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x504b18]
jne 0x4d60ce
mov eax, dword [0xadeaac]
cmp eax, 1
je 0x4d60a8
test eax, eax
jne 0x4d5fd1
cmp dword [0x501fa4], 1
je 0x4d60a8
cmp edx, 0xfc
je 0x4d60ce
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4d6008
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004d5430
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004d20e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4d604b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004d20e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4f1f80
push edi
call fcn.004cb870
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004d5430
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004d5440
lea eax, [ebp - 0xa0]
push 0x4e1be8
push eax
call fcn.004d5440
push dword [esi + 0x504b1c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004d5440
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004daa2f
add esp, 0x2c
pop edi
jmp 0x4d60ce
lea eax, [ebp + 8]
lea esi, [esi + 0x504b1c]
push 0
push eax
push dword [esi]
call fcn.004d20e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x408f08
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408ebc
test al, al
jne 0x408f29
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408f75
xor eax, eax
push ebp
push 0x408f65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033cc
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f6c
lea eax, [ebp - 0xc]
call fcn.00408ef8
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40927c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40936b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406c90
mov edx, dword [ebp - 8]
mov ecx, 0x409384
xor eax, eax
call fcn.00409170
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409339
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x40929c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.00408d44
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c30
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407220
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x67
call fcn.00408d14
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x4045fc
call fcn.0040582c
call fcn.00402e88
jmp 0x40929c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409372
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403170
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403170
ret

Function at 0x409438
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409492
inc esi
xor edi, edi
cmp edi, 1
jne 0x40945e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40946c
cmp edi, 1
jle 0x40946c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408f08
test eax, eax
jne 0x409492
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409492
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409492
inc edi
dec esi
jne 0x40944e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x40949c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x4094e9
xor ebx, ebx
jmp 0x4094de
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404bdc
test eax, eax
jne 0x4094dd
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409599
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4094bf
mov al, byte [ebp - 1]
sub al, 1
jb 0x4094f4
je 0x4094fd
jmp 0x409506
call fcn.00406fc0
mov edi, eax
jmp 0x409508
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x409508
xor edi, edi
test di, di
je 0x409599
xor ebx, ebx
jmp 0x409544
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x409543
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409538
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409543
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409599
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409515
xor ebx, ebx
jmp 0x40958e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40958d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409582
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x40958d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409599
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409553
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x409904
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4099d7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099f0
push ebx
push 0x4099fc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040336c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409984
mov al, 0x69
call fcn.004095a8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004098d8
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40998d
call fcn.004098d8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4099de
lea eax, [ebp - 4]
call fcn.00403150
ret
Function at 0x409a70
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b24
jmp 0x409b19
cmp dword [esi + 0x10], 0x1000
jne 0x409b05
test byte [esi + 0x15], 1
jne 0x409b05
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409ac4
cmp eax, 2
je 0x409ac4
cmp eax, 0x10
je 0x409ac4
cmp eax, 0x20
jne 0x409ad9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ad9
mov bl, 1
xor ebp, ebp
jmp 0x409aea
mov eax, dword [esi]
add eax, ebp
call fcn.00409a68
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409add
test bl, bl
je 0x409b05
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b24
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a9c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1a83700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.01a8378f
jae 0x1a8370e
xor ecx, ecx
call fcn.01a8378f
jae 0x1a8373d
xor eax, eax
call fcn.01a8378f
jae 0x1a8374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.01a8378f
adc al, al
jae 0x1a8372f
jne 0x1a83779
stosb byte es:[edi], al
jmp 0x1a83711
call fcn.01a8379b
sub ecx, ebx
jne 0x1a83756
call fcn.01a83799
jmp 0x1a83775
lodsb al, byte [esi]
shr eax, 1
je 0x1a83783
adc ecx, ecx
jmp 0x1a83772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01a83799
cmp eax, 0x7d00
jae 0x1a83772
cmp ah, 5
jae 0x1a83773
cmp eax, 0x7f
ja 0x1a83774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1a83711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x1adecb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffffffffff
lea edx, [ebx + 8]
push dword [edx + 0x34]
lea esi, [edx - 8]
add dword [esp], ebx
pop ecx
add edx, dword [ecx + 0x78]
add esi, dword [edx + 0x18]
pop ecx
lodsd eax, dword [esi]
add ecx, 1
cmp dword [edx + 0x10], ecx
lea edi, [eax + ebx + 4]
je 0x1aded30
nop
cmc
and al, 0xff
xor eax, eax
imul eax, eax, 0xf
push eax
movzx eax, byte [edi - 4]
neg eax
sub edi, 0xfffffff1
add dword [esp], eax
lea edi, [edi - 0xe]
pop eax
cmp byte [edi - 4], 0xa
jmp 0x1adee3e
ret
add ecx, ecx
add edi, ebx
add ecx, ebx
mov esi, dword [edx + 1]
mov ax, word [ecx + esi]
cwde
push dword [edi + eax*4]
add dword [esp], ebx
pop esi
mov eax, dword [esp]
add esp, 8
jmp eax
ja 0x1adece1
mov eax, 0xfc8e2a94
xor dword [esp - 4], eax
mov eax, dword [esp + 4]
sub dword [esp - 4], eax
jne 0x1adecce
add edx, 0x1b
push dword [edx - 7]
pop edi
jmp 0x1aded49