joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61747e
Capabilities:
Encode data using xor

Disassembly:
mov ebp, esi
faddp st(0)
add eax, 0x3a77ddf3
stosb byte es:[edi], al
and dword [edx - 0x75cfeda5], edx
mov byte [edx + 0x569c4085], 0x1d
pushfd
push esi
sbb eax, 0x57126abf
xor byte [ebx], 0xb2
clc
ror byte [eax - 0x722d6233], 1
stosb byte es:[edi], al
imul dl
invalid
aas
xor byte [ebx + 0x6a0dbe4d], bh
mov al, byte [0x67d3b852]
sbb cl, 0xb1
sbb cl, 0xb1
inc eax
mov ebx, 0x1259921b
cmp dword [edi], eax
cmc
loop 0x61744a
inc edi
add ebp, esp
push 0x13
adc esi, dword [edx + 0xac83759]
mov esp, 0x8d6758c2
push ecx
lds eax, [eax + 0x3b]
cli
test al, 0xc6
adc byte [ecx - 0x6e], cl
fadd qword [edx]
push 0x53
sub bl, dl
pop edx
insd dword es:[edi], dx
jl 0x6174d8
or byte [esi], 0xba
inc ebp
ljmp 0xec94
xlatb
frstor dword [ebp - 0x398a6ee1]
pop eax
mov bl, ch
in al, 0xa7
in eax, 0x97
or dword [ebx - 0x49bbf268], ebx
push esi
cld
jge 0x61755a
pop ecx
invalid
mov al, byte [0xf2c990f6]
pop edx
retf 0xe004

Function at 0x64d3ab
Capabilities:
Packed with generic packer

Disassembly:
push edx
in eax, dx
mov esi, 0xd8a88015
fxch st(5)
enter 0xffffffffffffe278, 0xffffffffffffffdc
leave
bound ebx, qword [eax + 0x61]
fst qword [edx - 0x50545289]
fild dword [ecx + esi*8]
push ebx
inc esp
insd dword es:[edi], dx
ja 0x64d3ec
sub ecx, ebp
invalid
out 0x36, eax
not esp
or eax, 0xcaf0f0a3
fisub word [eax - 0x5bf9b084]
jb 0x64d40a
push 0x62e2d148
movsb byte es:[edi], byte [esi]
and ecx, dword [ecx + 2]
cmp byte [esi - 0x137d302], bl
pop ds
cli
enter 0x1ffe, 0xfffffffffffffffa
xor byte [edi + 0x3efd2af8], 0x40
add dword [edi + edx*8 - 0x46d75808], ebp
rol edx, 0x2b
or edi, dword [eax + 6]
enter 0x5132, 0xffffffffffffff82
not byte [ecx + 0x2686272]
in eax, 0x98
invalid
Function at 0x426cf0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sym._fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x426d50
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x426e46
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x426dc0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x426d95
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sym._memcpy
cmp byte [esp + 0x1f], 0
je 0x426da5
cmp byte [esp + 0x1e], 0
je 0x426da5
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x426da5
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
nop

Function at 0x4270e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4c77b4
call sym._EnterCriticalSection_4
mov ebx, dword [0x4c77cc]
sub esp, 4
test ebx, ebx
je 0x42712b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x427124
test esi, esi
je 0x427124
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x427100
mov dword [esp], 0x4c77b4
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x428680
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
add eax, 0x31
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x41]
shr eax, 4
shl eax, 4
call fcn.00428370
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
je 0x428770
int3
mov dword [esp], esi
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x428810
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x4287a8
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x4287a0
mov dword [esp], esi
call sym._AddAtomA_4
sub esp, 4
test ax, ax
je 0x428804
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call dbg.get_ptr_from_atom
cmp ebx, eax
mov esi, eax
je 0x428827
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], edi
call sym._CloseHandle_4
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call dbg.get_ptr_from_atom
mov esi, eax
jmp 0x4287e1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4287e1
mov dword [esp], esi
call dword [ebp + 0x10]
jmp 0x4287e1
Function at 0x432800
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x4c81e4]
test ebx, ebx
je 0x432830
call sym._TlsAlloc_0
mov dword [ebx], eax
mov eax, dword [0x4c81e4]
test eax, eax
je 0x432855
cmp dword [eax], 0xffffffff
je 0x432878
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov ebx, eax
mov dword [0x4c81e4], eax
jmp 0x43280e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4c81e4], eax
jmp 0x43281e
call sym._abort
lea esi, [esi]

Function at 0x432d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x4c81e8]
test eax, eax
je 0x432e50
cmp dword [eax], 1
je 0x432d1d
call sym.__pthread_once_raw.part.1.constprop.5
mov eax, dword [0x4c81e4]
test eax, eax
je 0x432e80
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
test eax, eax
je 0x432d42
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call sym._pop_pthread_mem
mov ebx, eax
mov eax, dword [entry3]
test eax, eax
je 0x432ecc
test ebx, ebx
je 0x432ecc
mov dword [ebx + 0x24], 1
call sym._GetCurrentThreadId_0
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sym._CreateEventA_16
mov dword [ebx + 0x1c], 0xffffffff
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call sym._GetCurrentProcess_0
mov edi, eax
call sym._GetCurrentThread_0
mov esi, eax
call sym._GetCurrentProcess_0
lea edx, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._DuplicateHandle_28
sub esp, 0x1c
test eax, eax
je 0x432ed3
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sym._GetThreadPriority_4
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4c81e4]
test eax, eax
je 0x432ea6
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x432ed3
mov eax, ebx
jmp 0x432d3b
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4c81e8], eax
jmp 0x432d13
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4c81e4], eax
jmp 0x432d2a
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4c81e4], eax
jmp 0x432e2e
xor eax, eax
jmp 0x432d3b
call sym._abort
nop
lea esi, [esi]
Function at 0x433450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
cmp dword [esp + 0x24], 3
je 0x433470
add esp, 0x18
mov eax, 1
pop ebx
ret 0xc
mov eax, dword [0x4c81e4]
test eax, eax
je 0x4335e0
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x43345b
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
test eax, eax
mov ebx, eax
je 0x43345b
test byte [eax + 0x20], 0x30
je 0x433530
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x4335d0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4334df
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x4334d1
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x433636
mov eax, dword [0x4c81e4]
test eax, eax
je 0x433610
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
mov eax, 1
add esp, 0x18
pop ebx
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x433590
test eax, eax
je 0x433549
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x4335c0
test byte [ebx + 0x24], 4
je 0x4335a6
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4334d8
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x4334d8
test eax, eax
je 0x43359f
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x43345b
call sym.__pthread_cleanup_dest.part.3
jmp 0x433561
call sym.__pthread_cleanup_dest.part.3
jmp 0x4334ad
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4c81e4], eax
jmp 0x43347d
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4c81e4], eax
jmp 0x43350c
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x4334ff
Function at 0x4347b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x434840
test byte [ebx + 0x20], 0x30
je 0x434936
mov eax, dword [0x4c81e4]
test eax, eax
je 0x4348e0
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
test eax, eax
mov ebx, eax
je 0x43482b
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4348a5
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x43481e
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x434850
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sym.__endthreadex
call sym.__pthread_cleanup_dest.part.3
jmp 0x4347cd
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [ebx + 0xac]
sub esp, 4
mov dword [ebx + 0x14], 0
test eax, eax
je 0x4348d1
mov eax, dword [0x4c81e4]
test eax, eax
je 0x434910
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sym.__endthreadex
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4348bd
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
test edx, edx
jne 0x434875
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x434875
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4c81e4], eax
jmp 0x4347e4
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4c81e4], eax
jmp 0x434882
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
lea esi, [esi]
Function at 0x437150
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
add eax, 0x30
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x40]
shr eax, 4
shl eax, 4
call fcn.00428370
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
je 0x437240
int3
mov dword [esp], esi
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x4372e0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x437278
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x437270
mov dword [esp], esi
call sym._AddAtomA_4
sub esp, 4
test ax, ax
je 0x4372d4
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp ebx, eax
mov esi, eax
je 0x4372f7
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], edi
call sym._CloseHandle_4
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x4372b1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4372b1
mov dword [esp], esi
call dword [ebp + 0x10]
jmp 0x4372b1
Function at 0x450591
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4505a0
pop dword [ebp - 0x2c]
mov eax, 0xddb5213c
add eax, 0x228fe464
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x38d52
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x47cb
xor ebx, ebx
add ebx, eax
mov edx, 0x90a9be3b
add edx, 0x6fa007c5
add edx, dword [ebp - 0x2c]
mov edi, 0x8b6d27e0
add edi, 0x42edea19
xor dword [ebp - 0x1c], 0x73ac7b88
mov esi, dword [edx]
sub dword [ebp - 0x28], ecx
xor esi, edi
xor dword [ebp - 0x14], edi
mov dword [ebx], esi
add ebx, 0x3ff531c8
sub ebx, 0x3ff531c4
add edx, 4
loop 0x4505f6
add eax, 0x111ff
xor ebx, ebx
add ebx, eax
add eax, 0xe00219d
add eax, 0xf1ffde68
mov ecx, 0xf52cc9ca
sub ecx, 0xf4ecc9ca
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0xfb1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xfb11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xfb107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfb106a
add dl, dl
jne 0xfb1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfb10dc
xor eax, eax
add dl, dl
jne 0xfb1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfb117d
add dl, dl
jne 0xfb10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfb10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfb10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfb10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xfb10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xfb1075
mov eax, 1
add dl, dl
jne 0xfb10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfb10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfb10e1
sub eax, ebx
mov ebx, 1
jne 0xfb1128
mov ecx, 1
add dl, dl
jne 0xfb110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfb1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfb1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfb1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xfb113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfb114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfb1136
cmp eax, 0x7d00
jae 0xfb116d
cmp eax, 0x500
jb 0xfb1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfb1075
cmp eax, 0x7f
ja 0xfb1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfb1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xfb119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xfb1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x410b3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x410b4b
pop dword [ebp - 0x40]
mov eax, 0x410b4b
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x29aefcfd
sub dword [ebp - 0x50], 0xdb5cb7b2
mov dword [ebp - 0x4c], 0xc01295f7
add dword [ebp - 0x4c], 0x7220b64e
mov dword [ebp - 0x48], 0xc5f4534b
sub dword [ebp - 0x48], 0x79a80f1d
mov dword [ebp - 0x44], 0x45dc3b2e
sub dword [ebp - 0x44], 0x45dc3b2e
lea eax, [ebp - 0x50]
push eax
mov eax, 0x3c4954da
sub eax, 0x3c072466
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xb2fedf64
sub dword [ebp - 0x50], 0x3e8c760e
mov dword [ebp - 0x4c], 0x222307f6
sub dword [ebp - 0x4c], 0xe0b6a681
mov dword [ebp - 0x48], 0x9cb5f778
add dword [ebp - 0x48], 0xc6b974f4
mov dword [ebp - 0x44], 0x9f6424fb
add dword [ebp - 0x44], 0x609bdb05
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3c51e
push 0
call eax
mov ecx, 0x31ba52e6
add ecx, 0xce45ed0c
mov edi, eax
mov ebx, 0x3d40122
sub ebx, 0x390bd22
add ebx, dword [ebp - 0x40]
mov edx, 0x8ba3a7b3
add dword [ebp - 0x38], 0x1849c15c
mov esi, dword [ebx]
add dword [ebp - 0x24], edx
xor esi, edx
mov dword [ebp - 0x14], 0x8a680c4a
mov dword [edi], esi
add dword [ebp - 0x18], eax
add edi, 4
add ebx, 4
loop 0x410c5d
add eax, 0x625b5e7f
sub eax, 0x625a6be4
xor ebx, ebx
add ebx, eax
add eax, 0xbc7d9fea
add eax, 0x4382601b
mov ecx, 0x6b6aedb7
sub ecx, 0x6b2aedb7
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1075f5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
stc
adc cl, byte [eax - 0x1e7efcb0]
inc dword [ebx]
add byte [eax], al

Function at 0x1076244
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sar edx, 0xb
mov dword [eax + 0xe0], edx
mov edx, dword [esp + 0x34]
xor al, 0x8d
sbb al, 0x32
sub esi, edx
lea edx, [ecx + edi]
sar ebp, 0xb

Function at 0x1076b2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
lea ebp, [edx + 0x80]
push edi
lea eax, [esp + 0x78]

Function at 0x1076ce8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc eax
add byte [eax], al
mov dword [esp + 0x14], ebx
sub ebx, ebp
add ebx, dword [esp + 0x10]
adc byte [ebx + 0x31c246c], cl
pop esp
and al, 0x18
invalid
pop esp
invalid

Function at 0x10778fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ebx, 0x40
lea ebp, [edx + 0x80]
push edi
lea eax, [esp + 0x78]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], 8
jmp 0x1077920

Function at 0x10889b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor esi, dword [ebp + 0x19]
cmp word [edi + 2], 0x32
jne 0x10889d0
add edi, 4
and dword [ebp - 0x408], 0xffff7fff
jmp 0x10891ed
cmp ax, 0x64
je 0x10891ed
cmp ax, 0x69
je 0x10891ed