joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027dd0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10027e08
push str.WMIInit__:_CoInitializeEx___failed
mov eax, dword [ebp - 0xc]
push eax
call main
add esp, 8
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10027e3a
push str.WMIInit__:_CoInitializeSecurity___failed
mov ecx, dword [ebp - 0xc]
push ecx
call main
add esp, 8
lea edx, [ebp - 8]
push edx
push 0x10046e1c
push 1
push 0
push 0x10046eec
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10027e71
push str.WMIInit__:_CoCreateInstance___failed
mov eax, dword [ebp - 0xc]
push eax
call main
add esp, 8
jmp 0x10027f39
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10027ebc
push str.WMIInit__:_ConnectServer___failed
mov edx, dword [ebp - 0xc]
push edx
call main
add esp, 8
jmp 0x10027f39
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10027ef0
push str.WMIInit__:_CoSetProxyBlanket___failed
mov ecx, dword [ebp - 0xc]
push ecx
call main
add esp, 8
jmp 0x10027f39
push 8
call fcn.10019ae0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10027f16
push str.WMIInit__:_mem_alloc___failed
mov edx, dword [ebp - 0xc]
push edx
call main
add esp, 8
jmp 0x10027f39
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
push str.WMIInit__:_ok.
call fcn.10018570
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x10027f63
cmp dword [ebp - 0x14], 0
je 0x10027f4d
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
cmp dword [ebp - 8], 0
je 0x10027f61
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100280d0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
push str.ROOTCIMV2
call fcn.10027dd0
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100280f7
xor eax, eax
jmp 0x10028165
lea eax, [ebp - 0x10]
push eax
push str.Caption
push str.SELECT__FROM_Win32_OperatingSystem
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
call fcn.10027fd0
add esp, 0x10
test eax, eax
je 0x10028156
mov eax, dword [ebp - 8]
push eax
call fcn.10018df0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1002814c
push 0x100342c4
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
mov edx, dword [ebp - 0x18]
push edx
push str.WMIGetOsVersion__:_OS_Caption:__S
call fcn.10018570
add esp, 8
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x14]
push ecx
call fcn.10027f70
add esp, 4
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x10028210
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
push str.ROOTCIMV2
call fcn.10027dd0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10028237
xor eax, eax
jmp 0x100282a5
lea eax, [ebp - 0x10]
push eax
push str.Name
push str.SELECT__FROM_Win32_Processor
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call fcn.10027fd0
add esp, 0x10
test eax, eax
je 0x10028296
mov eax, dword [ebp - 8]
push eax
call fcn.10018df0
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1002828c
push 0x100342c4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
mov edx, dword [ebp - 0x14]
push edx
push str.WMIGetCpuName__:_CPU_Name:__S
call fcn.10018570
add esp, 8
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x18]
push ecx
call fcn.10027f70
add esp, 4
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x1002ac40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
lea edi, [eax + ecx - 0x21524111]
mov ecx, dword [ebp + 8]
mov esi, edi
mov ebx, edi
cmp eax, 0xc
jbe switch.0x1002ad35
lea edx, [eax - 0xd]
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
inc edx
mov dword [ebp + 8], edx
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, esi
shl eax, 8
add edx, eax
movzx eax, byte [ecx + 0xb]
movzx esi, byte [ecx + 3]
shl eax, 8
mov dword [ebp - 4], edx
movzx edx, byte [ecx + 0xa]
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, edi
movzx edi, byte [ecx + 2]
shl esi, 8
add esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
add esi, edi
movzx edi, byte [ecx]
shl esi, 8
add esi, edi
mov edi, dword [ebp - 4]
shl eax, 8
add edx, eax
sub esi, edx
add esi, ebx
mov eax, edx
rol eax, 4
xor eax, esi
add edx, edi
sub edi, eax
mov esi, eax
rol esi, 6
xor esi, edi
sub dword [ebp + 0xc], 0xc
add eax, edx
sub edx, esi
mov edi, esi
rol edi, 8
xor edi, edx
add esi, eax
sub eax, edi
mov ebx, edi
rol ebx, 0x10
xor ebx, eax
add edi, esi
sub esi, ebx
mov eax, ebx
ror eax, 0xd
xor esi, eax
add ebx, edi
mov edx, esi
sub edi, esi
rol edx, 4
xor edi, edx
add esi, ebx
add ecx, 0xc
dec dword [ebp + 8]
jne 0x1002ac72
cmp dword [ebp + 0xc], 0xc
ja case.default.0x1002ad35
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x1002adf4]
movzx eax, byte [ecx + 0xb]
shl eax, 0x18
add edi, eax
movzx edx, byte [ecx + 0xa]
shl edx, 0x10
add edi, edx
movzx eax, byte [ecx + 9]
shl eax, 8
add edi, eax
movzx edx, byte [ecx + 8]
add edi, edx
movzx eax, byte [ecx + 7]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 6]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 5]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 4]
add esi, edx
movzx eax, byte [ecx + 3]
shl eax, 0x18
add ebx, eax
movzx edx, byte [ecx + 2]
shl edx, 0x10
add ebx, edx
movzx eax, byte [ecx + 1]
shl eax, 8
add ebx, eax
movzx ecx, byte [ecx]
add ebx, ecx
xor edi, esi
mov edx, esi
rol edx, 0xe
sub edi, edx
mov eax, edi
rol eax, 0xb
mov ecx, edi
xor ecx, ebx
sub ecx, eax
xor esi, ecx
mov edx, ecx
ror edx, 7
sub esi, edx
xor edi, esi
mov eax, esi
rol eax, 0x10
sub edi, eax
mov eax, edi
rol edi, 4
mov edx, eax
xor edx, ecx
sub edx, edi
mov ecx, edx
xor esi, edx
rol ecx, 0xe
sub esi, ecx
mov edx, esi
pop edi
xor eax, esi
ror edx, 8
pop esi
sub eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002fec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x1002fee5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x1002fefd
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x1002ff2c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x1002ff6e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x10030042
sub edx, 0x10000
js 0x10030042
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x1002ff54
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x1002ff54
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x1002ffc5
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x1002ffc2
add edx, 8
jne 0x1002ffa9
jmp 0x10030033
add edx, 4
test eax, 0xffff
jne 0x1002ffd2
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x10030033
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x10030006
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x1002ff54
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x10030042
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x1002ff54
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x10030053
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4758599c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0xce318d9
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4fa000
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa5000]
push edi
jmp 0x4fa01a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fa021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fa010
mov eax, 1
add ebx, ebx
jne 0x4fa033
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fa044
jne 0x4fa063
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fa063
dec eax
add ebx, ebx
jne 0x4fa050
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fa028
add ebx, ebx
jne 0x4fa05f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fa0b5
xor ecx, ecx
sub eax, 3
jb 0x4fa07b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fa0ea
sar eax, 1
mov ebp, eax
jmp 0x4fa086
add ebx, ebx
jne 0x4fa086
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fa054
inc ecx
add ebx, ebx
jne 0x4fa094
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fa054
add ebx, ebx
jne 0x4fa0a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fa096
jne 0x4fa0b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fa096
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fa0d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fa0c6
jmp 0x4fa016
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fa0d4
add edi, ecx
jmp 0x4fa016
pop esi
mov edi, esi
mov ecx, 0x3eef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fa0f2
cmp byte [edi], 0x11
jne 0x4fa0f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fa0f7
lea edi, [esi + 0xf3000]
mov eax, dword [edi]
or eax, eax
je 0x4fa16f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11ca2c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11cba8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fa124
mov ecx, edi
jns 0x4fa153
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11cbac]
or eax, eax
je 0x4fa169
mov dword [ebx], eax
add ebx, 4
jmp 0x4fa141
call dword [esi + 0x11cbbc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4fa1a0
cmp al, 0xef
ja 0x4fa193
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4fa175
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4fa182
mov ebp, dword [esi + 0x11cbb0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fa1d4
sub esp, 0xffffff80
jmp 0x426bf7
Function at 0xad8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xad81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xad807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xad806a
add dl, dl
jne 0xad8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xad80dc
xor eax, eax
add dl, dl
jne 0xad8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xad817d
add dl, dl
jne 0xad80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xad80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xad8075
mov eax, 1
add dl, dl
jne 0xad80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xad80e1
sub eax, ebx
mov ebx, 1
jne 0xad8128
mov ecx, 1
add dl, dl
jne 0xad810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xad8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xad8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xad8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xad813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xad814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xad8136
cmp eax, 0x7d00
jae 0xad816d
cmp eax, 0x500
jb 0xad8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xad8075
cmp eax, 0x7f
ja 0xad8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xad8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xad819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xad8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x43b63d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
or esi, edi
mov edi, edi
mov esi, esi
call fcn.0043b67f
or esi, edi
sub esi, 0xebfcf748
xor dword [ebx], eax
sub edi, 1
push 0xfa49ab14
pop edi
and edi, esi
inc ebx
or esi, edi
sub edi, esi
cmp ebx, edx
jne fcn.0043b63d
sub edi, 0xecfb9cf8
dec esi
ret
Function at 0x413000
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push ebx
push esi
push edi
mov ebx, edx
mov ecx, dword [esp + 0x10]
lea edi, [0x41a0c0]
or ebx, ecx
mov esi, edx
test ebx, 3
mov ebx, dword [edi]
jne 0x413080
add edx, ecx
shr ecx, 2
neg ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, dword [edx + ecx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
inc ecx
jne 0x413040
pop edi
pop esi
pop ebx
ret 4
and esi, 3
je 0x41309d
mov bl, al
shr eax, 8
xor bl, byte [edx]
inc edx
xor eax, dword [ebx*4 + 0x41a0c0]
dec edi
je 0x4130e3
dec esi
jne 0x413088
mov esi, ecx
shr ecx, 2
je 0x4130cd
xor eax, dword [edx]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4130a4
and esi, 3
je 0x4130e3
mov bl, al
shr eax, 8
xor bl, byte [edx]
inc edx
xor eax, dword [edi + ebx*4]
dec esi
jne 0x4130d5
pop edi
pop esi
pop ebx
ret 4

Function at 0x413100
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x403028
push 0x403024
push 0x403020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x403028]
push dword [0x403024]
push dword [0x403020]
mov dword [0x403014], esp
call fcn.004016f4
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
mov dword [ebp - 0x44], 0x1003
lea edi, [0x4013c9]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x34], edi
push str.lgicon
push dword [ebp + 8]
call sub.USER32.DLL_LoadIconA
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call sub.USER32.DLL_LoadCursorA
mov dword [ebp - 0x2c], eax
push 0
call sub.GDI32.DLL_GetStockObject
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
lea edi, str.blankclass
mov dword [ebp - 0x20], edi
lea edi, [ebp - 0x44]
push edi
call sub.USER32.DLL_RegisterClassA
push str.splash
push dword [ebp + 8]
call sub.USER32.DLL_LoadBitmapA
mov dword [section..bss], eax
push 0
call sub.USER32.DLL_GetSystemMetrics
mov edi, eax
push 1
call sub.USER32.DLL_GetSystemMetrics
mov esi, eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0x1c2
push 0x258
mov ecx, 2
cdq
idiv ecx
mov esi, eax
sub esi, 0xe1
push esi
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub edi, 0x12c
push edi
push 0x80080000
push str.Balancer_Setup
push str.blankclass
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [0x402010], eax
push 1
push dword [0x402010]
call main
push dword [0x402010]
call sub.USER32.DLL_UpdateWindow
jmp 0x4013ac
lea edi, [ebp - 0x1c]
push edi
call sub.USER32.DLL_TranslateMessage
lea edi, [ebp - 0x1c]
push edi
call sub.USER32.DLL_DispatchMessageA
push 0
push 0
push 0
lea edi, [ebp - 0x1c]
push edi
call sub.USER32.DLL_GetMessageA
cmp eax, 0
jne 0x40139a
mov eax, dword [ebp - 0x14]
pop edi
pop esi
leave
ret 0x10

Function at 0x4016f4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x401728
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x401743
mov edi, eax
inc edi
jmp 0x401720
inc edi
cmp byte [edi], 0x20
je 0x40171f
jmp 0x401743
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x401734
cmp eax, 0x20
jne 0x401727
jmp 0x401737
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x401743
cmp eax, 0x20
je 0x401736
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.0040129c
pop edi
leave
ret