joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10093418
Capabilities:
Get keyboard layout

Disassembly:
push 0x1c
mov eax, 0x100b7a31
call fcn.100b4d71
xor edi, edi
mov dword [ebp - 4], edi
call fcn.100b022b
call fcn.10045e50
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push edi
call esi
mov ebx, eax
cmp ebx, edi
jl 0x100935cc
cmp ebx, 0xffffffff
ja 0x100935cc
cmp ebx, edi
je 0x10093460
cmp ebx, 0x3fffffff
ja 0x100935cc
mov edi, ebx
shl edi, 2
push edi
call fcn.10045e50
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
je 0x100934aa
push eax
push ebx
call esi
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
cmp ebx, esi
je 0x10093492
cmp ebx, 0x3fffffff
ja 0x100935b2
push edi
call fcn.10045e50
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x100934b4
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
xor eax, eax
call fcn.100b4e16
ret 8
cmp dword [ebp - 0x24], ebx
jge 0x1009350a
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + ecx*4]
push eax
call sub.java.dll_getJavaIDFromLangID
mov edi, eax
pop ecx
test edi, edi
je 0x10093502
xor esi, esi
cmp esi, dword [ebp - 0x20]
jge 0x100934f4
mov eax, dword [ebp - 0x1c]
push edi
push dword [eax + esi*4]
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10093507
push edi
call dword [sym.imp.MSVCR100.dll_free]
cmp esi, dword [ebp - 0x20]
pop ecx
jne 0x10093502
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x18]
inc dword [ebp - 0x20]
mov dword [eax + esi*4], edi
inc dword [ebp - 0x24]
jmp 0x100934b4
inc esi
jmp 0x100934d2
mov esi, dword [ebp + 8]
mov eax, dword [esi]
and dword [ebp - 0x20], 0
push str.java_util_Locale
push esi
call dword [eax + 0x18]
xor edi, edi
mov dword [ebp + 8], eax
cmp eax, edi
je 0x10093572
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x18]
push esi
call dword [ecx + 0x2b0]
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x10093569
cmp edi, dword [ebp - 0x18]
jge 0x10093569
mov eax, dword [ebp - 0x1c]
push dword [eax + edi*4]
push esi
call fcn.1009310c
pop ecx
pop ecx
mov ebx, eax
mov eax, dword [esi]
push esi
call dword [eax + 0x390]
test al, al
mov eax, dword [esi]
je 0x10093589
push dword [ebp - 0x20]
push esi
call dword [eax + 0x5c]
and dword [ebp - 0x20], 0
push dword [ebp + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x5c]
xor esi, esi
cmp esi, dword [ebp - 0x18]
jge 0x10093598
mov eax, dword [ebp - 0x1c]
push dword [eax + esi*4]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
inc esi
jmp 0x10093574
push ebx
push edi
push dword [ebp - 0x20]
push esi
call dword [eax + 0x2b8]
inc edi
jmp 0x1009353a
push dword [ebp - 0x28]
mov esi, dword [sym.imp.MSVCR100.dll_free]
call esi
push dword [ebp - 0x1c]
call esi
mov eax, dword [ebp - 0x20]
pop ecx
pop ecx
jmp 0x100934ac
xor eax, eax
lea edi, [ebp + 0xb]
stosb byte es:[edi], al
mov al, byte [ebp + 0xb]
mov byte [ebp - 0x11], al
push 0x100da640
lea eax, [ebp - 0x11]
push eax
call sub.MSVCR100.dll__CxxThrowException
xor eax, eax
lea edi, [ebp + 0xb]
stosb byte es:[edi], al
mov al, byte [ebp + 0xb]
mov byte [ebp - 0x12], al
push 0x100da640
lea eax, [ebp - 0x12]
jmp 0x100935c6
Function at 0x10098ab6
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x100fd640]
xor eax, ebp
mov dword [ebp + 0x388], eax
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc08]
push edi
call fcn.100a9f93
mov edi, eax
test edi, edi
je 0x10098c87
push ebx
push 0xc
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [esi + 0xc08]
push edi
mov ebx, eax
call fcn.100a9f9d
cmp ebx, 8
jne 0x10098b53
mov ecx, dword [esi + 0xc08]
call fcn.100a9f93
mov ebx, eax
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.1009892f
pop ecx
pop ecx
mov ecx, dword [esi + 0xc08]
push ebx
mov edi, eax
call fcn.100a9f9d
cmp edi, dword [esi + 0xc00]
jne 0x10098b5a
mov eax, edi
shl eax, 2
push eax
lea eax, [esi + 0x800]
push eax
lea eax, [ebp - 0x78]
push eax
call sub.MSVCR100.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10098b5a
xor eax, eax
jmp 0x10098c86
mov eax, 0x100
cmp edi, eax
jle 0x10098b65
mov edi, eax
mov eax, edi
shl eax, 2
push eax
lea eax, [ebp - 0x78]
push eax
lea ebx, [esi + 0x800]
push ebx
call sub.MSVCR100.dll_memcpy
and dword [ebp - 0x80], 0
add esp, 0xc
lea eax, [edi - 1]
push ebx
mov ecx, esi
mov dword [esi + 0xc00], edi
mov dword [ebp - 0x7c], eax
call fcn.10045e50
cmp eax, 1
jne 0x10098b9f
push 2
jmp 0x10098be2
cmp eax, 2
jne 0x10098ba8
push 3
jmp 0x10098be2
push str.FORCEGRAY
call dword [sym.imp.MSVCR100.dll_getenv]
pop ecx
test eax, eax
je 0x10098be0
push 0xa
pop edx
lea eax, [esi + 0x7d8]
mov ecx, edx
and dword [eax - 0x3d8], 0
and dword [eax], 0
add eax, 4
dec ecx
jne 0x10098bc3
sub edi, 0x14
sub dword [ebp - 0x7c], edx
mov dword [ebp - 0x80], edx
push 1
jmp 0x10098be2
push 0
mov ecx, dword [esi + 0xc08]
call fcn.100aa544
mov ecx, dword [ebp - 0x80]
cmp ecx, dword [ebp - 0x7c]
jg 0x10098c26
lea eax, [esi + ecx*4 + 0x400]
movzx edx, byte [ebp + ecx*4 - 0x78]
movzx ebx, byte [ebp + ecx*4 - 0x77]
or edx, 0xffffff00
shl edx, 8
or edx, ebx
movzx ebx, byte [ebp + ecx*4 - 0x76]
shl edx, 8
or edx, ebx
mov dword [eax], edx
inc ecx
add eax, 4
cmp ecx, dword [ebp - 0x7c]
jle 0x10098bfc
push 0x20
lea ebx, [esi + 0x400]
push edi
push ebx
call fcn.10045e50
mov dword [esi + 0xc0c], eax
mov eax, dword [esi + 0xc08]
mov edi, dword [eax + 8]
mov eax, dword [eax]
mov eax, dword [eax]
add esp, 0xc
cmp eax, 3
je 0x10098c55
cmp eax, 1
jne 0x10098c83
test edi, edi
je 0x10098c83
mov eax, dword [edi + 0x10]
test eax, eax
je 0x10098c6c
push eax
call dword [sym.imp.MSVCR100.dll_free]
and dword [edi + 0x10], 0
pop ecx
mov eax, dword [esi + 0xc08]
push dword [eax + 8]
push 0x100
push ebx
call fcn.10045e50
add esp, 0xc
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp + 0x388]
pop edi
xor ecx, ebp
pop esi
call fcn.100b4c22
add ebp, 0x38c
leave
ret
Function at 0x100a5c50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x100fd640]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
call fcn.100b022b
call fcn.10045e50
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
push eax
push eax
push str.0x_x___ld
lea eax, [ebp - 0x114]
push 0x80
push eax
call fcn.100a3e5f
add esp, 0x14
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.kernel32.dll_lstrlenW]
mov edi, eax
call esi
cmp al, 5
jb 0x100a5d17
call esi
cmp al, 5
jb 0x100a5cdc
call esi
shr eax, 8
cmp al, 1
jae 0x100a5ce2
call esi
cmp al, 5
jbe 0x100a5d03
call esi
cmp al, 6
jb 0x100a5cef
push str.__Windows_Vista_
jmp 0x100a5d1c
push str.__Windows_XP_
push 0x80
lea eax, [ebp + edi*2 - 0x114]
push eax
jmp 0x100a5d29
push str.__Windows_2000_
push 0x80
lea ecx, [ebp + edi*2 - 0x114]
push ecx
jmp 0x100a5d29
push str.__Unknown_
push 0x80
lea edx, [ebp + edi*2 - 0x114]
push edx
call fcn.100a3e5f
lea eax, [ebp - 0x114]
add esp, 0xc
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
mov ecx, dword [ebx]
add esp, 4
push eax
mov eax, dword [ecx + 0x28c]
lea edx, [ebp - 0x114]
push edx
push ebx
call eax
jmp 0x100a5d63
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b4c22
mov esp, ebp
pop ebp
ret 8
Function at 0x100ab4e3
Capabilities:
Check os version

Disassembly:
push 0xc
mov eax, 0x100b92f3
call fcn.100b4d71
mov eax, dword [0x100fd620]
cmp eax, 0xfffffffe
jne 0x100ab568
call dword [sym.imp.kernel32.dll_GetVersion]
cmp al, 6
jae 0x100ab50e
and dword [0x100fd620], 0
xor eax, eax
jmp 0x100ab568
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
call fcn.10045e50
pop ecx
cmp eax, ebx
jl 0x100ab532
mov ebx, dword [ebp - 0x14]
jmp 0x100ab532
push 0x10002
push dword [0x101004d4]
mov dword [0x100fd620], ebx
call sub.java.dll__JNU_GetEnv_8
movzx ecx, bl
push ecx
push str._Z_V
push str.dwmCompositionChanged
push str.sun_awt_Win32GraphicsEnvironment
push 0
push eax
call sub.java.dll_JNU_CallStaticMethodByName
add esp, 0x18
mov eax, ebx
call fcn.100b4e16
