joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c808
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
mov esi, dword [0x48fe64]
xor eax, eax
push ebp
push 0x48c9ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x18]
mov edx, dword [esi + 0x108]
call fcn.0040463c
lea ecx, [ebp - 4]
xor eax, eax
mov al, byte [esi + 0x10c]
mov edx, 2
call fcn.00408c70
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.0040463c
lea ecx, [ebp - 8]
xor eax, eax
mov al, byte [esi + 0x10d]
mov edx, 2
call fcn.00408c70
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x20]
call fcn.0040463c
lea ecx, [ebp - 0xc]
xor eax, eax
mov al, byte [esi + 0x10e]
mov edx, 2
call fcn.00408c70
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x24]
call fcn.0040463c
lea ecx, [ebp - 0x10]
xor eax, eax
mov al, byte [esi + 0x10f]
mov edx, 2
call fcn.00408c70
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040463c
lea edx, [ebp - 0x14]
mov eax, dword [0x4964a8]
mov eax, dword [eax + 0x31c]
call fcn.0043bc28
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0040463c
lea eax, [ebx + 4]
push eax
mov eax, dword [esi + 0x104]
mov ecx, 1
mov edx, 9
call fcn.00404b08
lea eax, [ebx + 8]
push eax
mov eax, dword [esi + 0x104]
mov ecx, 4
mov edx, 5
call fcn.00404b08
mov eax, dword [esi + 0x110]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x18]
call fcn.0048bea4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040463c
lea ecx, [ebp - 0x1c]
mov eax, dword [esi + 0x114]
mov edx, 8
call fcn.00408c70
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
mov eax, dword [esi + 0x110]
mov edx, 8
call fcn.00408c70
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x10]
pop ecx
call fcn.004048f4
mov byte [ebx + 0x30], 0
lea eax, [ebx + 0x34]
mov edx, 0x48c9c4
call fcn.0040463c
mov dl, 1
mov eax, dword [0x41633c]
call fcn.004037e4
mov dword [ebx + 0x38], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c9b3
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040460c
lea eax, [ebp - 0x14]
call fcn.004045e8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040460c
ret
Function at 0x41da4c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x483c68
call fcn.00466fdc
sub esp, 0x440
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x44b]
mov byte [ebp - 0x44c], bl
mov dword [ebp - 0x10], 0x208
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x41db45
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
mov byte [ebp - 0x244], 0x22
call fcn.00401166
mov ecx, eax
call fcn.0042a4c5
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.004042dd
push eax
lea eax, [ebp - 0x243]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00402438
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x244]
push str.____
push eax
call esi
lea eax, [ebp - 0x44c]
push 0x20
push eax
call fcn.00468e90
pop ecx
cmp eax, ebx
pop ecx
je 0x41db45
push eax
lea eax, [ebp - 0x244]
push eax
call esi
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x244]
push eax
push 1
push ebx
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
jmp 0x41db47
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x43b654
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x94], 0x94
and dword [eax], 0
lea eax, [ebp - 0x94]
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 1
jne 0x43b6cf
cmp dword [ebp - 0x8c], 0
je 0x43b6c7
cmp dword [ebp - 0x8c], 0xa
je 0x43b6b2
cmp dword [ebp - 0x8c], 0x5a
je 0x43b6bb
xor al, al
mov dword [esi], 0x80
jmp 0x43b740
call fcn.0043bbc4
test al, al
je 0x43b6bf
mov al, 1
jmp 0x43b6a7
mov dword [esi], 0x40
jmp 0x43b729
mov dword [esi], 0x10
jmp 0x43b729
cmp dword [ebp - 0x84], 2
jne 0x43b73e
mov eax, dword [ebp - 0x90]
sub eax, 4
je 0x43b736
mov ecx, dword [ebp - 0x8c]
dec eax
je 0x43b6f9
dec eax
je 0x43b71f
xor al, al
mov dword [esi], 0x2000000
jmp 0x43b740
test ecx, ecx
jne 0x43b705
mov dword [esi], 0x100000
jmp 0x43b729
cmp ecx, 1
jne 0x43b712
mov dword [esi], 0x400000
jmp 0x43b729
cmp ecx, 2
jne 0x43b71f
mov dword [esi], 0x800000
jmp 0x43b729
test ecx, ecx
jne 0x43b72d
mov dword [esi], 0x1000000
mov al, 1
jmp 0x43b740
cmp ecx, 1
jne 0x43b6ef
mov al, cl
jmp 0x43b6f1
mov dword [esi], 0x10000
jmp 0x43b729
xor al, al
pop esi
leave
ret

Function at 0x43bab9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x43bae8
push str.GetSystemDefaultUILanguage
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43bae8
call eax
jmp 0x43bbbf
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
mov ebx, 0xf003f
push eax
push ebx
push 0
mov edi, SysStringLen
push str..DefaultControl_PaneldesktopResourceLocale
push edi
mov dword [ebp - 0xc], 0xa
call esi
test eax, eax
jne 0x43bb34
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x4a9e54
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43bb95
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
push 0
push str..DEFAULTControl_PanelInternational
push edi
call esi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x43bb69
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push str.Locale
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x43bb7d
cmp esi, ebx
je 0x43bb7d
push dword [ebp - 8]
call esi
cmp edi, ebx
je 0x43bb9d
cmp dword [ebp - 4], ebx
je 0x43bb8f
cmp esi, ebx
je 0x43bb8f
push dword [ebp - 4]
call esi
mov ax, 0x409
jmp 0x43bbbf
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
push 0x10
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0046713c
add esp, 0xc
cmp dword [ebp - 4], ebx
mov edi, eax
je 0x43bbbc
cmp esi, ebx
je 0x43bbbc
push dword [ebp - 4]
call esi
mov ax, di
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4f55d0
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov eax, dword [0x52c2b0]
cmp dword [eax], 2
je 0x4f55e9
mov byte [esp], 1
jmp 0x4f56be
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4f5627
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x4f5627
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x4f56be
mov eax, 0x400
call fcn.00402e98
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x4f56b7
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x52b31c
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x4f56ad
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4f56a9
mov byte [esp], 1
jmp 0x4f56ad
inc edi
dec ebx
jne 0x4f5690
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402ec8
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4f57c8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f5854
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f5837
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004f5760
mov eax, dword [ebp - 0xc]
call fcn.00405958
push eax
call sub.kernel32.dll_GetFileAttributesA
test eax, eax
jns 0x4f581d
call fcn.00404574
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f583e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x510b88
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403ba0
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x5223e8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x522501
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x14]
mov eax, dword [0x52bf8c]
mov eax, dword [eax]
call fcn.0046ca44
mov eax, dword [ebp - 0x14]
call fcn.00405958
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x5224eb
push 2
push 0
push 0xfffffffffffffff6
push esi
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0xf]
xor ecx, ecx
mov edx, 0xb
call fcn.00403ba0
push 0
lea eax, [ebp - 4]
push eax
push 0xa
lea eax, [ebp - 0xf]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
mov edx, 0x522510
lea eax, [ebp - 0xf]
call fcn.0040d154
test eax, eax
jne 0x5224a0
push 2
push 0
push 0xfffffffffffffff2
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x5542dc
push esi
call sub.kernel32.dll_ReadFile_1
mov bl, 1
jmp 0x5224e5
mov edx, 0x52251c
lea eax, [ebp - 0xf]
call fcn.0040d154
test eax, eax
jne 0x5224e5
push 2
push 0
push 0xfffffffffffffff2
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x5542dc
push esi
call sub.kernel32.dll_ReadFile_1
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
sub eax, dword [0x5542dc]
mov dword [0x5542dc], eax
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522508
lea eax, [ebp - 0x14]
call fcn.00405488
ret
Function at 0x5008206d
Capabilities:
Terminate process

Disassembly:
jmp 0x500bc7a5
push 0x17
call dword [sym.imp.kernel32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x500bc7b6
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.50081429
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
pop esi
ret

Function at 0x50082b53
Capabilities:
Hide graphical window

Disassembly:
jmp 0x5008bf00
push 0
push dword [0x50376b1c]
call dword [sym.imp.user32.dll_ShowWindow]
mov ecx, dword [0x50376704]
mov eax, dword [ecx]
call dword [eax + 0x30]
and dword [0x50376b18], 0xffffffef
ret

Function at 0x500830e9
Capabilities:
Query environment variable

Disassembly:
jmp 0x500c3df8
mov edi, edi
push esi
push edi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x500c3e0c
xor edi, edi
jmp 0x500c3e43
push ebx
push esi
call fcn.500c3d00
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.50082432
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x500c3e33
push ebx
push esi
push edi
call fcn.500831f7
add esp, 0xc
push 0
call fcn.500814ec
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x503e42ae
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x503e42cb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x503e42bc
add dl, dl
jne 0x503e42d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x503e4322
xor eax, eax
add dl, dl
jne 0x503e42e3
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x503e43bf
add dl, dl
jne 0x503e42f2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x503e42fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x503e4308
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x503e4313
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x503e431d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x503e42c2
mov eax, 1
add dl, dl
jne 0x503e4330
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x503e433b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x503e4327
sub eax, 2
jne 0x503e436a
mov ecx, 1
add dl, dl
jne 0x503e4350
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x503e435b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x503e4347
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x503e42c2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x503e4381
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x503e438c
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x503e4378
cmp eax, 0x7d00
jae 0x503e43af
cmp eax, 0x500
jb 0x503e43aa
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x503e42c2
cmp eax, 0x7f
ja 0x503e43b2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x503e42c2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x503e43db
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x503e42c2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8

Function at 0x5040c8a0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x5043603c], 0x8088405
inc edx
mov dword [0x5043603c], edx
mul edx
mov eax, edx
ret

Function at 0x50413d80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov ebp, edx
mov dword [esp], eax
xor ebx, ebx
mov esi, dword [esp]
lea edi, [esp + 4]
mov byte [esi], bl
mov eax, ebx
cdq
idiv ecx
add edx, ebp
mov al, byte [edx]
mov byte [edi], al
inc ebx
inc edi
inc esi
cmp ebx, 0x100
jne 0x50413d98
xor esi, esi
mov ebx, 0x100
mov eax, dword [esp]
lea edi, [esp + 4]
mov dl, byte [eax]
xor ecx, ecx
mov cl, dl
add esi, ecx
xor ecx, ecx
mov cl, byte [edi]
add esi, ecx
and esi, 0xff
mov ecx, dword [esp]
mov cl, byte [ecx + esi]
mov byte [eax], cl
mov ecx, dword [esp]
mov byte [ecx + esi], dl
inc edi
inc eax
dec ebx
jne 0x50413dbe
mov edx, dword [esp]
mov eax, dword [esp]
add eax, 0x100
mov ecx, 0x100
call fcn.5040fa90
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50413e18
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor ecx, ecx
xor edx, edx
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x50413ea9
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
inc ecx
and cl, 0xff
xor ebx, ebx
mov bl, cl
add dl, byte [eax + ebx]
and dl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov byte [ebp - 9], bl
mov esi, edx
and esi, 0xff
xor ebx, ebx
mov bl, cl
lea edi, [eax + ebx]
mov bl, byte [eax + esi]
mov byte [edi], bl
mov bl, byte [ebp - 9]
mov byte [eax + esi], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov esi, edx
and esi, 0xff
add bl, byte [eax + esi]
and bl, 0xff
mov byte [ebp - 9], bl
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
mov bl, byte [ebx + esi]
movzx esi, byte [ebp - 9]
xor bl, byte [eax + esi]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov byte [esi + edi], bl
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x50413e3e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5041b448
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x58], eax
xor edi, edi
mov dword [ebp - 0x10], 0x67452301
mov dword [ebp - 0xc], 0xefcdab89
mov dword [ebp - 8], 0x98badcfe
mov dword [ebp - 4], 0x10325476
mov eax, ebx
shl eax, 3
mov edx, eax
add edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x54]
jae 0x5041b491
inc dword [ebp - 0x58]
add dword [ebp - 0x54], eax
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x58], eax
mov esi, dword [ebp + 0xc]
cmp ebx, 0x40
jb 0x5041b4b9
mov edx, esi
lea eax, [ebp - 0x10]
call fcn.5041b558
add esi, 0x40
sub ebx, 0x40
cmp ebx, 0x40
jae 0x5041b4a4
test ebx, ebx
jbe 0x5041b4ce
mov edi, ebx
lea eax, [ebp - 0xa8]
mov ecx, edi
mov edx, esi
call fcn.5040fa90
push edi
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
lea edx, [ebp - 0xa8]
lea eax, [ebp - 0x50]
mov ecx, edi
call fcn.5040fa90
mov byte [ebp + edi - 0x50], 0x80
lea eax, [edi + 1]
cmp eax, 0x38
jbe 0x5041b517
mov edx, 0x40
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.5040faa4
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.5041b558
xor eax, eax
mov edx, 0x38
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.5040faa4
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.5041b558
mov eax, dword [ebp + 8]
mov edi, eax
lea esi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50425484
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
mov ebp, edi
mov dword [esp], 1
mov cl, 1
mov edx, edi
mov eax, esi
call fcn.5042291c
mov ebx, eax
mov byte [ebp + 0xb4], bl
xor eax, eax
mov al, bl
xor edx, edx
mov dl, byte [esi + 0x10]
add eax, edx
mov edx, eax
and edx, 0xf0
cmp edx, 0x90
jg 0x504254da
je 0x5042553a
sub edx, 1
jb 0x504254f0
sub edx, 0x2f
je 0x50425507
sub edx, 0x50
je 0x50425529
jmp 0x504256e1
sub edx, 0xa0
je 0x50425553
sub edx, 0x10
je 0x50425641
jmp 0x504256e1
cmp eax, 2
jae 0x504256e1
mov edx, edi
mov eax, esi
call fcn.50421538
jmp 0x504256e1
cmp eax, 0x31
jne 0x504256e1
mov eax, dword [ebp + 0x94]
xor edx, edx
mov dword [ebp + 0x28], eax
mov eax, dword [ebp + 0x90]
mov dword [ebp + 0x20], eax
jmp 0x504256e1
mov edx, edi
mov eax, esi
call fcn.50423590
mov dword [esp], eax
jmp 0x504256e1
mov edx, ebx
add dl, byte [esi + 0x10]
and dl, 0xf
mov ecx, edi
mov eax, esi
call fcn.504252dc
mov dword [esp], eax
jmp 0x504256e1
xor edx, edx
mov dl, byte [ebp + 0xb4]
xor eax, eax
mov al, byte [esi + 0x10]
add edx, eax
mov eax, edx
and eax, 7
cmp eax, 4
je 0x50425571
cmp eax, 5
jne 0x5042557f
mov edx, edi
mov eax, esi
call fcn.5042277c
jmp 0x504256e1
cmp edx, 0xaf
jne 0x504255e8
push edi
lea ecx, [ebp + 0xa2]
lea edx, [ebp + 0xa7]
mov eax, esi
call fcn.5042134c
lea edx, [ebp + 0xa2]
mov ecx, edi
mov eax, esi
call fcn.5042160c
mov ebx, eax
lea edx, [ebp + 0xa7]
mov ecx, edi
mov eax, esi
call fcn.5042160c
imul ebx, eax
push edi
lea edx, [ebp + 0xa7]
mov ecx, ebx
mov eax, esi
call fcn.50421698
mov eax, ebx
xor edx, edx
push edx
push eax
mov ecx, edi
mov dl, byte [ebp + 0xac]
mov eax, esi
call fcn.50421728
jmp 0x504256e1
cmp edx, 0xa2
jne 0x504256e1
mov eax, dword [ebp + 0x20]
sub eax, 1
jb 0x50425603
je 0x50425624
jmp 0x504256e1
mov dword [ebp + 0x20], 2
mov dword [ebp + 0x2c], 0x756e6547
mov dword [ebp + 0x24], 0x6c65746e
mov dword [ebp + 0x28], 0x49656e69
jmp 0x504256e1
mov dword [ebp + 0x20], 0xf10
mov dword [ebp + 0x2c], 0xb
xor eax, eax
mov dword [ebp + 0x24], eax
xor eax, eax
mov dword [ebp + 0x28], eax
jmp 0x504256e1
xor eax, eax
mov al, byte [ebp + 0xb4]
xor edx, edx
mov dl, byte [esi + 0x10]
add eax, edx
and eax, 7
cmp eax, 6
jne 0x50425664
mov dword [ebp + 0xac], 1
jmp 0x5042566e
mov dword [ebp + 0xac], 2
push edi
lea ecx, [ebp + 0xa2]
lea edx, [ebp + 0xa7]
mov eax, esi
call fcn.5042134c
lea edx, [ebp + 0xa2]
mov ecx, edi
mov eax, esi
call fcn.5042160c
mov ebx, eax
xor eax, eax
mov al, byte [ebp + 0xb4]
xor edx, edx
mov dl, byte [esi + 0x10]
add eax, edx
test al, 8
je 0x504256c7
cmp dword [ebp + 0xac], 1
jne 0x504256bc
mov edx, ebx
mov eax, esi
call fcn.50420d94
mov ebx, eax
jmp 0x504256c7
mov edx, ebx
mov eax, esi
call fcn.50420d90
mov ebx, eax
mov dword [ebp + 0xac], 4
push edi
lea edx, [ebp + 0xa7]
mov ecx, ebx
mov eax, esi
call fcn.50421698
mov eax, dword [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5042cb14
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ecx
push edx
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov ecx, dword [eax]
cmp ecx, eax
je 0x5042cb42
mov edx, ecx
mov ecx, dword [ecx]
cmp dword [edx + 8], 0
je 0x5042cb42
push dword [edx + 0x18]
call fcn.5042c998
jmp 0x5042cb2a
pop edi
pop esi
pop edx
pop ecx
ret
Function at 0x5043d651
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x5043d66e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5043d65f
add dl, dl
jne 0x5043d679
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5043d6c5
xor eax, eax
add dl, dl
jne 0x5043d686
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5043d762
add dl, dl
jne 0x5043d695
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x5043d6a0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x5043d6ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x5043d6b6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x5043d6c0
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x5043d665
mov eax, 1
add dl, dl
jne 0x5043d6d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x5043d6de
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5043d6ca
sub eax, 2
jne 0x5043d70d
mov ecx, 1
add dl, dl
jne 0x5043d6f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x5043d6fe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5043d6ea
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5043d665
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x5043d724
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x5043d72f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5043d71b
cmp eax, 0x7d00
jae 0x5043d752
cmp eax, 0x500
jb 0x5043d74d
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5043d665
cmp eax, 0x7f
ja 0x5043d755
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5043d665
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x5043d77e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5043d665
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8