joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4af91c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
jmp 0x4af9db
cmp dword [esi + 0x10], 0x1000
jne 0x4af9c7
test byte [esi + 0x15], 1
jne 0x4af9c7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4af978
cmp ebp, 2
je 0x4af978
cmp ebp, 0x10
je 0x4af978
cmp ebp, 0x20
jne 0x4af994
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4af994
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4af9a5
mov eax, dword [esi]
add eax, ebx
call fcn.004af914
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4af998
cmp byte [esp + 4], 0
je 0x4af9c7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4af94d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408925
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
call fcn.0040893e
xor dword [ecx], esi
inc ecx
and ebx, ebx
cmp ecx, edi
jne fcn.00408925
or eax, eax
push eax
pop eax
ret
Function at 0x10f5c7c
Capabilities:
Encode data using xor

Disassembly:
iretd
jmp 0x10f5c86
pushal
call 0x10f5c8c
pop ebp
sub ebp, 0x10
sub ebp, 0xcf5c7c
jmp 0x10f5ca2
mov eax, 0xcf5c7c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0x867c212d
xor byte [eax], dl
inc eax
dec ecx
jne 0x10f5cb9
jmp 0x10f5ccc
cmpsb byte [esi], byte es:[edi]
loopne 0x10f5c75
movsb byte es:[edi], byte [esi]
adc dword [0xecac2d2d], ebp
aad 0x2d
sub eax, 0x95e02e2d
sub dword [0x5972d2d], ebp
sub eax, 0xcfda2d2d
in eax, 0xa6
lodsb al, byte [esi]
and dword [0xe82e2d2d], ebp
jge 0x10f5d71
inc ebp
mov cl, 0xd
cvtps2pi mm0, qword [ebp - 0xe]
push ss
sub byte [0x4509012c], 0xd5
jle 0x10f5d19
lds ebp, es:[eax]
sub eax, 0x19c42d2d
sub eax, 0x49a02d2d
or ecx, edx
movsb byte es:[edi], byte [esi]
add dword [ecx], ecx
jns 0x10f5d89
cmpsb byte [esi], byte es:[edi]
test al, 0x25
sub eax, 0xb8a62d2d
and dword [0xa0a62d2d], ebp
cmp eax, 0xec2d2d2d
les ebp, [edi]
sbb al, 0x2f
scasb al, byte es:[edi]
out dx, eax
sub dword [edx - 0x58], esp
invalid
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x2d2d2909]
sub eax, 0xf0db145
sub eax, 0x8016f245
sub eax, 0x7c09012c
lds ebp, [eax]
sub eax, 0x66c42d2d
das
sub eax, 0x7079782d
rcr byte [eax + 0x21], cl
rcr byte [eax + 0x25], cl
lds edx, [ebx + 0x2d]
sub eax, 0x2590a62d
sub eax, 0xdcac2d2d
ret
cmpsb byte [esi], byte es:[edi]
nop
and eax, 0xac2d2d2d
fadd st(3), st(0)
div byte ss:[edx + 0x36c3dcac]
div byte [edx - 0x20531be2]
jno 0x10f5d44
cmp edi, edi
lodsb al, byte [esi]
fbstp tbyte [ecx - 0x45]
cmp edi, edi
push ds
jmp [esi + 0x226528c5]
Function at 0x402bc0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40d008], 0x8088405
inc edx
mov dword [ebx + 0x40d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402fe8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40d018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403080
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403060
xor eax, eax
push ebp
push 0x403059
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40309c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403060
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40d018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40d018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403b08
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40e044], 0
je 0x403b69
cmp word [0x40e218], 0xd7b2
jne 0x403b31
cmp dword [0x40e220], 0
jbe 0x403b31
mov eax, 0x40e214
call dword [0x40e230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40d060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403b90
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40d024], 0
jne 0x403b85
push 0
push 0x40d058
push 0x40d060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404a14
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404a7a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403ee0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402bdc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404a64
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404a81
lea eax, [ebp - 0x10]
call fcn.00403c8c
ret

Function at 0x406c18
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406c51
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403d7c
jmp 0x406c5a
mov eax, ebx
mov edx, esi
call fcn.00403ce0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406c64
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406c85
mov al, byte [esp]
jmp 0x406c87
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407dec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407e50
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403ee0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00405fa0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e57
lea eax, [ebp - 0xc]
call fcn.00403c8c
ret

Function at 0x408efc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x408f42
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00408e60
mov eax, dword [ebp - 4]
call fcn.00404068
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f49
lea eax, [ebp - 4]
call fcn.00403c8c
ret
Function at 0x4090f4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor eax, eax
mov dword [ebp - 8], eax
lea esi, [ebp - 4]
xor eax, eax
push ebp
push 0x40914f
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineA_1
lea edx, [ebp - 8]
call fcn.00409014
mov dword [esi], eax
xor ebx, ebx
jmp 0x409132
inc ebx
lea edx, [ebp - 8]
mov eax, dword [esi]
call fcn.00409014
mov dword [esi], eax
mov eax, dword [esi]
cmp byte [eax], 0
jne 0x409125
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409156
lea eax, [ebp - 8]
call fcn.00403c8c
ret

Function at 0x409160
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4091f9
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4091aa
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
mov ecx, eax
lea edx, [ebp - 0x10c]
mov eax, esi
call fcn.00403d7c
jmp 0x4091e3
call sub.kernel32.dll_GetCommandLineA_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x4091c4
lea eax, [ebp - 4]
call fcn.00403c8c
jmp 0x4091d9
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00409014
mov dword [ebp - 8], eax
test ebx, ebx
je 0x4091d9
dec ebx
jmp 0x4091b2
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409200
lea eax, [ebp - 4]
call fcn.00403c8c
ret

Function at 0x409208
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00406198
add esp, 0x104
pop ebx
ret
Function at 0x40934c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40946d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x409457
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x4093a5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x409457
cmp dword [ebp - 0xc], 0
jne 0x4093ba
mov eax, dword [ebp - 4]
call fcn.00403c8c
mov bl, 1
jmp 0x409457
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00403d7c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004040b8
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x409371
test eax, eax
jne 0x409457
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x409401
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x409457
jmp 0x409401
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x409414
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x4093fe
cmp dword [ebp - 8], 7
jne 0x409423
cmp dword [ebp - 0xc], 0
je 0x409423
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0040415c
cmp dword [ebp - 8], 7
jne 0x40944a
cmp dword [ebp - 0xc], 0
je 0x40944a
lea eax, [ebp - 0x10]
call fcn.004040b8
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00403ce0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409474
lea eax, [ebp - 0x10]
call fcn.00403c8c
ret

Function at 0x409e08
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40e7d4
mov eax, esi
mov edx, 8
test al, 1
je 0x409e24
shr eax, 1
xor eax, 0xedb88320
jmp 0x409e26
shr eax, 1
dec edx
jne 0x409e17
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x409e10
pop esi
ret

Function at 0x409e3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40e7d0], 0
jne 0x409e60
call fcn.00409e08
push 1
push 0x40e7d0
call sub.kernel32.dll_InterlockedExchange
mov dword [esp], edi
test esi, esi
je 0x409e90
mov eax, ebx
and eax, 0xff
mov edx, dword [esp]
movzx edx, byte [edx]
xor ax, dx
movzx eax, ax
mov eax, dword [eax*4 + 0x40e7d4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
dec esi
inc dword [esp]
test esi, esi
jne 0x409e67
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40b81c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040b7d0
test al, al
jne 0x40b83d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40b889
xor eax, eax
push ebp
push 0x40b879
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404068
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b880
lea eax, [ebp - 0xc]
call fcn.0040b80c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bbc8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40bbd0
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40bcbd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00409234
mov edx, dword [ebp - 8]
mov ecx, 0x40bcd4
xor eax, eax
call fcn.0040bab8
push 0
mov eax, dword [ebp - 4]
call fcn.00404068
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x40bc8b
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x40bbea
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.0040b5c8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00405f78
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00409704
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x60
call fcn.0040b598
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x405380]
call fcn.00407414
call fcn.004036c4
jmp 0x40bbea
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bcc4
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403cb0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403cb0
ret

Function at 0x40bce4
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x40d500]
cmp dword [eax], 2
jne 0x40bd4c
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40bd07
xor eax, eax
jmp 0x40bd5b
lea eax, [esp + 8]
push eax
push 0x40bd60
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x40bd4c
xor eax, eax
jmp 0x40bd5b
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret
Function at 0x40bd74
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40bdce
inc esi
xor edi, edi
cmp edi, 1
jne 0x40bd9a
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40bda8
cmp edi, 1
jle 0x40bda8
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040b81c
test eax, eax
jne 0x40bdce
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40bdce
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x40bdce
inc edi
dec esi
jne 0x40bd8a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x40c0a0
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x40ef40], 0
je 0x40c0ea
mov esi, dword [0x40f07c]
dec esi
test esi, esi
jl 0x40c0ea
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 4
add eax, ebx
mov edx, dword [0x40f078]
mov edx, dword [edx + eax*4]
mov eax, dword [0x40ef40]
call fcn.00405e0c
test eax, eax
jne 0x40c0e6
mov eax, ebx
call fcn.0040c054
jmp 0x40c1c3
inc ebx
dec esi
jne 0x40c0bc
mov al, byte [0x40f064]
sub al, 1
jb 0x40c0f7
je 0x40c100
jmp 0x40c109
call fcn.004094b4
mov edi, eax
jmp 0x40c10b
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x40c10b
xor edi, edi
test di, di
je 0x40c1bc
mov esi, dword [0x40f07c]
dec esi
test esi, esi
jl 0x40c162
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 4
add eax, ebx
mov edx, dword [0x40f078]
lea eax, [edx + eax*4]
mov dword [esp], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x2c]
movzx edx, di
cmp eax, edx
jne 0x40c15e
mov eax, dword [esp]
mov ebp, dword [eax + 0x30]
test ebp, ebp
je 0x40c155
call sub.kernel32.dll_GetACP
cmp ebp, eax
jne 0x40c15e
mov eax, ebx
call fcn.0040c054
jmp 0x40c1c3
inc ebx
dec esi
jne 0x40c122
mov esi, dword [0x40f07c]
dec esi
test esi, esi
jl 0x40c1bc
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 4
add eax, ebx
mov edx, dword [0x40f078]
lea eax, [edx + eax*4]
mov dword [esp], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x2c]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40c1b8
mov eax, dword [esp]
mov ebp, dword [eax + 0x30]
test ebp, ebp
je 0x40c1af
call sub.kernel32.dll_GetACP
cmp ebp, eax
jne 0x40c1b8
mov eax, ebx
call fcn.0040c054
jmp 0x40c1c3
inc ebx
dec esi
jne 0x40c170
xor eax, eax
call fcn.0040c054
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40c258
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c32d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40c344
push ebx
push 0x40c350
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403fcc
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402ba0
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404068
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40c2d8
mov al, 0x62
call fcn.0040be10
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.0040c22c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40c2e1
call fcn.0040c22c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c334
lea eax, [ebp - 4]
call fcn.00403c8c
ret

Function at 0x40c3f0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov ebp, eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov dword [esp], ebp
push 0x1c
push esi
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40c4c2
jmp 0x40c4b7
cmp dword [esi + 0x10], 0x1000
jne 0x40c49e
test byte [esi + 0x15], 1
jne 0x40c49e
mov byte [esp + 4], 0
mov edi, dword [esi + 0x14]
cmp edi, 1
je 0x40c44f
cmp edi, 2
je 0x40c44f
cmp edi, 0x10
je 0x40c44f
cmp edi, 0x20
jne 0x40c46b
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40c46b
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40c47c
mov eax, dword [esi]
add eax, ebx
call fcn.0040c3e8
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40c46f
cmp byte [esp + 4], 0
je 0x40c49e
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov dword [esp], eax
push 0x1c
push esi
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40c4c2
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x40c424
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xa84058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a841a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa8407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8406a
add dl, dl
jne 0xa84089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa840dc
xor eax, eax
add dl, dl
jne 0xa84096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8417d
add dl, dl
jne 0xa840a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa840b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa840bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa840c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa840d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa84075
mov eax, 1
add dl, dl
jne 0xa840ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa840f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa840e1
sub eax, ebx
mov ebx, 1
jne 0xa84128
mov ecx, 1
add dl, dl
jne 0xa8410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa84119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa84105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa84075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa8413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa8414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa84136
cmp eax, 0x7d00
jae 0xa8416d
cmp eax, 0x500
jb 0xa84168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa84075
cmp eax, 0x7f
ja 0xa84170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa84075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa8419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa84075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10