joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40379c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5af008], 0x8088405
inc edx
mov dword [ebx + 0x5af008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4138dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jbe 0x413900
mov eax, 1
mov ebx, ecx
add ebx, eax
dec ebx
mov bl, byte [ebx]
mov edi, edx
add edi, eax
dec edi
xor byte [edi], bl
inc eax
dec esi
jne 0x4138ee
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x413c90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x413cb5
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x14]
mov eax, edi
call fcn.00413c50
mov ax, word [esi + ebp*2 + 0x16]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x18]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1a]
lea eax, [edi + 6]
call fcn.00413c50
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1c]
lea eax, [edi + 4]
call fcn.00413c50
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x1e]
lea eax, [edi + 2]
call fcn.00413c50
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x413cd1
mov dx, word [esi + 0x74]
mov eax, edi
call fcn.00413c50
mov ax, word [esi + 0x76]
add word [edi + 4], ax
mov ax, word [esi + 0x78]
add word [edi + 2], ax
mov dx, word [esi + 0x7a]
lea eax, [edi + 6]
call fcn.00413c50
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x413e20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x413e45
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x7c]
mov eax, edi
call fcn.00413c50
mov ax, word [esi + ebp*2 + 0x7e]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x80]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x82]
lea eax, [edi + 6]
call fcn.00413c50
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x84]
lea eax, [edi + 4]
call fcn.00413c50
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x86]
lea eax, [edi + 2]
call fcn.00413c50
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x413e61
mov dx, word [esi + 0xdc]
mov eax, edi
call fcn.00413c50
mov ax, word [esi + 0xde]
add word [edi + 4], ax
mov ax, word [esi + 0xe0]
add word [edi + 2], ax
mov dx, word [esi + 0xe2]
lea eax, [edi + 6]
call fcn.00413c50
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4225e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x422615
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x422606
and ecx, 3
je 0x42262d
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x42261a
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x422638
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x422671
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x422659
pop esi
and esi, 3
je 0x422696
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x422677
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4226a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x4226cc
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x4226bd
and ecx, 3
je 0x4226e4
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x4226d1
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4226ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x4226f8
pop edi
pop ebx
ret
Function at 0x423014
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00422c6c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x52f553
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x4230c2
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.004034e8
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.004226ec
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.004034e8
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.004226ec
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x42306f
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x423110
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.004034e8
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.004226ec
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.004034e8
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x42313a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x42313a
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x42312a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f55a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00422e08
ret

Function at 0x43191c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jl 0x431970
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x5b55a4]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x5b59a4]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x5b5da4]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x5b61a4]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x43192b
pop edi
pop esi
pop ebx
ret
Function at 0x43dc80
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea esi, [ebp - 0x110]
mov eax, ebx
xor edx, edx
div ecx
mov al, byte [edi + edx]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x43dca3
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0xc], 0
jle 0x43dd29
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x43dd29
inc eax
mov dword [ebp - 0x10], eax
xor edx, edx
inc ebx
and ebx, 0xff
xor eax, eax
mov al, byte [ebp + ebx - 0x110]
lea ecx, [eax + esi]
and ecx, 0xff
mov esi, ecx
mov cl, byte [ebp + esi - 0x110]
mov byte [ebp + ebx - 0x110], cl
mov byte [ebp + esi - 0x110], al
xor ecx, ecx
mov cl, byte [ebp + ebx - 0x110]
add eax, ecx
and eax, 0xff
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
xor cl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + edx], cl
inc edx
dec dword [ebp - 0x10]
jne 0x43dcd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43dd34
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea esi, [ebp - 0x110]
mov eax, dword [ebp + 8]
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
call fcn.00405c44
mov al, byte [edi + eax]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x43dd54
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 0xc], 0
jle 0x43dde1
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x43dde1
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
inc ebx
and ebx, 0xff
xor eax, eax
mov al, byte [ebp + ebx - 0x110]
lea edx, [eax + edx]
and edx, 0xff
mov cl, byte [ebp + edx - 0x110]
mov byte [ebp + ebx - 0x110], cl
mov byte [ebp + edx - 0x110], al
xor ecx, ecx
mov cl, byte [ebp + ebx - 0x110]
add eax, ecx
and eax, 0xff
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + esi]
xor cl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + esi], cl
inc esi
dec dword [ebp - 0x10]
jne 0x43dd8a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ddec
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, ecx
mov ecx, edx
mov ebp, eax
test cl, cl
jbe 0x43de53
xor ebx, ebx
mov esi, esp
mov byte [edi + ebx], bl
xor eax, eax
mov al, cl
push eax
mov eax, ebx
pop edx
push ecx
mov ecx, edx
cdq
idiv ecx
pop ecx
mov al, byte [ebp + edx]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x43de04
xor eax, eax
xor ebx, ebx
mov esi, esp
mov dl, byte [edi + ebx]
xor ecx, ecx
mov cl, dl
add eax, ecx
xor ecx, ecx
mov cl, byte [esi]
add eax, ecx
and eax, 0xff
mov cl, byte [edi + eax]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
inc ebx
inc esi
cmp ebx, 0x100
jne 0x43de2c
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x444558
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x44455e
ret
Function at 0x4957c8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, esi
cmp word [ecx], 0x5a4d
jne 0x495888
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov ebx, eax
cmp dword [ebx], 0x4550
jne 0x495888
push 4
push 0x1000
mov eax, dword [ebx + 0x50]
push eax
push 0
call fcn.00407478
mov edi, eax
test edi, edi
je 0x495888
mov ecx, dword [ebx + 0x54]
mov edx, esi
mov eax, edi
call fcn.00407c34
mov ax, word [ebx + 6]
test ax, ax
jbe 0x495875
movzx eax, ax
dec eax
test eax, eax
jl 0x495875
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x108]
mov edx, dword [ebx + eax*8 + 0x10c]
add edx, esi
push edx
mov eax, dword [ebx + eax*8 + 0x104]
add eax, edi
pop edx
call fcn.00407c34
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x495847
lea eax, [ebp - 0xc]
push eax
push 2
mov eax, dword [ebx + 0x50]
push eax
push edi
call fcn.00407498
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x499388
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov eax, dword [eax + 0x78]
add eax, ebx
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 8], edx
cmp dword [ebp + 0xc], 0xffff
jbe 0x49941a
test esi, esi
jbe 0x49943e
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00409f7c
test eax, eax
jne 0x499408
mov eax, dword [ebp - 8]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49943e
add ebx, dword [ebp - 4]
mov dword [ebp - 4], ebx
jmp 0x49943e
add dword [ebp - 8], 2
add edi, 4
dec esi
test esi, esi
je 0x49943e
test esi, esi
ja 0x4993d9
jmp 0x49943e
mov edx, dword [ebp + 0xc]
sub edx, dword [eax + 0x10]
cmp edx, dword [eax + 0x14]
jae 0x49943e
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49943e
add ebx, dword [ebp - 4]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x499ed4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x5a636f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, esi
push 2
push ebx
call fcn.00407330
test eax, eax
jne 0x499f65
cmp word [ebx], 0x5a4d
jne 0x499f65
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov ebx, eax
push 4
push ebx
call fcn.00407330
test eax, eax
jne 0x499f65
cmp dword [ebx], 0x4550
jne 0x499f65
movzx eax, word [ebx + 6]
lea eax, [eax + eax*4]
lea eax, [ebx + eax*8 + 0x120]
mov ebx, eax
push 0x10
push ebx
call fcn.00407330
test eax, eax
jne 0x499f65
mov edx, dword [0x5bffe0]
add edx, 0x434
mov ecx, 0x10
mov eax, ebx
call fcn.00408ec4
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x499f79
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49d984
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x49d9a1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x49d992
add dl, dl
jne 0x49d9ac
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x49d9f8
xor eax, eax
add dl, dl
jne 0x49d9b9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x49da95
add dl, dl
jne 0x49d9c8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x49d9d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x49d9de
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x49d9e9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x49d9f3
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x49d998
mov eax, 1
add dl, dl
jne 0x49da06
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x49da11
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x49d9fd
sub eax, 2
jne 0x49da40
mov ecx, 1
add dl, dl
jne 0x49da26
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x49da31
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x49da1d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x49d998
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x49da57
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x49da62
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x49da4e
cmp eax, 0x7d00
jae 0x49da85
cmp eax, 0x500
jb 0x49da80
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x49d998
cmp eax, 0x7f
ja 0x49da88
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x49d998
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x49dab0
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x49d998
pop ebp
sub edi, dword [ebp + 0x40]
mov dword [esp + 0x1c], edi
popal
pop ebp
ret
Function at 0x401318
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040169c
test esi, esi
jne 0x40134e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00401788
jmp 0x40136c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040122c
mov edi, eax
test esi, esi
je 0x40136c
cmp dword [ebx], 0
je 0x40136c
dec esi
jmp 0x401355
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x403c0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x403cfb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x403d08
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403c75
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_CharLowerA
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.004017d0
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x22
jne 0x403cb8
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x403d2c
call fcn.00401aa0
mov ecx, eax
add ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00401a18
jmp 0x403cdb
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x403d2c
call fcn.00401aa0
mov ecx, eax
add ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00401a18
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.004016f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d02
lea eax, [ebp - 0x10]
call fcn.0040169c
ret

Function at 0x403dd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x403e34
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, edx
dec esi
test esi, esi
jl 0x403e1e
inc esi
xor ebx, ebx
lea eax, [ebp - 4]
mov edx, dword [0x405070]
call fcn.00401800
mov eax, dword [ebp - 4]
call fcn.00403d6c
xor edx, edx
mov dl, byte [edi + ebx]
xor eax, edx
mov byte [edi + ebx], al
inc ebx
dec esi
jne 0x403dfa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403e3b
lea eax, [ebp - 4]
call fcn.0040169c
ret