ret
Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e016479
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e016479
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret

Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e016479
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e016479
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e016479
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e016479
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e016479
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e016479
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8

Function at 0x2e016479
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x2e016488
pop dword [ebp - 0x10]
mov eax, 0x4a77bbdf
sub eax, 0x1c765757
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x87b41b56
add dword [ebp - 0x20], 0xc69e29f5
mov dword [ebp - 0x1c], 0x7665d566
sub dword [ebp - 0x1c], 0x44328921
mov dword [ebp - 0x18], 0x753b1c6c
add dword [ebp - 0x18], 0xd71127c2
mov dword [ebp - 0x14], 0x93c2e7d7
sub dword [ebp - 0x14], 0x93c2e7d7
lea eax, [ebp - 0x20]
push eax
mov eax, 0x60e6908a
sub eax, 0x32e36fc2
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x8a0342d1
add dword [ebp - 0x20], 0xea6f2685
mov dword [ebp - 0x1c], 0xdb4b8e3d
sub dword [ebp - 0x1c], 0x99df2cc8
mov dword [ebp - 0x18], 0x3595b1df
sub dword [ebp - 0x18], 0xd2264573
mov dword [ebp - 0x14], 0xc884370c
add dword [ebp - 0x14], 0x377bc8f4
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x8ad3da6c
add eax, 0xa32f4650
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x44bef
push 0
call eax
mov ecx, 0x7675a3de
add ecx, 0x898ab34b
mov edi, eax
mov edx, 0x414a8abe
add edx, 0xecbae342
add edx, dword [ebp - 0x10]
mov esi, 0x6ed050a5
sub esi, 0x17223953
xor dword [ebp - 8], edx
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0xad181d43
xor ebx, esi
mov dword [ebp - 4], 0x2d6f012a
mov dword [edi], ebx
add dword [ebp - 4], eax
add edi, 4
add edx, 4
loop 0x2e0165aa
add eax, 0x4739824f
add eax, 0xb8c7cd28
xor ebx, ebx
add ebx, eax
add eax, 0xd519ffc7
add eax, 0x2ae6003e
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x2e01e341
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030586
call fcn.2e02e16c
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e45f
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e456
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e016479
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e449
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010c49
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e016479
test al, al
jne 0x2e01e3fc
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e016479
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e3ff
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e439
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e430
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e016479
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e016479
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e016479
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e14a
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10002570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100025d1
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002592
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18

Function at 0x1000f7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000f7ff
pop dword [ebp - 0x10]
mov eax, 0x1000f7ff
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xfb3d7764
add dword [ebp - 0x20], 0x5314cde7
mov dword [ebp - 0x1c], 0x19f976b3
sub dword [ebp - 0x1c], 0xe7c62a6e
mov dword [ebp - 0x18], 0x12271e85
add dword [ebp - 0x18], 0x3a2525a9
mov dword [ebp - 0x14], 0xd7710d2d
add dword [ebp - 0x14], 0x288ef2d3
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x19bceb70
sub dword [ebp - 0x20], 0xa54a821a
mov dword [ebp - 0x1c], 0xd6386d45
add dword [ebp - 0x1c], 0x6b33f430
mov dword [ebp - 0x18], 0xf08826d0
add dword [ebp - 0x18], 0x72e7459c
mov dword [ebp - 0x14], 0xbfac4b4e
add dword [ebp - 0x14], 0x4053b4b2
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x3dd5e423
add eax, 0xd22bcbf1
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3c683
push 0
call eax
mov ecx, 0x62a55e7d
sub ecx, 0x62a51dd6
xor esi, esi
add esi, eax
mov edi, 0xd9f8560a
add edi, 0x360a59f6
add edi, dword [ebp - 0x10]
mov edx, 0xfcacf828
sub edx, 0xc471c5f5
add dword [ebp - 4], ecx
mov ebx, dword [edi]
xor dword [ebp - 8], edx
xor ebx, edx
add dword [ebp - 0xc], ebx
mov dword [esi], ebx
add dword [ebp - 4], ebx
add esi, 0x9a38462
add esi, 0xf65c7ba2
add edi, 4
loop 0x1000f919
add eax, 0xed5450b6
add eax, 0x12aca4b9
mov ebx, eax
add eax, 0x81e2900b
add eax, 0x7e1d6ffa
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x25814700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x2581470f
pop dword [ebp - 0x20]
mov eax, 0xcfb6f6d6
add eax, 0x55ca5039
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x8b08b779
add dword [ebp - 0x30], 0xc3498dd2
mov dword [ebp - 0x2c], 0xa37f393b
add dword [ebp - 0x2c], 0x8eb4130a
mov dword [ebp - 0x28], 0x884239f2
add dword [ebp - 0x28], 0xc40a0a3c
mov dword [ebp - 0x24], 0x5c9086f5
add dword [ebp - 0x24], 0xa36f790b
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xb5faa250
sub dword [ebp - 0x30], 0x418838fa
mov dword [ebp - 0x2c], 0xf64da9d6
add dword [ebp - 0x2c], 0x4b1eb79f
mov dword [ebp - 0x28], 0xc2c883d0
add dword [ebp - 0x28], 0xa0a6e89c
mov dword [ebp - 0x24], 0x96da7678
sub dword [ebp - 0x24], 0x96da7678
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xec66650b
add eax, 0x391b6b75
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3bf11
push 0
call eax
mov ecx, 0x8034bbba
sub ecx, 0x8034761d
xor edi, edi
add edi, eax
mov ebx, 0xaae7ae0c
sub ebx, 0x8565180c
add ebx, dword [ebp - 0x20]
mov edx, 0x56aa9da9
add edx, 0x917b71e8
xor dword [ebp - 4], 0xa9732470
mov esi, dword [ebx]
xor dword [ebp - 0x18], eax
add esi, edx
xor dword [ebp - 8], 0xbcedaafe
mov dword [edi], esi
mov dword [ebp - 8], 0xaeec0b71
add edi, 0x5f0995cc
sub edi, 0x5f0995c8
add ebx, 0x746fe33c
sub ebx, 0x746fe338
loop 0x2581482e
add eax, 0x10947
xor ebx, ebx
add ebx, eax
add eax, 0x90105d54
sub eax, 0x90105d4f
mov ecx, 0xc69c8927
sub ecx, 0xa11c8927
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0xdd4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00dd41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xdd407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd406a
add dl, dl
jne 0xdd4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd40dc
xor eax, eax
add dl, dl
jne 0xdd4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd417d
add dl, dl
jne 0xdd40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdd40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdd4075
mov eax, 1
add dl, dl
jne 0xdd40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd40e1
sub eax, ebx
mov ebx, 1
jne 0xdd4128
mov ecx, 1
add dl, dl
jne 0xdd410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdd4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdd413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdd414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd4136
cmp eax, 0x7d00
jae 0xdd416d
cmp eax, 0x500
jb 0xdd4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd4075
cmp eax, 0x7f
ja 0xdd4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdd419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdd4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x45f470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x1cc
mov dword [esp], esp
mov dword [esp + 4], 0x1cc
call fcn.0045ee40
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.0045ee40
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb80
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret