joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004e60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100283b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1003b050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000ecc1
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1000e2cf
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005ba0
Capabilities:
Create thread
Terminate process

Disassembly:
push 0
push 0
push 0
push 0x10005b40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006030
Capabilities:
Create thread
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003b050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10006089
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10006091
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100060a6
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], 0
test esi, esi
jne 0x1000611f
cmp dword [ebp - 0x14], esi
je 0x100060f9
cmp dword [0x10040898], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x100060ce
push 0
push 0
push 0
push 0x10005bd0
push 0
push 0
call esi
cmp dword [0x1004089c], 0
jne 0x1000610e
push 0
push 0
push 0
push fcn.10005c50
push 0
push 0
call esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ecb3
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x10005fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000ecb3
mov esp, ebp
pop ebp
ret
push 0x10039490
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call fcn.1001051b
int3
Function at 0x10007440
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002883b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x1003b050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10040974], 1
jne 0x100074e8
sub esp, 0xc
lea ecx, [ebp - 0x178]
push str.OpenGuard.txt
call fcn.10004120
mov edx, str._nHTTP_Server_connection_fail_
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.100055d0
lea ecx, [ebp - 0x174]
call fcn.100048b0
test eax, eax
jne 0x100074d6
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d60
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.100030e0
cmp dword [0x10040984], 1
jne 0x100075be
lea eax, [ebp - 0x18]
push eax
call fcn.100143df
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.100146cc
sub esp, 8
lea ecx, [ebp - 0xc8]
mov esi, eax
push 0x10034fb0
call fcn.10004120
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.100055d0
push esi
call fcn.100150f8
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.100055d0
mov edx, str.HTTP_Server_connection_fail_
lea ecx, [ebp - 0xc8]
call fcn.100055d0
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.100055d0
lea ecx, [ebp - 0xc4]
call fcn.100048b0
test eax, eax
jne 0x100075a6
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d60
push 2
push 0x10034fb0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.100030e0
mov eax, dword [0x10040978]
cmp eax, 1
je 0x100075ff
cmp eax, 3
je 0x100075ff
cmp eax, 4
je 0x100075ff
push 0
cmp eax, 2
jne 0x100075f9
push 0
push 0
push 0x100073e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10007410
jmp 0x100075e2
Function at 0x1000a880
Capabilities:
Check os version
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10028f20
mov eax, dword fs:[0]
push eax
sub esp, 0x4c8
mov eax, dword [0x1003b050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x4d4], esi
mov dword [ebp - 0x4c0], esi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4bc]
push eax
mov dword [ebp - 0x4c0], esi
mov dword [ebp - 0x4bc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x4b8], 6
jne 0x1000a917
cmp dword [ebp - 0x4b4], 1
jne 0x1000a917
mov dword [esi], 0
mov ecx, esi
mov dword [esi + 0x10], 0
push 0
mov dword [esi + 0x14], 0xf
push 0x1003498b
mov byte [esi], 0
call fcn.10004d00
jmp 0x1000aa9f
push 0
push 0
push 0
push 1
push str.LicenseDownloader
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x4c0], eax
test eax, eax
je 0x1000a8ed
cmp dword [edi + 0x14], 8
jb 0x1000a93c
mov edi, dword [edi]
push 0
push 0x80803000
push 0
push edi
push str.https:__openguard.com.tr_server_licenses.txt
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x4c8], eax
test eax, eax
je 0x1000a8ed
xor edi, edi
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x414], 0xf
mov byte [ebp - 0x428], 0
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 4], edi
push ecx
push 0x400
lea ecx, [ebp - 0x410]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1000aa5e
nop dword [eax]
nop dword [eax + eax]
mov ecx, dword [ebp - 0x4c4]
mov dword [ebp - 0x4cc], ecx
test ecx, ecx
je 0x1000aa58
mov esi, dword [ebp - 0x414]
mov eax, esi
sub eax, edi
push ecx
cmp ecx, eax
ja 0x1000aa0a
lea eax, [edi + ecx]
cmp esi, 0x10
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
add edi, eax
lea eax, [ebp - 0x410]
push eax
push edi
call fcn.10010590
mov eax, dword [ebp - 0x4cc]
add esp, 0xc
mov byte [edi + eax], 0
jmp 0x1000aa2a
lea eax, [ebp - 0x410]
mov byte [ebp - 0x4d0], 0
push eax
push dword [ebp - 0x4d0]
push ecx
lea ecx, [ebp - 0x428]
call fcn.10005450
lea eax, [ebp - 0x4c4]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x4c8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1000aa58
mov edi, dword [ebp - 0x418]
jmp 0x1000a9b0
mov esi, dword [ebp - 0x4d4]
push dword [ebp - 0x4c0]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 0x4c8]
call edi
movups xmm0, xmmword [ebp - 0x428]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x418]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ecb3
mov esp, ebp
pop ebp
ret
Function at 0x1000bce0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x10040a80
call fcn.10010b20
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x1000bd0b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x1000bd16
bts eax, 6
shr ecx, 1
test cl, 1
je 0x1000bd21
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000bd2c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x1000bd37
bts eax, 3
shr ecx, 1
test cl, 1
je 0x1000bd42
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000bd4d
bts eax, 1
test cl, 2
je 0x1000bd56
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x1000bdef
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x1000bde0
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x10040a80], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x1000bd00
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000be20
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1003b050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x10035ff0
push eax
or ebx, 0xffffffff
call fcn.10015b8f
add esp, 8
mov dword [ebp - 0x408], eax
test eax, eax
jne 0x1000be66
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ecb3
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop dword [eax + eax]
push eax
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.10014a9c
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x1000bebd
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10040a80]
sub edx, 1
jne 0x1000be95
mov eax, dword [ebp - 0x408]
cmp edi, 0x400
je 0x1000be70
push dword [ebp - 0x408]
call fcn.10013bfb
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.1000ecb3
mov esp, ebp
pop ebp
ret 4
Function at 0x1000db10
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029150
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x1003b050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10040974], 1
jne 0x1000dbc0
sub esp, 0xc
lea ecx, [ebp - 0xbc]
push str.OpenGuard.txt
call fcn.10004120
mov edx, str._nAKS_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.100055d0
mov edx, str.Thread_attack_
lea ecx, [ebp - 0xbc]
call fcn.100055d0
lea ecx, [ebp - 0xb8]
call fcn.100048b0
test eax, eax
jne 0x1000dbb5
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xbc]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d60
lea ecx, [ebp - 0xbc]
call fcn.100030e0
mov eax, dword [0x10040978]
cmp eax, 1
je 0x1000dc0c
cmp eax, 4
je 0x1000dc0c
push 0
cmp eax, 2
jne 0x1000dbfc
push 0
push 0
push 0x1000da70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x1000dbf6
push 0
push 0
push 0x10001f00
jmp 0x1000dbdf
push 0
push 0
push 0
push 0x1000dac0
jmp 0x1000dbdf

Function at 0x1000dee0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10007610
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov eax, dword [0x10040a1c]
cdq
sub eax, edx
mov dword [0x100416a8], 1
sar eax, 1
push eax
mov dword [0x10041688], 1
call ebx
mov eax, 0x10624dd3
inc esi
imul dword [0x10040a08]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jne 0x1000df02
push 0
push 0
push 0
push 0x10007610
push 0
push 0
call edi
jmp 0x1000df00

Function at 0x1001b27c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001b0f2

Function at 0x10022afb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10022778
Function at 0x40380b
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403834
cmp al, 0x22
je 0x40382c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403820
cmp byte [esi], 0x22
jne 0x40383e
inc esi
jmp 0x40383e
cmp al, 0x20
jle 0x40383e
inc esi
cmp byte [esi], 0x20
jg 0x403838
mov al, byte [esi]
test al, al
je 0x403848
cmp al, 0x20
jle 0x403831
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004038b6
push 0x405004
push section..data
call fcn.0040389c
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403878
movzx eax, word [ebp - 0x14]
jmp 0x40387b
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004038ce
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x408949
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.0040896b
mov eax, eax
sub ebx, 0xe80ca913
xor dword [esi], edi
inc esi
inc ebx
or eax, eax
cmp esi, ecx
jne fcn.00408949
mov eax, eax
inc ebx
ret
Function at 0x48af92
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x48b017
sbb si, 0x49d6
bt esi, esi
mov bl, dh
xchg dword [esp], ebp
sub esp, 0xc
jmp 0x48afff
inc bl
lea edi, [ecx + ebp]
neg dx
rdtsc
lea ebp, reloc.mscoree.dll__CorExeMain
bswap edi
jmp 0x48afd5
lea ecx, [eax*4]
push dword [esp + 0xc]
ret 0x10
rdtsc
rdtsc
mov al, byte [esp]
mov ebp, dword [esp]
mov ecx, 0xb818579e
xchg dword [esp], ebp
jmp 0x48afeb

Function at 0x491d36
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x4cc607cb
jmp 0x4923c6
add edx, 0xbe001a04
jmp 0x492427
mov ebx, ebp
dec edx
jg 0x4916f1
mov dh, 0x75
jmp 0x4916db
lea ecx, [ebx + edi]
bsf ax, ax
pushal
jmp 0x491733
mov dh, 0x75
lea ecx, [ebx + edi]
bsf ax, ax
pushal
lea ecx, [eax*4]
pop word [esp + 0x16]
jmp 0x4917ad
lea ecx, [eax*4]
call fcn.0049171d
inc ebx
invalid
rol cx, 7
sub esp, 0x10
mov ch, 6
pop edx
push dword [esp + 0x14]
ret 0x18
jmp 0x491766
mov word [esp + 0xc], ax
mov eax, 0x5ed013cf
lea eax, [esi*4]
mov word [esp + 6], bx
jmp 0x4917f4
lea ecx, [ebx + esi]
mov ax, word [esp]
cmp al, dh
bts dx, dx
jmp 0x491816
lea esp, [esp + 2]
ror ebp, 0
btr dx, di
jae 0x4917de
jb 0x49180b
adc al, 0x88
push ds
jns 0x491790
dec ecx
movsd dword es:[edi], dword [esi]
aam 0x8d
or al, 0x33
lea ecx, [ebx + esi]
mov ax, word [esp]
cmp al, dh
jmp 0x491878
lea esp, [esp + 0x1c]
inc ebp
mov edx, dword [esp]
rdtsc
mov ah, 0xd9
jmp 0x49185c
mov ah, 0x18
jmp 0x491894
mov ax, word [esp]
sub ecx, ecx
jge 0x491846
mov ah, 0x18
jmp 0x491894
bts dx, dx
jmp 0x491816
mov dh, 0xc9
jmp 0x492256
not ebp
mov al, dl
bsr ecx, esi
jbe 0x49187e
ja 0x492852
add dword [edx + ebx*4], reloc.mscoree.dll__CorExeMain
or al, 0xce
xor dword [eax], esi
xor ebp, dword [edx]
inc ebp
inc edx
dec ebx
dec ebx
inc edx
sal edi, 1
inc edi
inc edx
mov ebx, 0xdc424abc
lahf
dec edx
inc edx
out dx, eax
dec byte [ecx + 0x42]
inc edi
jmp 0x49190e
pop ss
pop es
dec eax
inc edx
test ecx, 0x76bc424e
dec esi
inc edx
invalid
and edx, edi
jmp 0x491d02
bsf edx, esi
jl 0x491cdf
and edx, edi
jmp 0x491d02
add ebp, dword [esi]
mov dl, 0x6d
mov dl, 0xbd
call 0x491d36
arpl cx, bp
jns 0x491d29
jmp 0x491d3e
rcr edx, cl
bt edx, eax
jmp 0x491d98
push ecx
shl dword [eax - reloc.mscoree.dll__CorExeMain], 0x40
daa
rcl byte [esi], cl
ror dword [edx - 0x15], cl
call 0x9d3e8327
outsd dx, dword [esi]
rcr byte [ebx], cl
xchg esi, eax
add al, 0x63
sahf
sub eax, 0xfe9b0b97
or eax, 0x66392ec9
neg edx
sbb edx, dword [esi + 0x2d9e6304]
xchg edi, eax
or ebx, dword [ebx + reloc.mscoree.dll__CorExeMain]
cmp dword [esi - 9], esp
invalid
rcr edx, cl
bt edx, eax
xor ebp, 0x2e3a6f38
bswap edx
jmp 0x491cf5
xchg edx, eax
xchg edx, eax
mov cl, 0xea
add ax, bp
jl 0x491d93
jge 0x491d19
Function at 0x4bf263
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test edi, edi
jmp 0x4c02f0
xchg dh, bl
cmp ebx, 0x24305b79
jmp 0x4bf1c5
movzx edx, byte [eax + 1]
bts bx, bp
jmp 0x4bf236
lea esp, [esp + 0xc]
lea eax, [esi + 0x1a]
jmp 0x47df66
jne 0x47df1f
cpuid
sub esp, 0xc
xor ecx, ecx
lea edx, reloc.mscoree.dll__CorExeMain
jmp 0x4bf1db
or edx, ebx
jmp 0x4bf23f
shl edx, 8
jmp 0x4bf209
push edi
mov edi, eax
movzx ebx, byte [edi]
pop edi
jmp 0x4bf21f
movzx ebx, byte [eax - 1]
sub esp, 0x1a
lea esp, [esp + 2]
shl edx, 8
jmp 0x4bf27f
lea esp, [esp + 8]
jmp 0x4bf1f4
movzx ebx, byte [eax - 2]
jmp 0x4bf2a5
or edx, ebx
xor bh, al
lea ebx, [ebx + 0x14]
lea ebx, [ebx*4]
jmp 0x4bf269
pop word [esp + 0xe]
add esp, 5
lea esp, [esp + 1]
jmp 0x4c03d1
shl edx, 8
or edx, ebx
sub esp, 0x14
clc
jmp 0x4bf28f
lea eax, [ebp - 0x40]
jmp 0x4c030a
cmp ecx, 0x10
jb 0x47df66
not cx
lea ecx, [esi + 8]
jmp 0x4c02c2
xor eax, eax
jmp 0x47df1f
jne 0x47df4b
mov bx, 0xdd85
jmp 0x4c031f
call fcn.0049a402
lea eax, [eax + esi]
neg ax
mov al, byte [esp]
mov eax, 0xad3caf39
jmp 0x4c02e9
pop ebx
jmp 0x47df35
add eax, 4
sub esp, 0x19
push word [esp + 0xd]
lea esp, [esp + 3]
lea esp, [esp + 0x18]
jmp 0x4c02d8
mov dword [ebp + ecx*4 - 0x40], edx
lea esp, [esp + 0x24]
inc ecx
jmp 0x4c0342
Function at 0x8e11d4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e11da
pop ebp
sub ebp, 6
sub ebp, 0x4e11d4
jmp 0x8e1238
jmp 0x8e1241
mov eax, 0x4e11d4
add eax, ebp
add eax, 0x93
mov ecx, 0x64c
mov edx, 0xba4ef600
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e1258
jmp 0x8e126b
push 0x40
push 0x1000
push 0x2ccc00
xor eax, 0x4a1538e8
xor eax, 0x4a1538e8
xor eax, eax
push eax
call dword [ebp + 0x44513c]
push eax
mov ecx, ebp
mov ecx, dword [ecx + 0x3c]
add ecx, 0xf8
add ecx, ebp
mov eax, 6
mov edx, 0x28
mul edx
add ecx, eax
mov eax, dword [ecx + 0xc]
add eax, ebp
push eax
push 0x9374f
push 0x44da85
add dword [esp], ebp
push 0
call fcn.008e12d0
jmp 0x8e12f8
mov ecx, dword [esp + 4]
push 0x9374f
push 0x44da85
add dword [esp], ebp
push ecx
call fcn.008e1317
jmp 0x8e1564
pop edi
pop esi
jmp 0x8e156f
mov eax, 0x4e11d4
add eax, ebp
add eax, 0x3c1
mov ecx, 0x31e
mov edx, 0x7ad75109
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e1586
jmp 0x8e1599
pop edi
pop esi
pop esi
cmp cl, cl
add byte [edi + 0x9090859], 0xc8
loopne 0x8e15b2
sti
mov byte [0x5d878256], al
or byte [ecx], cl
or eax, ecx
loopne 0x8e15be
or edi, ebx
sti
lodsb al, byte [esi]
push esi
push edi
adc byte [edi + 0x9090935], 0x5a
push es
mov dh, 0x55
cmp cl, byte [edi]
push ebx
mov bl, cl
int1
or dword [ecx], ecx
or dword [edx], ecx
fisttp word [eax + 0x90909f2]
or dword [esi], eax
or dword [ecx], ecx
push es
lea edx, [esi]
or dword [ecx], ecx
or dword [edi + 0x5e], ebx
mov ds, eax
sbb byte [eax + 0x19], 0x8e
fmul dword [edx]
jae 0x8e15e9
or bh, byte [ebx + 0x1d]
sti
lodsd eax, dword [esi]
push esi
push edi
mov bl, cl
and dword [ecx], ecx
or dword [ecx], ecx
inc edx
loopne 0x8e15d0
div dh
mul byte [ecx + 9]
dec ecx
or dword [ecx], ecx
popal
or ebp, eax
and eax, 0x9cf65f09
dec ecx
pop eax
dec ebp
or dword [esi - 0x7d017109], ecx
jle 0x8e1644
invalid
mov al, ah
add dword [ecx], ecx
or dword [ecx], ecx
mov al, dh
or dword [ecx], ecx
or dword [ecx], ecx
push es
invalid

Function at 0x8e12d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0x8e12e8
pop ebp
ret 0xc
Function at 0x8e13a5
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x8e13d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8e13b4
add dl, dl
jne 0x8e13e9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8e1459
xor eax, eax
add dl, dl
jne 0x8e13fe
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8e152e
add dl, dl
jne 0x8e1411
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8e1420
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8e142f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8e143e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8e144c
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8e13c9
mov eax, 1
add dl, dl
jne 0x8e146b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8e147a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8e145e
sub eax, ebx
mov ebx, 1
jne 0x8e14c1
mov ecx, 1
add dl, dl
jne 0x8e149f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8e14ae
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8e1492
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8e13c9
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8e14dc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8e14eb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8e14cf
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8e13c9
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8e1556
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8e13c9
pop ebp
sub edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8