joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cb70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00422c50
add esp, 0xc
jo 0x42cb8c
jno 0x42cb8c
call 0x66f33941
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
jne 0x42cbdb
je 0x42cbdb
call 0x8b2f1969
inc ebp
int1
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 0xf]
mov dl, byte [ebp - 0xa]
dec cl
dec al
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 5]
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x13]
dec dl
dec cl
mov byte [ebp - 0xa], dl
mov dl, byte [ebp - 0xe]
dec al
mov byte [ebp - 5], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 0x13], al
mov al, byte [ebp - 4]
dec dl
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 9], cl
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], al
mov al, byte [ebp - 8]
dec dl
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 3]
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0x11]
mov byte [ebp - 8], al
mov al, byte [ebp - 0xc]
dec dl
dec cl
mov byte [ebp - 3], dl
mov dl, byte [ebp - 7]
dec al
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
dec dl
dec cl
dec al
mov byte [ebp - 7], dl
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xb], al
dec byte [ebp - 6]
jb 0x42cc6b
jae 0x42cc6b
sbb al, 0xe8
mov al, 0x54
invalid
call fcn.00422120
test eax, eax
jne 0x42cc7b
pop esi
mov esp, ebp
pop ebp
ret 4
jl 0x42cc80
jge 0x42cc80
call 0x522f1a11
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0042f550
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.00422c50
add esp, 0xc
test esi, esi
jne 0x42cca9
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
jb 0x42ccae
jae 0x42ccae
call 0xd0ffb508
invalid
push esi
call fcn.00429d70
add esp, 4
jo 0x42ccbc
jno 0x42ccbc
call 0x504b124b
mov eax, dword [ebp + 8]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42dd30
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
jb 0x42dd49
jae 0x42dd49
call 0x863f22d8
sal byte [ecx + edx - 0x7f], 0x7c
and al, 4
jbe 0x42dd59
mov eax, dword [ebp - 4]
test eax, eax
je 0x42dd61
cmp dword [esp + 4], 0x1770376
ja 0x42dd59
mov eax, 0xf
mov esp, ebp
pop ebp
ret
sldt word [eax]
add byte [ebx + 0x76c35de5], cl
add esi, dword [edi + 1]
jbe 0x42dd66
ja 0x42dd66
call 0x24f6eaf5
inc ecx
add byte [eax + 0x11], bh
mov ecx, dword [0x4124b4]
mov eax, 0x11
add ecx, eax
mov dword [0x4124b4], ecx
jle 0x42dd7e
jg 0x42dd7e
call 0x24fae2ab
inc ecx
add byte [ecx + 0x7204247c], al
add esi, dword [ebx + 1]
sub dword [0x4124b8], eax
cmp dword [esp + 4], 0x1730372
mov eax, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x44c442
Capabilities:
Encode data using xor

Disassembly:
inc esp
pop esi
cdq
aam 0xa
mov cl, 0x72
insb byte es:[edi], dx
mov eax, dword [0x89074fd7]
wait
sti
mov cl, 0x25
jbe 0x44c49a
pop es
mov ebx, 0xde617b40
dec edi
and dword [edx + 0x3d9e3e0d], 1
pushal
test byte [ecx], al
dec esp
adc al, 0xd
and eax, 0xe5b02b3
out 0x69, eax
ret 0xf831
dec eax
sbb bh, dh
xor al, 0xa2
dec dword [0xeede05fd]
in eax, 0x13
jbe 0x44c4e3
clc
or byte [eax - 0x31d3c548], al
sub al, 0xf3
ljmp 0x1959
sub dword [ebp + 0x1a], 0x35
sub dword [esi + 0x7843cedd], ebp
div dword [ecx]
sub al, 0x7e
aad 0xab
out 0x36, eax
sbb dword [ebx + 0x2340e076], esi
in al, dx
insd dword es:[edi], dx
xchg ebp, eax
or eax, 0xbc21414
pop ecx
popal
mov al, byte [0x1345b469]
test dword [eax], ebp
scasw ax, word es:[edi]
add dl, ch
inc edi
fcom qword [edi + 8]
dec esp
mov ah, 0x7d
invalid
Function at 0x4dad50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc98
push ebx
xor ecx, ecx
mov dword [ebp - 0x368], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da4
xor eax, eax
push ebp
push 0x4dae9f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20d]
mov edx, dword [ebp - 4]
call fcn.00409914
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004029a0
lea eax, [ebp - 0x30d]
mov edx, dword [ebp - 0xc]
call fcn.00409914
lea eax, [ebp - 0x354]
xor ecx, ecx
mov edx, 0x44
call fcn.00403264
mov dword [ebp - 0x354], 0x44
mov dword [ebp - 0x328], 1
mov word [ebp - 0x324], bx
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x30d]
push eax
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x20d]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4dae40
mov dword [ebp - 8], 0xffffffff
push 0
push 0x4daeb0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x368]
call fcn.0040c354
mov eax, dword [ebp - 0x368]
call fcn.00404db4
push eax
mov eax, dword [0x4de924]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4dae76
push 0xffffffffffffffff
mov eax, dword [ebp - 0x364]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x364]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x364]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x360]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4daea6
lea eax, [ebp - 0x368]
call fcn.00404904
lea eax, [ebp - 0xc]
call fcn.00404904
lea eax, [ebp - 4]
call fcn.00404904
ret

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x3ac62866
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x64d56bfa
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x409c01
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
mov bl, pe_nt_image_headers32
test edi, edi
je 0x409c7d
push 9
call esi
test bl, al
je 0x409c7d
push 0x11
call esi
test bl, al
jne 0x409c7d
push 0x10
call esi
test bl, al
jne 0x409c7d
push 0x12
call esi
test bl, al
jne 0x409c7d
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x409c7d
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x409c7d
xor eax, eax
jmp 0x409cff
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x409ca6
push 0x11
call esi
test bl, al
jne 0x409c9e
push 0x10
call esi
test bl, al
jne 0x409c9e
push 0x12
call esi
test bl, al
je 0x409ca6
push 1
push ebp
call fcn.00409bba
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test edi, edi
je 0x409cbc
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x409cfc
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x409cfc
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x409cfc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x409cfc
dec esi
push esi
push dword [0x4118e4]
call fcn.0040ca7a
test eax, eax
je 0x409cfc
mov eax, dword [eax + 8]
jmp 0x409cfe
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x409dc1
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push 0x40f470
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
mov dword [0x4117f4], eax
cmp eax, edi
je 0x409df4
push 0x40f464
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4117f8], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x4117f0], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x409e32
cmp dword [ebp - 0xc], 1
je 0x409e43
cmp dword [ebp - 0xc], 2
jne 0x409e32
cmp dword [ebp - 0x18], 5
jb 0x409e43
jne 0x409e32
cmp dword [ebp - 0x14], edi
jne 0x409e32
mov dword [0x4117f0], edi
cmp dword [0x4117f0], edi
je 0x409e49
call fcn.00409d08
test eax, eax
jne 0x409e49
mov dword [0x4117f0], edi
pop edi
add ebp, 0x78
leave
ret

Function at 0x40aa2e
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x40aa57
test byte [esp + 8], 2
je 0x40aa4b
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40aa59
xor eax, eax
ret 8
Function at 0x6a2ae5
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.006a2b64
jae 0x6a2af1
xor ecx, ecx
call fcn.006a2b64
jae 0x6a2b1b
xor eax, eax
call fcn.006a2b64
jae 0x6a2b2c
mov al, 0x10
call fcn.006a2b64
adc al, al
jae 0x6a2b0d
jne 0x6a2b59
stosb byte es:[edi], al
jmp 0x6a2af2
call fcn.006a2b70
dec ecx
loop 0x6a2b38
mov eax, ebp
call fcn.006a2b6e
jmp 0x6a2b5a
lodsb al, byte [esi]
shr eax, 1
je 0x6a2b80
adc ecx, 2
mov ebp, eax
jmp 0x6a2b5a
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.006a2b6e
cmp eax, 0x7d00
jae 0x6a2b58
cmp eax, 0x500
jae 0x6a2b59
cmp eax, 0x7f
ja 0x6a2b5a
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6a2af2
pop ebp
ret 8
Function at 0x3053f34
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x3053f68
mov edx, dword [eax + 8]
test edx, edx
jne 0x3053f57
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x3053f64
add edx, esi
cmp ebx, edx
jb 0x3053f75
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x3053f4d
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x3053fb0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x3053fca
xor eax, eax
jmp 0x305414a
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x3053fde
xor eax, eax
jmp 0x305414a
cmp word [ebx + 0x14], 0xe0
jne 0x3053fee
cmp word [ebx + 0x18], 0x10b
je 0x3053ff5
xor eax, eax
jmp 0x305414a
mov dword [0x4534ec], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.03053f34
add esp, 8
test eax, eax
jne 0x3054020
xor eax, eax
jmp 0x305414a
mov edx, dword [0x4534ec]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.03053f7c
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x3054052
push 0x10
push 0
push 0x44f992
push 0
call 0x305f97a
xor eax, eax
jmp 0x305414a
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x305411c
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x305410e
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x3054109
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x3054100
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x30540f5
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x30540f5
test cl, cl
je 0x30540ea
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x30540f5
add eax, 2
add edx, 2
test cl, cl
jne 0x30540ce
jne 0x30540f5
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x305414a
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x30540b4
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x305408c
jmp 0x3054148
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x3054140
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x305413c
cmp dword [eax], 0
je 0x305413c
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x305414a
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x3054123
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3054318
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x3054331
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x3054660
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, 0x401aa4
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x3054713
mov eax, 0x401734
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x3054713
mov eax, 0x403ecc
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x3054713
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x3054713
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x30546db
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3054730
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, 0x401aa4
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x30547e6
mov eax, 0x401734
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x30547e6
mov eax, 0x403d30
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x30547e6
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x30547e6
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x30547ae
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3054a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 8]
cmp ecx, edx
jbe 0x3054a28
xor byte [eax], 0xf5
inc edx
inc eax
cmp ecx, edx
ja 0x3054a1f
pop ebp
ret

Function at 0x305db4c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0305dbcf
jae 0x305db5a
xor ecx, ecx
call fcn.0305dbcf
jae 0x305db89
xor eax, eax
call fcn.0305dbcf
jae 0x305db99
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0305dbcf
adc al, al
jae 0x305db7b
jne 0x305dbc5
stosb byte es:[edi], al
jmp 0x305db5d
call fcn.0305dbdb
sub ecx, ebx
jne 0x305dba2
call fcn.0305dbd9
jmp 0x305dbc1
lodsb al, byte [esi]
shr eax, 1
je 0x305dbeb
adc ecx, ecx
jmp 0x305dbbe
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0305dbd9
cmp eax, 0x7d00
jae 0x305dbbe
cmp ah, 5
jae 0x305dbbf
cmp eax, 0x7f
ja 0x305dbc0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x305db5d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x305df18
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x305df87
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x305df4f
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45ede6
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0045ee65
jae 0x45edf2
xor ecx, ecx
call fcn.0045ee65
jae 0x45ee1c
xor eax, eax
call fcn.0045ee65
jae 0x45ee2d
mov al, 0x10
call fcn.0045ee65
adc al, al
jae 0x45ee0e
jne 0x45ee5a
stosb byte es:[edi], al
jmp 0x45edf3
call fcn.0045ee71
dec ecx
loop 0x45ee39
mov eax, ebp
call fcn.0045ee6f
jmp 0x45ee5b
lodsb al, byte [esi]
shr eax, 1
je 0x45ee81
adc ecx, 2
mov ebp, eax
jmp 0x45ee5b
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0045ee6f
cmp eax, 0x7d00
jae 0x45ee59
cmp eax, 0x500
jae 0x45ee5a
cmp eax, 0x7f
ja 0x45ee5b
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x45edf3
pop ebp
ret 8
Function at 0x40107c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x200]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_vsprintf]
add esp, 0xc
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push eax
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 0xc
leave
ret
Function at 0x4017d3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_malloc]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
mov dword [ebp - 4], edi
jne 0x401871
push str.ACTIVESTATE_LICENSE
call dword [sym.imp.MSVCRT.dll_getenv]
test eax, eax
pop ecx
je 0x40180f
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x401871
push 0
lea eax, [ebp - 8]
push dword [ebp + 0xc]
test byte [ebp + 0x14], 1
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.0040196f
add esp, 0x10
test eax, eax
je 0x401916
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
call esi
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x40184f
push dword [ebp + 0x14]
call dword [sym.imp.MSVCRT.dll_free]
jmp 0x401915
push str.ActiveState.lic
push dword [ebp + 0x14]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 0x14]
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll__stat]
pop ecx
test eax, eax
pop ecx
je 0x4018b0
push 0x800
call esi
pop ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
mov dword [ecx], eax
je 0x4018a7
push dword [ebp - 4]
push str.License_file__s_does_not_exist
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
test edi, edi
jne 0x401916
push dword [ebp - 4]
jmp 0x401844
mov eax, dword [ebp - 0x18]
lea ebx, [eax + 0xa]
push ebx
call esi
mov edi, eax
mov eax, dword [ebp + 8]
test edi, edi
pop ecx
mov dword [eax], edi
je 0x401916
push 0x40b480
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
mov dword [ebp + 0x14], eax
test eax, eax
pop ecx
jne 0x40191a
push edi
mov edi, dword [sym.imp.MSVCRT.dll_free]
call edi
mov dword [esp], 0x800
call esi
pop ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
mov dword [ecx], eax
je 0x40190a
push dword [ebp - 4]
push str.Cannot_read_license_file__s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x401916
push dword [ebp - 4]
call edi
pop ecx
xor eax, eax
jmp 0x40196a
test ebx, ebx
je 0x40194d
push dword [ebp + 0x14]
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
test eax, eax
je 0x40194d
push edi
call sub.MSVCRT.dll_strlen
add edi, eax
pop ecx
cmp byte [edi - 2], 0xd
jne 0x401945
and byte [edi - 2], 0
jmp 0x401949
and byte [edi - 1], 0
sub ebx, eax
jne 0x40191e
cmp dword [ebp + 0x10], 0
jne 0x40195d
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push dword [ebp + 0x14]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret