joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [0x44be80]
test ebx, ebx
jne 0x411160
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
shr edx, 8
xor edx, eax
movzx edx, dl
mov edx, dword [edx*4 + 0x44bfc0]
test edx, edx
je 0x421fc0
cmp dword [edx + 8], eax
jne 0x4111a0
mov edi, dword [edx + 4]
mov edx, dword [0x42d068]
movzx ecx, byte [edi + 0x10]
test cl, cl
je 0x41104c
movzx eax, word [edi + 0x12]
add eax, 1
mov word [edi + 0x12], ax
movzx eax, ax
shr eax, cl
test eax, eax
je 0x411170
xor eax, eax
mov word [edi + 0x12], ax
add ecx, 1
mov byte [edi + 0x10], cl
test edx, edx
jne 0x411140
xor esi, esi
jmp 0x4110a7
mov ebp, dword [0x42d3d0]
test ebx, ebx
cmove esi, dword [0x42d350]
test ebp, ebp
je 0x4110f0
mov edx, dword [ebp + 4]
mov dword [0x42d3d0], edx
mov ecx, dword [0x42d068]
test ecx, ecx
jne 0x4110d0
mov edx, dword [ebp + 0xc]
mov dword [ebp + 4], 0
add ebx, 1
mov dword [esp + 4], edx
mov edx, dword [ebp]
mov dword [esp], edx
call dword [ebp + 8]
mov dword [ebp + 0xc], 0
mov eax, dword [0x42d3d0]
test eax, eax
je 0x41110a
mov eax, dword [0x42d068]
test eax, eax
je 0x411060
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x411060
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x411086
mov ebp, dword [0x42d068]
test ebp, ebp
je 0x41110a
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
test ebx, ebx
je 0x411132
mov eax, dword [0x42d350]
cmp eax, esi
je 0x411132
mov edx, dword [0x42d068]
test edx, edx
jne 0x4111c0
add eax, dword [0x42d354]
sub eax, esi
mov dword [0x42d354], eax
mov byte [edi + 0x10], 0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x41105a
mov eax, dword [0x42d068]
test eax, eax
je 0x411136
jmp 0x411180
test edx, edx
je 0x411136
lea esi, [esi]
lea esi, [esi]
nop
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x411136
mov edx, dword [edx]
test edx, edx
je 0x411204
cmp eax, dword [edx + 8]
je 0x41101d
jmp 0x4111a0
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x42d354]
sub esp, 4
sub eax, esi
add eax, dword [0x42d350]
mov dword [0x42d354], eax
mov eax, dword [0x42d068]
test eax, eax
je 0x411132
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x411132
jmp 0x421fc0
mov eax, dword [4]
ud2
Function at 0x411270
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push ebx
sub esp, 0x14
mov edx, dword [0x42d30c]
test edx, edx
je 0x411300
cmp eax, 0xffffeffe
lea edx, [eax + 0x1000]
mov eax, 0xffffffff
mov dword [esp], 0
cmova edx, eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ebx, [eax + 0xfff]
sub esp, 8
and ebx, 0xfffff000
cmp dword [0x42d3ac], 0x1ff
jbe 0x4112d4
mov dword [esp], str.Too_many_heap_sections
call fcn.00410f40
call dword [sym.imp.KERNEL32.dll_DebugBreak]
test ebx, ebx
je 0x4112ed
mov eax, dword [0x42d3ac]
lea edx, [eax + 1]
mov dword [eax*4 + 0x441514], ebx
mov dword [0x42d3ac], edx
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
cmp dword [0x42480c], 1
mov esi, dword [0x42d304]
mov dword [esp], 0
sbb ecx, ecx
mov ebx, dword [0x42d308]
xor edx, edx
and ecx, 0xffffffc4
add ecx, 0x40
or bh, 0x30
test esi, esi
sete dl
mov dword [esp + 8], ebx
mov esi, edx
add edx, eax
mov dword [esp + 0xc], ecx
not esi
cmp esi, eax
mov eax, 0xffffffff
cmovbe edx, eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
test eax, 0xfff
je 0x4112b6
mov dword [esp], str.Bad_VirtualAlloc_result
call fcn.00410f40
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x4112b6

Function at 0x411520
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
shl edx, 0xc
xor ecx, 1
mov ebp, eax
push edi
lea edi, [eax + edx]
mov edx, ecx
push esi
and edx, 1
push ebx
sub esp, 0x2c
mov esi, dword [0x44c3e8]
mov byte [esp + 0x1b], dl
mov ebx, esi
lea esi, [esi + edi - 1]
neg ebx
and ebp, ebx
and esi, ebx
mov dword [esp + 0x1c], ebp
cmp ebp, esi
jae 0x4115a3
mov dword [esp + 0x14], eax
mov edx, ebp
mov ebp, 1
cmp dword [esp + 0x14], edx
seta bl
cmp edi, edx
setbe cl
or bl, cl
jne 0x411577
cmp byte [esp + 0x1b], 0
je 0x411599
mov ebx, edx
mov ecx, edx
mov eax, ebp
shr ebx, 0x11
shr ecx, 0xc
and ebx, 0x1fff
shl eax, cl
add ebx, 0x307c
lock or dword [ebx*4 + 0x42d320], eax
add edx, 0x1000
cmp edx, esi
jb 0x411560
cmp dword [0x42480c], 1
mov dword [esp + 0xc], 0x44be84
sbb eax, eax
and eax, 0xffffffc4
add eax, 0x40
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
sub esi, eax
mov dword [esp], eax
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4115e0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.un_VirtualProtect_failed:_errcode_0x_X_n
mov dword [esp + 4], eax
call fcn.00411380
mov dword [esp], str.un_VirtualProtect_failed
call fcn.00410f40
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_DebugBreak]
Function at 0x411610
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov ecx, dword [0x42d08c]
test ecx, ecx
je 0x41165f
mov edx, dword [0x42d070]
test edx, edx
jne 0x41165f
mov edx, dword [eax + 4]
cmp edx, 0x44be68
je 0x411639
mov ecx, dword [0x42d304]
test ecx, ecx
je 0x411660
cmp eax, 0x44bf80
jne 0x411650
ret
mov edx, dword [0x42d304]
and eax, 0xfffff000
test edx, edx
je 0x4116d0
ret
push ebx
mov ebx, eax
mov eax, edx
xor ecx, ecx
and eax, 0xfffff000
mov edx, 1
sub esp, 8
call fcn.00411520
cmp ebx, 0x44bf80
je 0x4116c0
mov eax, dword [0x42d08c]
test eax, eax
je 0x4116c0
mov eax, ebx
mov ebx, dword [0x42d070]
and eax, 0xfffff000
test ebx, ebx
jne 0x4116c0
mov ecx, dword [0x42d304]
test ecx, ecx
jne 0x4116c0
add esp, 8
xor ecx, ecx
mov edx, 1
pop ebx
jmp fcn.00411520
add esp, 8
pop ebx
ret
xor ecx, ecx
mov edx, 1
jmp fcn.00411520
Function at 0x412ed0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov eax, dword [0x42d04c]
mov edi, dword [0x44bf60]
mov dword [0x42d048], 1
test edi, edi
jne 0x412f80
mov eax, dword [0x42d068]
test eax, eax
jne 0x412f20
mov dword [0x42d048], 0
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
mov ecx, dword [0x42d068]
test ecx, ecx
je 0x412f00
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x42d068]
mov dword [0x42d048], 0
sub esp, 4
test edx, edx
je 0x412f0a
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [edi*4]
lea ebx, [esp + 0x10]
mov dword [esp + 4], 0x44bec0
mov dword [esp + 8], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x44bec0
mov dword [0x44bf60], 0
call sub.msvcrt.dll_memset
mov eax, dword [0x42d068]
test eax, eax
jne 0x4130b0
mov dword [esp + 4], edi
add esi, ebx
mov dword [esp], str.Found__u_leaked_objects:_n
call fcn.004123d0
jmp 0x41300f
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ebp + 0xc]
mov eax, edi
call fcn.00412de0
mov edi, dword [0x42d068]
test edi, edi
jne 0x413060
add ebx, 4
cmp esi, ebx
je 0x413077
mov edi, dword [ebx]
mov dword [esp], edi
call fcn.00412450
test edi, edi
je 0x413008
mov edx, edi
mov eax, dword [0x42d068]
shr edx, 0x16
mov ecx, dword [edx*4 + 0x448d14]
mov edx, edi
shr edx, 0xc
and edx, 0x3ff
mov ebp, dword [ecx + edx*4]
test eax, eax
je 0x412ff0
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x412ff0
mov dword [esp], 0x42d050
add ebx, 4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
cmp esi, ebx
jne 0x41300f
mov dword [esp], str.GC_ABORT_ON_LEAK
call sub.msvcrt.dll_getenv
test eax, eax
je 0x412f30
mov dword [esp], str.Leaked_or_smashed_objects_encountered
call fcn.00410f40
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x412f30
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x412fce
Function at 0x4131e0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x2ec
call fcn.00411610
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ebp, [esp + 0x10]
lea esi, [esi]
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], ebp
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
je 0x413221
cmp dword [esp + 0x10], 0x103
jne 0x4132d0
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
je 0x413291
cmp dword [0x44c3c4], 1
sbb eax, eax
and eax, 0xbffffffc
add eax, 0x40010007
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
jne 0x4132f0
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x413291
mov dword [esp], str.ResumeThread_failed_in_suspend_loop
call fcn.00410f40
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp esi, 1
jle 0x4132a6
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
add esi, 1
cmp esi, 0xf423f
jle 0x413200
mov dword [esp], str.SuspendThread_loop_failed
call fcn.00410f40
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x413200
mov eax, ebx
call fcn.004130d0
add esp, 0x2ec
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x14]
or byte [ebx + 0x10], 0x40
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0xa4]
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0xb0]
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0xb4]
mov dword [ebx + 0x24], eax
mov eax, dword [esp + 0xb8]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0xbc]
mov dword [ebx + 0x2c], eax
mov eax, dword [esp + 0xc0]
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0xc4]
mov dword [ebx + 0x34], eax
mov eax, dword [esp + 0xc8]
mov dword [ebx + 0x38], eax
mov eax, dword [esp + 0xd8]
mov dword [ebx + 0x14], eax
add esp, 0x2ec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [0x42d360]
mov edx, dword [0x42d368]
sub edx, ebx
cmp eax, 0xfffffff7
ja 0x413960
lea esi, [eax + 7]
and esi, 0xfffffff8
cmp esi, edx
jbe 0x413855
cmp esi, 0xffff
ja 0x4138f1
mov ecx, dword [0x42d30c]
test ecx, ecx
je 0x413870
mov dword [esp + 4], 0x11000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ebx, [eax + 0xfff]
sub esp, 8
and ebx, 0xfffff000
cmp dword [0x42d3ac], 0x1ff
jbe 0x413816
mov dword [esp], str.Too_many_heap_sections
call fcn.00410f40
call dword [sym.imp.KERNEL32.dll_DebugBreak]
test ebx, ebx
je 0x4138e0
mov eax, dword [0x42d3ac]
add dword [0x42d340], 0x10000
cmp dword [0x42d310], 2
lea edx, [eax + 1]
mov dword [eax*4 + 0x441514], ebx
mov dword [0x42d3ac], edx
je 0x413930
lea eax, [ebx + 0x10000]
mov dword [0x42d368], eax
add esi, ebx
mov dword [0x42d360], esi
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
cmp dword [0x42480c], 1
mov edx, dword [0x42d304]
mov dword [esp], 0
sbb eax, eax
and eax, 0xffffffc4
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, dword [0x42d308]
or ah, 0x30
mov dword [esp + 8], eax
xor eax, eax
test edx, edx
sete al
add eax, 0x10000
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
test eax, 0xfff
je 0x4137f8
mov dword [esp], str.Bad_VirtualAlloc_result
call fcn.00410f40
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x4137f8
mov dword [esp + 4], esi
mov dword [esp], str.GC_Warning:_Out_of_memory___trying_to_allocate_requested_amount___lu_bytes_..._n
call dword [0x424810]
mov eax, esi
call fcn.00411270
mov ebx, eax
test eax, eax
je 0x413970
add dword [0x42d340], esi
cmp dword [0x42d310], 2
jne 0x41385d
mov dword [esp + 4], esi
mov dword [esp], str.Got__lu_bytes_from_OS_n
call fcn.00411380
jmp 0x41385d
mov dword [esp + 4], 0x10000
mov dword [esp], str.Got__lu_bytes_from_OS_n
call fcn.00411380
lea eax, [ebx + 0x10000]
mov dword [0x42d368], eax
jmp 0x413855
mov esi, 0xfffffff8
cmp edx, 0xfffffff7
jbe 0x4138f1
jmp 0x413855
xor ebx, ebx
jmp 0x41385d
Function at 0x4184b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ecx, dword [0x42d08c]
test ecx, ecx
je 0x418560
mov edx, dword [0x42d3a0]
test edx, edx
je 0x418560
lea esi, [eax + eax*4]
mov ebx, dword [0x44be28]
add esi, esi
cmp esi, ebx
jg 0x4184f7
jmp 0x418546
add ebx, 1
cmp esi, ebx
je 0x418540
call fcn.00403170
test eax, eax
je 0x4184f0
mov eax, dword [0x42d088]
test eax, eax
jne 0x418540
cmp dword [0x42482c], 0xf423f
mov eax, dword [0x44be38]
je 0x41866a
cmp eax, 2
jle 0x41865a
mov eax, fcn.004105c0
call fcn.004165b0
test eax, eax
jne 0x4186aa
add dword [0x44be38], 1
mov ebx, dword [0x44be28]
test ebx, ebx
jle 0x418569
sub ebx, esi
mov eax, 0
cmovs ebx, eax
mov dword [0x44be28], ebx
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [0x42d088]
test eax, eax
je 0x418570
add esp, 0x14
pop ebx
pop esi
ret
call fcn.00412770
test eax, eax
je 0x418569
mov eax, dword [0x42d08c]
test eax, eax
je 0x418690
mov ebx, dword [0x44be3c]
test ebx, ebx
jne 0x4185a1
mov eax, dword [0x449df8]
cmp eax, dword [0x424828]
jl 0x418650
mov ecx, dword [0x42d310]
test ecx, ecx
jne 0x4186ba
call fcn.00412230
mov edx, 1
xor eax, eax
call fcn.004119a0
mov dword [esp + 4], 0
mov dword [esp], 0x4109d0
call fcn.00402c60
mov dword [0x42d37c], 0
mov dword [0x42d3a0], 5
mov dword [0x42d398], 0
mov dword [0x449df8], 0
mov dword [0x44c3c0], 1
cmp dword [0x42482c], 0xf423f
je 0x41861d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x449df4], eax
mov eax, 0x4121a0
call fcn.004165b0
test eax, eax
jne 0x418680
mov edx, dword [0x44c3c0]
test edx, edx
jne 0x418569
add dword [0x44be38], 1
jmp 0x418569
add eax, 1
mov dword [0x449df8], eax
jmp 0x418606
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x449df4], eax
mov eax, dword [0x44be38]
cmp eax, 2
jg 0x418527
mov eax, 0x4121a0
jmp 0x41852c
add esp, 0x14
pop ebx
pop esi
jmp fcn.00417100
mov esi, dword [0x42d088]
test esi, esi
jne 0x418569
add esp, 0x14
mov eax, fcn.004105c0
pop ebx
pop esi
jmp fcn.004186e0
call fcn.00417100
mov ebx, dword [0x44be28]
jmp 0x418546
mov eax, dword [0x42d344]
mov dword [esp], str._Full_mark_for_collection__lu_after__lu_allocd_bytes_n
mov dword [esp + 8], eax
mov eax, dword [0x42d2ac]
add eax, 1
mov dword [esp + 4], eax
call fcn.00411380
jmp 0x4185af
Function at 0x419ef0
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
mov eax, dword [0x42d06c]
test eax, eax
je 0x419f00
ret
sub esp, 0x1c
mov dword [esp], str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
je 0x419f50
mov dword [esp + 4], str.InitializeCriticalSectionAndSpinCount
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x419f50
mov dword [esp + 4], 0xfa0
mov dword [esp], 0x42d050
call eax
sub esp, 8
jmp 0x419f60
mov dword [esp], 0x42d050
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
add esp, 0x1c
jmp fcn.00419480

Function at 0x41a9d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.00421904
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.00421904
mov edx, eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x41b4e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x41b4ff
mov eax, 0
jmp 0x41b543
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x41b522
mov eax, 0
jmp 0x41b543
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x41b53e
mov eax, 0
jmp 0x41b543
mov eax, 1
leave
ret

Function at 0x41b545
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x41b5a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x41b59c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x41b59c
mov eax, dword [ebp - 4]
jmp 0x41b5b8
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x41b579
mov eax, 0
leave
ret
Function at 0x1039dd2c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1039dd36
pushal
call 0x1039dd3c
pop ebp
sub ebp, 0x10
sub ebp, 0x39dd2c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1039dd60
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x1039dd69
and byte [eax + 0x39dd2c], bh
mov eax, 0x39dd2c
add eax, ebp
add eax, 0x63
mov ecx, 0x5e6
mov edx, 0x9cb6a820
xor byte [eax], dl
inc eax
dec ecx
jne 0x1039dd80
jmp 0x1039dd93
stosd dword es:[edi], eax
in eax, dx
stosd dword es:[edi], eax
test eax, 0x2020201c
mov eax, dword [0x2020d8e1]
and byte [ebx], ah
in eax, dx
cwde
and esp, dword [eax]
and byte [eax], ah
lcall 0xc2d7, 0x20202008
and ebp, eax
stosd dword es:[edi], eax
mov eax, dword [0x2020202c]
and esp, ebp
jo 0x1039dd68
inc esp
add al, 0xdc
test eax, 0x8480424
pop ebx
and byte cs:[eax + 0x21], cl
inc edx
or esp, dword [eax]
and dword [esp + eax], ecx
dec eax
xor byte [ebp + 0x25c82f0b], dl
and byte [eax], ah
and cl, cl
or byte [eax], ah
and byte [eax], ah
jne 0x1039dd8a
int3

Function at 0x88e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0088e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88e06a
add dl, dl
jne 0x88e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88e0dc
xor eax, eax
add dl, dl
jne 0x88e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88e17d
add dl, dl
jne 0x88e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x88e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x88e075
mov eax, 1
add dl, dl
jne 0x88e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88e0e1
sub eax, ebx
mov ebx, 1
jne 0x88e128
mov ecx, 1
add dl, dl
jne 0x88e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88e136
cmp eax, 0x7d00
jae 0x88e16d
cmp eax, 0x500
jb 0x88e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e075
cmp eax, 0x7f
ja 0x88e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x88e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x8d3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008d31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8d307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8d306a
add dl, dl
jne 0x8d3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8d30dc
xor eax, eax
add dl, dl
jne 0x8d3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8d317d
add dl, dl
jne 0x8d30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8d30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8d30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8d30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8d30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8d3075
mov eax, 1
add dl, dl
jne 0x8d30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8d30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8d30e1
sub eax, ebx
mov ebx, 1
jne 0x8d3128
mov ecx, 1
add dl, dl
jne 0x8d310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8d3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8d3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8d3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8d313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8d314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8d3136
cmp eax, 0x7d00
jae 0x8d316d
cmp eax, 0x500
jb 0x8d3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8d3075
cmp eax, 0x7f
ja 0x8d3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8d3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8d319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8d3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10