joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408440
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
xor eax, eax
test esi, esi
je 0x4085a5
mov byte [esi], al
mov eax, dword [esp + 0x114]
test eax, eax
je 0x40846b
mov dword [eax], 0
push ebx
push edi
push str.QuickTime.qts
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov ebx, dword [esp + 0x118]
je 0x4084cb
push 0x104
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x4084cb
lea eax, [esp + 0xc]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4084a0
sub eax, edx
lea edi, [eax - 0xd]
lea edx, [edi + 1]
cmp ebx, edx
jbe 0x4084cb
push edi
lea eax, [esp + 0x10]
push eax
push esi
call sub.MSVCR110.dll_strncpy
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x408554
cmp byte [esi], 0
jne 0x408559
push ebx
push esi
push str.QTSysDir
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00408390
mov al, byte [esi]
add esp, 0x10
test al, al
je 0x4084fd
push 0
push esi
call sub.MSVCR110.dll__access
add esp, 8
test eax, eax
je 0x408500
mov byte [esi], 0
cmp byte [esi], 0
jne 0x408559
push ebx
push esi
push str.QuickTime.qts_folder
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00408390
mov al, byte [esi]
add esp, 0x10
test al, al
je 0x40852e
push 0
push esi
call sub.MSVCR110.dll__access
add esp, 8
test eax, eax
je 0x408531
mov byte [esi], 0
cmp byte [esi], 0
jne 0x408559
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x408551
push 0
push esi
call sub.MSVCR110.dll__access
add esp, 8
test eax, eax
je 0x408554
mov byte [esi], 0
cmp byte [esi], 0
je 0x40859a
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408560
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
je 0x40859a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408575
sub eax, edx
cmp byte [eax + esi - 1], 0x2f
je 0x40859a
mov edi, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x408588
mov cx, word [0x40b448]
mov word [edi], cx
mov cl, byte [esi]
xor eax, eax
test cl, cl
pop edi
setne al
pop ebx
pop esi
add esp, 0x104
ret
Function at 0x4085b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebp
mov ebp, dword [esp + 0x210]
push esi
mov esi, dword [esp + 0x218]
push esi
push ebp
push str.QTExtDir
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00408390
mov al, byte [ebp]
add esp, 0x10
test al, al
jne 0x4086ec
add esi, 0xfffffff6
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
lea ecx, [esp + 0x110]
push esi
push ecx
call fcn.00408440
mov al, byte [esp + 0x118]
add esp, 0xc
test al, al
je 0x4086ec
lea eax, [esp + 8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408620
sub eax, edx
cmp byte [esp + eax + 7], 0x5c
push edi
je 0x408662
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408638
sub eax, edx
cmp byte [esp + eax + 0xb], 0x2f
je 0x408662
lea edi, [esp + 0xc]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x408650
mov dx, word [0x40b448]
mov word [edi], dx
lea eax, [esp + 0x110]
mov edx, ebp
mov ecx, eax
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x408670
lea esi, [esp + 0x110]
lea eax, [esp + 0xc]
push ebx
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4086ae
test cl, cl
je 0x4086aa
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4086ae
add eax, 2
add esi, 2
test cl, cl
jne 0x408686
xor eax, eax
jmp 0x4086b3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
jne 0x4086eb
mov edi, ebp
dec edi
jmp 0x4086c0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4086c0
mov eax, dword [str.QuickTime_]
mov dword [edi], eax
mov ecx, dword [0x40b510]
mov dword [edi + 4], ecx
mov dx, word [0x40b514]
mov word [edi + 8], dx
mov al, byte [0x40b516]
mov byte [edi + 0xa], al
pop edi
mov eax, ebp
pop esi
lea edx, [eax + 1]
pop ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4086f3
sub eax, edx
add esp, 0x208
ret
Function at 0x406444
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406469
mov eax, dword [0x40a908]
cmp eax, 0xffffffff
je 0x406460
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a908], 0xffffffff
jmp 0x4064dc
cmp dword [0x42efc0], ebx
je 0x4064dc
cmp byte [0x42ebc0], bl
je 0x4064a8
cmp dword [0x40a908], 0xffffffff
jne 0x4064b1
push 4
push 0x40000000
push 0x42ebc0
call fcn.00405dd1
cmp eax, 0xffffffff
mov dword [0x40a908], eax
je 0x4064dc
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a908], 0xffffffff
je 0x4064dc
push esi
mov esi, 0x42f7e0
push 0x40ab64
push esi
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp + 8]
push ebx
push eax
push esi
call sub.KERNEL32.dll_lstrlenA
push eax
push esi
push dword [0x40a908]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40668a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42d62c], 0
push esi
jne 0x4066c1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40669b
mov dword [ecx*4 + 0x42d628], eax
inc ecx
cmp ecx, 0x100
jl 0x406696
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4066f2
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42d628]
xor eax, esi
inc ecx
dec edx
jne 0x4066d4
pop edi
not eax
pop esi
ret 0xc
Function at 0x40c1c8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004079cb
mov dword [ebp - 0x14], eax
cmp dword [0x811ec0], esi
jne 0x40c2bb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c248
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c39b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c39b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c39b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x811ec0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x811ec4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x811ec8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x811ed0], eax
test eax, eax
je 0x40c2b8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x811ecc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c2e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c2d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c2f5
push 4
pop eax
jmp 0x40c39d
cmp dword [ebp - 0x14], esi
je 0x40c2f5
push dword [0x811ec0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c2da
mov eax, dword [0x811ecc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c353
cmp dword [0x811ed0], edi
je 0x40c353
push eax
call ebx
push dword [0x811ed0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c353
test eax, eax
je 0x40c353
call ecx
test eax, eax
je 0x40c348
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c348
test byte [ebp - 8], 1
jne 0x40c353
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c383
mov eax, dword [0x811ec4]
cmp eax, edi
je 0x40c380
push eax
call ebx
test eax, eax
je 0x40c380
call eax
mov esi, eax
test esi, esi
je 0x40c380
mov eax, dword [0x811ec8]
cmp eax, edi
je 0x40c380
push eax
call ebx
test eax, eax
je 0x40c380
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x811ec0]
call ebx
test eax, eax
je 0x40c39b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c39d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403b35
mov esp, ebp
pop ebp
ret
Function at 0x10004755
Capabilities:
Print debug messages
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [section..data]
push esi
cmp ecx, 0xffffffff
je 0x10004787
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000476c
push 0
sub eax, esi
push eax
push dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
pop esi
pop ebp
ret 4
cmp dword [0x1001042c], 0
je 0x10004807
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push edi
push 0xffffffffffffffff
push dword [0x10010428]
call esi
push dword [0x1001042c]
mov edi, dword [sym.imp.msvcrt.dll_fputs]
push dword [ebp + 8]
call edi
push dword [0x1001042c]
mov ebx, dword [sym.imp.msvcrt.dll_fflush]
call ebx
add esp, 0xc
push dword [0x10010428]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [0x1001042c], 0
je 0x10004805
push 0xffffffffffffffff
push dword [0x10010428]
call esi
push dword [0x1001042c]
push dword [ebp + 8]
call edi
push dword [0x1001042c]
call ebx
add esp, 0xc
push dword [0x10010428]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop ebx
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_OutputDebugStringA]

Function at 0x10004814
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x10010848
push 0xffffffffffffffff
push 0x18ff
push esi
call sub.msvcrt.dll__vsnprintf_s
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
pop ebp
ret
Function at 0x10009806
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push 1
push esi
push 0x10002cf8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100098cc
push 4
pop edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x10002cec
push dword [ebp - 0x10]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100098a4
test dword [0x10010004], 0x8000
je 0x10009897
cmp dword [0x10010008], edi
jb 0x10009897
push dword [ebp - 4]
push 0x10002cb4
cmp dword [0x1001042c], esi
je 0x10009890
call fcn.100043d5
jmp 0x10009895
call fcn.10004814
pop ecx
pop ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor esi, esi
mov dword [eax], ecx
inc esi
jmp 0x100098ee
test dword [0x10010004], 0x8000
je 0x100098ee
cmp dword [0x10010008], edi
jb 0x100098ee
push 0x10002c7c
cmp dword [0x1001042c], esi
je 0x100098e8
call fcn.100043d5
jmp 0x100098ed
test dword [0x10010004], 0x8000
je 0x100098ee
cmp dword [0x10010008], 4
jb 0x100098ee
push 0x10002c08
jmp 0x100098bd
call fcn.10004814
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret 4

Function at 0x1000a0af
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10010410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
push ebx
xor edi, edi
push edi
push esi
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x42
mov byte [ebp - 8], 0x43
mov byte [ebp - 7], 0x44
mov byte [ebp - 6], 0x45
mov byte [ebp - 5], 0x46
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [ebp + 0x18], 0
je 0x1000a14c
cmp dword [ebp + 0xc], edi
jle 0x1000a179
lea eax, [esi + ebx]
mov ecx, dword [ebp + 8]
add ecx, edi
movsx edx, byte [ecx]
and edx, 0xf
mov dl, byte [ebp + edx - 0x14]
dec eax
mov byte [eax], dl
movzx ecx, byte [ecx]
dec eax
shr ecx, 4
mov cl, byte [ebp + ecx - 0x14]
inc edi
cmp edi, dword [ebp + 0xc]
mov byte [eax], cl
jl 0x1000a125
jmp 0x1000a179
xor ecx, ecx
cmp dword [ebp + 0xc], edi
jle 0x1000a179
mov eax, dword [ebp + 8]
add eax, ecx
movsx edx, byte [eax]
and edx, 0xf
mov dl, byte [ebp + edx - 0x14]
mov byte [esi + ecx*2 + 1], dl
movzx eax, byte [eax]
shr eax, 4
mov al, byte [ebp + eax - 0x14]
mov byte [esi + ecx*2], al
inc ecx
cmp ecx, dword [ebp + 0xc]
jl 0x1000a153
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d555
leave
ret 0x14
Function at 0x1000cf50
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10010410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov dword [ebp - 0x210], 1
mov byte [ebp - 0x20c], bl
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x18
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x402
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x403
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [ebp - 0x20c], bl
je 0x1000d08c
cmp byte [ebp - 0x108], bl
je 0x1000d08c
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.1000b1b8
test eax, eax
jne 0x1000d031
push 0x10
push 0x10004240
push 0x10004228
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
push 0x403
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x1000d09f
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.1000b1b8
test eax, eax
jne 0x1000d05e
push 0x10
push 0x10004240
push 0x10004210
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
push 0x402
jmp 0x1000d025
push edi
call fcn.1000b8e7
push ebx
push 0x402
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push ebx
push 0x403
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push edi
call fcn.1000c891
jmp 0x1000d0a5
push 0x10
push 0x10004240
push 0x100041f0
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x210], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d555
leave
ret 4
Function at 0x412ed0
Capabilities:
Terminate process

Disassembly:
call fcn.00413815
jmp 0x412eda
push 0x58
push 0x419330
call fcn.004138c8
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x41e22c
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x412f2c
cmp eax, esi
jne 0x412f1f
xor esi, esi
inc esi
mov edi, esi
jmp 0x412f2f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x412f03
xor esi, esi
inc esi
cmp dword [0x41e230], esi
jne 0x412f41
push 0x1f
call fcn.00591000
pop ecx
jmp 0x412f7b
cmp dword [0x41e230], ebx
jne 0x412f75
mov dword [0x41e230], esi
push 0x401024
push 0x401018
call fcn.004130b9
pop ecx
pop ecx
test eax, eax
je 0x412f7b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4130a9
mov dword [0x41decc], esi
cmp dword [0x41e230], esi
jne 0x412f9e
push 0x401014
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x41e230], 2
test edi, edi
jne 0x412fab
xor eax, eax
mov ecx, 0x41e22c
xchg dword [ecx], eax
cmp dword [0x41e23c], 0
je 0x412fd7
push 0x41e23c
call fcn.00413720
pop ecx
test eax, eax
je 0x412fd7
push ebx
push 2
push ebx
mov esi, dword [0x41e23c]
mov ecx, esi
call dword [0x41f2f0]
call esi
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x413035
test cl, cl
je 0x413004
test edi, edi
jne 0x413035
test cl, cl
je 0x413004
cmp cl, 0x20
ja 0x413004
inc esi
mov dword [ebp - 0x1c], esi
mov cl, byte [esi]
jmp 0x412ff3
test byte [ebp - 0x3c], 1
je 0x413010
movzx eax, word [ebp - 0x38]
jmp 0x413013
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x41dec8], eax
cmp dword [0x41dee0], 0
jne 0x41308e
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x413046
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x413059
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x412fe4
cmp dword [0x41decc], 0
jne 0x4130a2
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x41dec8]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413604
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x419370
call fcn.004138c8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x413664
cmp eax, 0xffffffff
je 0x413664
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41365d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41365d
cmp edx, 0x10000000
jae 0x41365d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41365a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x438c87
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop edx
sub esi, ecx
push 0x66bb0db5
pop ecx
dec esi
call fcn.00438cb7
sub ecx, esi
xor dword [ebx], edx
inc ecx
add esi, 0x420b72eb
inc ebx
dec esi
sub esi, 0x7afbaf3f
sub ecx, esi
cmp ebx, eax
jne fcn.00438c87
inc ecx
ret

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41aecd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x41aedc
pop dword [ebp - 0xc]
mov eax, 0x76486ed7
sub eax, 0x7606bffb
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3a9a0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x8ec24931
add ecx, 0x713e03fc
mov edi, eax
mov esi, 0x4d311dc9
add esi, 0xb3129a37
add esi, dword [ebp - 0xc]
mov ebx, 0xdc0ad2ec
add ebx, 0x80b0ff40
mov dword [ebp - 8], 0xd5f7fa84
mov edx, dword [esi]
xor dword [ebp - 8], 0x8e812744
sub edx, ebx
mov dword [edi], edx
add dword [ebp - 8], 0x978f0875
add edi, 0xbf07d5e0
sub edi, 0xbf07d5dc
add esi, 0x8d1c6edb
add esi, 0x72e39129
loop 0x41af36
add eax, 0x684a68c6
add eax, 0x97b6bec1
mov ebx, eax
add eax, 5
mov ecx, 0xda118ce3
sub ecx, 0xd9d18ce3
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x421730
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x42176d
push str.SetDefaultDllDirectories
push 0x42c874
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x42176d
push 0xc00
call eax
test eax, eax
jne 0x421806
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421806
cmp eax, 0x104
ja 0x421806
cmp word [esp + eax*2 + 6], 0x5c
je 0x42179c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x421806
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x4217db
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x4217c7
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x4217bc
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret