joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446190
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.DLL_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x446323
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x44630d
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4461df
lea ebx, [eax + 0xe]
jmp 0x4461eb
cmp eax, 0x17
jne 0x44629a
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x44629a
mov eax, dword [edi + 0x10]
test eax, eax
je 0x44629a
cmp eax, ebx
jb 0x44629a
push 0x20
call dword [0xa17424]
mov esi, eax
add esp, 4
test esi, esi
je 0x446302
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0xa17424]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4462f1
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x446285
push eax
call dword [0xa17430]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4462d7
test ebp, ebp
jne 0x44628b
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x446296
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4461d2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4462b9
push eax
call dword [sym.imp.WS2_32.DLL_freeaddrinfo]
test ebx, ebx
je 0x446309
push ebp
call fcn.00446150
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0xa17428]
push esi
call dword [0xa17428]
add esp, 8
jmp 0x4462a9
push esi
mov ebx, 8
call dword [0xa17428]
add esp, 4
jmp 0x4462a9
mov ebx, 8
jmp 0x4462a9
test ebp, ebp
jne 0x446319
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WSOCK32.DLL_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x446770
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x264], 2
je fcn.00446720
mov al, 1
ret
Function at 0x44c1cb
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov esi, 0xa197b4
cmp dword [0xa197b0], edi
jne 0x44c1fa
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0xa197b0], 1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0xa197ac]
test esi, esi
je 0x44c255
test edi, edi
jne 0x44c39c
xor eax, eax
lea ecx, [esi + 0x114]
inc eax
cmp ebx, dword [ecx]
je 0x44c22b
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x44c21c
jmp 0x44c247
push dword [esp + 0x1c]
add eax, 0x84
push dword [esp + 0x1c]
lea eax, [esi + eax*4]
push eax
call fcn.0044c174
xor edi, edi
add esp, 0xc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x44c20b
test edi, edi
jne 0x44c39c
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push ebp
push ebp
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x44c39c
mov esi, dword [0xa197ac]
jmp 0x44c296
cmp dword [esi + 0xc], 0x3f
jl 0x44c337
mov esi, dword [esi]
test esi, esi
jne 0x44c28a
push 0x310
push 8
push dword [0xa18ed0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x44c396
push ebp
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 8], eax
test eax, eax
je 0x44c388
push ebp
push ebp
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x44c3af
mov dword [esi + 0x114], ebx
lea ebx, [esi + 0x214]
push 0x1000
mov dword [esi + 0x14], eax
mov dword [ebx], ebp
push ebp
mov dword [esi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x44c383
push eax
call edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call fcn.0044c174
mov eax, dword [0xa197ac]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi], eax
test eax, eax
je 0x44c32f
mov dword [eax + 4], esi
mov dword [0xa197ac], esi
jmp 0x44c39c
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov dword [esi + ecx*4 + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x110], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x210], ebp
mov eax, dword [esi + 0xc]
add eax, 0x84
lea eax, [esi + eax*4]
push eax
call fcn.0044c174
add esp, 0xc
inc dword [esi + 0xc]
push ebp
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x44c39c
push dword [esi + 8]
call edi
push esi
push ebp
push dword [0xa18ed0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call edi
push 0xa197b4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x420086
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 2
jne 0x4200b8
movzx ecx, word [ebp + 8]
sar ecx, 8
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041ff86
movzx edx, byte [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041ff86
jmp 0x420187
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 1
jne 0x4200e3
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041ff86
movzx edx, word [ebp + 8]
sar edx, 8
push edx
mov ecx, dword [ebp - 4]
call fcn.0041ff86
jmp 0x420187
movzx eax, word [ebp + 8]
cmp eax, 0x7f
jg 0x4200fe
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041ff86
jmp 0x420187
movzx edx, word [ebp + 8]
cmp edx, 0x7ff
jg 0x420137
movzx eax, word [ebp + 8]
sar eax, 6
or eax, 0xc0
push eax
mov ecx, dword [ebp - 4]
call fcn.0041ff86
movzx ecx, word [ebp + 8]
and ecx, 0x3f
or ecx, 0x80
push ecx
mov ecx, dword [ebp - 4]
mov bh, 0x4d
or byte [ebx - 0x367ec01f], al
add byte [eax], 0
add byte [ecx - 0x75], dl
dec ebp
cld
sub byte [ecx], dh
pop es
and al, 0xc6
fisttp word [ebp + ebp*2 + 0x6b817c9]
push cs
add al, dl
insd dword es:[edi], dx
leave
pop ss
mov eax, 0xc2020e06
inc esp
dec edx
salc
jbe 0x420120
inc esp
ljmp 0xe216
pop esp
adc eax, 0xacb388f6
fimul dword [eax - 0x25d58510]
pushfd
cmc
adc cl, byte [ebx]
or ebx, dword [edx - 0x6b]

Function at 0x420626
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
arpl word [edx], ax
shl byte [edx], 1
inc edi
ror dword [eax + 0x48cb2a82], 0x37
fdiv qword [edi]
inc ebp
popal
xor edx, dword [ebx]
mov esp, 0x8852cbf9
imul ebp, ebp, 0xff32f010
rcr dword [ebx], 1
lcall 0xf228, 0x93210dd8
adc ecx, 0xffffffc4
dec edx
out 0x78, eax
sub byte [edx], ah
leave
adc eax, 0x7fc0402b
in al, 0x46
pushfd
push ebx
test eax, 0x60e1da97
or byte [ecx], bh
sahf
add ebx, 0xffffffd0
nop
adc cl, byte [edx + ecx*4]
js 0x420632
pop edx
sbb bh, byte [ecx + ebx - 0x2d73e41d]
ret 0x664f
Function at 0x437ad6
Capabilities:
Encode data using xor

Disassembly:
and dl, 0x1e
mov eax, 0xc813e47b
pop edx
or esi, dword [ecx]
xor al, 0x32
pop ss
add edi, ebp
and ecx, dword [eax]
pop ss
arpl word [ebx + 0x76], di
mov edi, 0xd37989b3
push esi
adc dword [edi], ecx
sub edi, dword [esi - 0x19e97315]
mov eax, dword [0x88546e12]
jns 0x437a96
mov esi, 0xb708c014
lahf
adc byte [ebx + 0x49], ah
bound ebx, qword [edx + 0x5ee7e132]
dec ecx
fmul qword [ebx - 0x5c]
cmpsb byte [esi], byte es:[edi]
pop ss
mov bh, 0x76
mov ah, 0x87
add byte [ebp - 5], ah
xor byte [edi - 0x52f3a392], ch
out 0x40, al
das
add dword [esi], 0x7f
xor esp, dword [ebx - 0x5c016e57]
xchg byte [eax + 0x13], bl
pop ss
salc
loopne 0x437aad
invalid
and cl, bl
mov esp, 0xad3e05c9
cmp eax, 0xffffff8c
dec eax
out dx, eax
jbe 0x437a6b
mov ah, 0xa3
mov byte [0xb653a40b], al
pop ss
jp 0x437ae4
pop ss
in eax, dx
push ebx
adc edi, dword [esi + 0x3e]
jmp 0x437b2b
or al, 0x3e
push ebx
pop ecx
iretd
adc byte [ebp - 0x1a56ebd3], bh
add eax, 0x664314fe
in eax, 0x33
inc dx
sub byte [ebp*8 + 0x4e0a2f07], dl
lodsd eax, dword [esi]
adc byte [ebx - 0x4d], dh
adc bl, bl
mov dword [0xf313aaf7], eax
and dword [ebp - 0x76], esi
je 0x437b6d
les edx, [ecx + 0x23d75844]
scasb al, byte es:[edi]
jecxz 0x437af9
sub dword [esi - 0x59], eax

Function at 0x438d06
Capabilities:
Encode data using xor

Disassembly:
pop eax
add edx, ebp
jae 0x438d4b
int3
or eax, 0xc27ce2ab
push ebx
mov ecx, 0x75e76286
inc ecx
sal dword [edi], cl
mov ch, 0xbe
push ebp
das
cmp eax, 0x82dff2f3
xchg ecx, eax
xor dword [0xceb16b52], edx
wait
lahf
pop es
xchg ebx, eax
inc ebx
push esi
mov byte [0xef473517], al
add al, byte [esi - 0x1daa65ee]
jl 0x438d4f
ret 0xb953
pop ebp
and cl, byte [eax]
pop ds
sbb edi, edi
pop es
invalid
Function at 0x4651a6
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
jg 0x46516e
cmp edi, edi
dec esp
xchg esi, eax
scasd eax, dword es:[edi]
fist word [ecx]
xor eax, 0x3020cca9
add byte [edx], ah
in al, dx
bnd je 0x465183
aam 0x10
invalid
popfd
or ecx, dword [ebx]
mov esi, 0xef305b3d
mov ecx, edi
loope 0x46519d
invalid
mov dword [0xc06cfeac], eax
mov dh, 3
push es
adc al, 0x66
and bl, byte ss:[edi]
pop ds
fdivr qword [esi + 0x1bb5d54e]
xor dword [ecx - 0x1a], eax
push es
sal byte [edx - 0x6df21de7], 0x1e
push 0xffffffffffffffe5
sbb edx, esp
or eax, 0xe56a1e92
invalid
sub edi, dword [ecx + ecx*8 - 0x47]
not esi
js 0x46515b
lodsb al, byte [esi]
rol byte [ebx], cl
adc dl, ah
xor al, 0xe0
adc eax, 0x8a5f8342
out 0x78, al
jns 0x465175
xchg dword [ecx - 0x6f], edx
inc eax
lodsd eax, dword [esi]
push ebx
mov dl, 0x72
adc byte [ecx], 0xdd
enter 0xffffffffffffc9e1, 0x12
jl 0x4651ae
xchg ecx, eax
in eax, dx
salc
lodsd eax, dword [esi]
loopne 0x4651f0
cdq
xchg edx, eax
push eax
shr byte [ebp - 0x1a4fea0c], cl
xchg eax, ebx
mov dl, 0x87
hlt
shl byte [edx + edi*8 + 0x7f], cl
int3
fadd st(4), st(0)
jecxz 0x4651e4
add esi, dword [esi + 0x5c5d005a]
mov bh, byte [eax - 0x63]
mov al, 0x24
fdiv dword [edx + 0x6e]
and dword [ebx + 0x78331322], edx
xchg edi, eax
je 0x4651dc
dec edi
inc eax
mov bh, 0xd6
dec ecx
inc edx
dec edx
dec esp
mov ch, 0x37
shl byte [edx - 0x50], cl
dec ecx
pop edi
sbb al, 0x30
and byte [edx + ebx*4 - 0x58b87cb8], al
movsb byte es:[edi], byte [esi]
invalid

Function at 0x4810ac
Capabilities:
Encode data using xor

Disassembly:
call 0xba00568f
loop 0x4810e4
sub ecx, ebx
add byte [edi - 0x5105b16d], bh
sbb ah, byte [esi + 0x4c66cce7]
movsd dword es:[edi], dword [esi]
inc esi
mov esp, 0x934cecee
wait
mov dh, 0x11
mov word [ecx + 0x78], ss
mov edi, 0xf5e28a75
sbb dword [eax - 0x7f98cb09], edx
sub ecx, edi
push ebp
out dx, eax
std
pop ss
or edi, dword [ebp + 0x39d1c8fa]
push ebx
in eax, 0x49
cmp dword [ebx + 0x3e], edx
in eax, 0x49
mov edx, 0xfcb67444
rcl dword [ecx + 0x1e], 0x45
cmp byte [esi + edx*2], 0x99
inc ecx
cmp dl, dl
cdq
imul edi, dword [edi + 0xd4f59c7], 0xffffffab
je 0x481148
sbb dword [ebx + 0x5a], edx
dec ecx
xchg ebx, eax
push edi
fistp word [edx - 0x7df80744]
xor eax, 0xe9d9c59f
xchg ecx, eax
int3
adc al, 0x6d
lea esi, [esi + 0x324e5eec]
mov dword [eax + 1], ebx
les eax, [edx - 0x37]
pop ss
cdq
push esp
xchg edi, eax
xchg edi, eax
and al, 0x9c
stosd dword es:[edi], eax
sbb ah, byte [esi + 0x46d8f225]
or dh, al
xor eax, 0x479dda0a
jae 0x48115a
sub bl, byte [ecx + ecx - 0x17]
xor al, 0x38
dec edx
wait
les ebp, [edi + eax*2]
aad 0xa1
inc edx
xor bl, dl
xor edi, dword [eax - 0x64]
xor byte [edi + 0x4d], bl
stc
ret
Function at 0x497ee3
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x535d563b
sub eax, 0xde331f11
rcr dh, cl
xor eax, 0x36181419
pop edx
push esi
push ebp
cmp byte [edi], dl
sbb dl, byte [esi]
cmp dl, dh
fst st(1)
cmp eax, 0x3c101d11
push ebx
popal
pop esp
xor bl, byte [ecx]
pop ss
adc eax, 0xdfd17d3a
sbb bl, byte ss:[ecx]
push ss
add dword [esi + 0x54], ebx
pop ebx
aaa
adc eax, 0xd23f1618
loopne 0x497efc
xor byte [ebx + edx], bl
pop ds
xor ebx, dword [esi + 0x52]
pop esi
xor eax, 0x34181519
fcom st(4)
invalid

Function at 0x4ad666
Capabilities:
Encode data using xor

Disassembly:
jnp 0x4ad677
or al, 0x70
mov byte [0xa14afdfa], al
in eax, 0x25
adc esi, dword [edx - 0x41]
inc eax
dec ebx
into
mov eax, dword [0xa941547c]
movsb byte es:[edi], byte [esi]
arpl word [edi - 0x4e], bp
out dx, eax
invalid

Function at 0x4bafcd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4bafef
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4bafe0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4bb11d
mov eax, dword [0x4c6d1c]
cmp eax, 1
je 0x4bb0f7
test eax, eax
jne 0x4bb020
cmp dword [0x4c22bc], 1
je 0x4bb0f7
cmp edx, 0xfc
je 0x4bb11d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb057
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb9b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbe40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb09a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbe40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c06f4
push edi
call fcn.004bdd10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb9b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb9c0
lea eax, [ebp - 0xa0]
push 0x4c06d4
push eax
call fcn.004bb9c0
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb9c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bdc84
add esp, 0x2c
pop edi
jmp 0x4bb11d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004bbe40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5d69e1
Capabilities:
Encode data using xor

Disassembly:
arpl word [ebx - 0x7f], si
imul ebx, dword [ebx - 0x3b], 0xffffff92
mov eax, dword [0xcc000004]
nop
inc edi
xlatb
sub dword [ebp + 0x40], edx
jns 0x5d6a3d
or dword [eax], eax
add byte [edi], dh
add byte [eax], bh
fcomp qword [ecx + eax*8 + 0x63]
add byte [ecx - 0xb], ah
jl 0x5d6a0b
add byte [eax], al
aaa
add byte [eax + 0x13004d00], al
add byte [ebx], dl
add eax, dword [eax]
add byte [edx + ebp*8 + 0x66], ah
cmp eax, 0x6b0113
mov byte [ebp + edx*4 + 0x14006305], dl
aam 0xe
add al, 0
add byte [ecx + 0x3e], cl
lcall 0x694c, 0x20008057
push esi
dec ecx
add byte [edi], ah
mov dl, 9
add byte [eax], al
add byte [eax], 0x67
add byte [ebx], ah
adc eax, 0x2c01912c
mov ah, 0x6d
sub al, 0x91
add dword [esp + esi*4], ebp
insd dword es:[edi], dx
add eax, 0xb3ec0000
mov al, byte [ecx]
add byte [eax], al
jbe 0x5d6a51
add byte [eax], al
arpl word [eax], ax
xor byte [esi], 0x97
add al, 0
add byte [ecx], dh
test dword [ebx - 0x43ff98ac], edi
add dh, al
add al, 0
add byte [eax + 0x4970076], al
add byte [eax], al
xor dword [ebp + 0x6754bb], eax
mov esp, 0x4c600
add byte [eax + 0x63008000], al
add al, bl
sub eax, 0x1c0063
add byte [eax], al
inc esi
out dx, eax
add byte [di + 0x7d], ch
stosb byte es:[edi], al
pop ebp
out 0x6b, al
add ah, bh
add al, 0x7a
mov byte [0xb7000005], al
sbb bh, ch
test dword [edx], 0x37000002
add cl, al
pop edx
aaa
add byte [ebx], ah
push ds
mov edi, 0xc3376b
add byte [eax], al
sal byte [ebp - 0xa], 4
add byte [eax], al
mov al, byte [0x2281732c]
add ch, 0x92
sbb ebx, edi
cmp eax, dword [ecx - 0x5d]
push es
add byte [eax], al
pop edi
arpl word [bx + si], ax
arpl word [eax], ax
mov ch, 6
add byte [eax], al
jns 0x5d6b3b
xor eax, 0x63ec74
jnp 0x5d6ad8
adc edi, dword [esi + 0xb]
nop
in al, dx
cmpsd dword [esi], dword es:[edi]
stc
add byte [eax], al
add cl, dh
jg 0x5d6ab7
dec edi
or dword [ecx], eax
add byte [eax], al
jg 0x5d6ab7
adc ebp, 0x1bf9f31a
arpl word [eax], ax
xor al, 0
add byte [eax], al
sub byte [esi - 0x745dffb7], bh
leave
mov eax, dword [edi + edi*8]
invalid
add byte [eax + eax + 0x6a9], bh
les edx, [eax - 0x58c4ec3b]
in al, dx
or dword [ebx], esp
push ss
xor al, 0xb
add al, byte [eax]
add byte [edi], dh
add byte [edi], ah
arpl word [eax], ax
mov bh, bh
invalid
Function at 0xe52108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00e52258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe5212e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe5211a
add dl, dl
jne 0xe52139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe5218c
xor eax, eax
add dl, dl
jne 0xe52146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe5222d
add dl, dl
jne 0xe52155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe52160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe5216b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe52176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe52182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe52125
mov eax, 1
add dl, dl
jne 0xe5219a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe521a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe52191
sub eax, ebx
mov ebx, 1
jne 0xe521d8
mov ecx, 1
add dl, dl
jne 0xe521be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe521c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe521b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe52125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe521ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe521fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe521e6
cmp eax, 0x7d00
jae 0xe5221d
cmp eax, 0x500
jb 0xe52218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe52125
cmp eax, 0x7f
ja 0xe52220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe52125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe5224e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe52125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401060
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x401071
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x40108f
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x4010c6
test ecx, ecx
je 0x4010bf
test esi, esi
jne 0x401080
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x4010e0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x401142
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
mov eax, 0x400000
cmp esi, 0x400000
ja 0x40110f
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x401147
test ecx, ecx
je 0x401140
test esi, esi
jne 0x401100
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x403890
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x58d0a0], ecx
inc edx
cmp edx, 0x100
jb 0x403892
ret

Function at 0x403940
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xffffffff
test ecx, ecx
je 0x40396a
push esi
jmp 0x403950
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x58d0a0]
inc edx
dec ecx
jne 0x403950
pop esi
ret
Function at 0x403e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
mov eax, dword [0x587978]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x94]
push ebp
push esi
push edi
push ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
xor ebp, ebp
push ecx
lea esi, [esp + 0x28]
mov edi, edx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
call fcn.00406090
add esp, 8
cmp eax, ebp
jne 0x403f73
mov edx, dword [esp + 0xac]
mov eax, 1
mov dword [esp + 0x34], edi
mov dword [esp + 0x48], edx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], ebp
mov dword [esp + 0x78], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x70], eax
lea ebx, [ebx]
mov eax, 0x40000
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], eax
cmp dword [esp + 0xa8], ebp
ja 0x403eac
jb 0x403ea1
cmp dword [esp + 0xa4], eax
jae 0x403eac
mov eax, dword [esp + 0xa4]
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
call eax
mov esi, eax
add esp, 0xc
cmp esi, ebp
jne 0x403f5f
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x44]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0xb0]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x30]
call fcn.00405d90
mov esi, eax
mov eax, dword [esp + 0x20]
sub dword [esp + 0x1c], eax
add esp, 0x10
sub dword [esp + 0xa4], eax
sbb dword [esp + 0xa8], ebp
cmp esi, ebp
jne 0x403f5f
mov ecx, dword [esp + 0x48]
cmp dword [esp + 0x44], ecx
je 0x403f3d
cmp eax, ebp
jne 0x403f27
cmp edi, dword [esp + 0x44]
je 0x403f3d
push eax
mov eax, dword [ebx + 4]
push ebx
call eax
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x403e80
jmp 0x403f5f
cmp ecx, dword [esp + 0xac]
jne 0x403f5a
cmp dword [esp + 0xc], ebp
jne 0x403f5a
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x403f5f
cmp eax, 4
je 0x403f5f
mov esi, 1
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
push ecx
push eax
call edx
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004eb16b
add esp, 0x90
ret