joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1009b720
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
Function at 0x1009b720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1009b72f
pop dword [ebp - 0x10]
mov eax, 0x1009b72f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x860cd0b8
add dword [ebp - 0x20], 0xc8457493
mov dword [ebp - 0x1c], 0x20d0e848
sub dword [ebp - 0x1c], 0xee9d9c03
mov dword [ebp - 0x18], 0x9a09a4bc
sub dword [ebp - 0x18], 0x4dbd608e
mov dword [ebp - 0x14], 0x84af186e
add dword [ebp - 0x14], 0x7b50e792
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x3e782689
sub dword [ebp - 0x20], 0xca05bd33
mov dword [ebp - 0x1c], 0x360e11f9
sub dword [ebp - 0x1c], 0xf4a1b084
mov dword [ebp - 0x18], 0x60df23fa
sub dword [ebp - 0x18], 0xfd6fb78e
mov dword [ebp - 0x14], 0x392038b0
add dword [ebp - 0x14], 0xc6dfc750
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x803774e0
sub eax, 0x702c0444
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x5f9f0
push 0
call eax
mov ecx, 0x4f6e
xor edx, edx
add edx, eax
mov esi, 0x14adf389
sub esi, 0x49ebf89
add esi, dword [ebp - 0x10]
mov ebx, 0xafafca72
add ebx, 0xc44bc9cb
mov edi, dword [esi]
add dword [ebp - 0xc], eax
sub edi, ebx
sub dword [ebp - 4], esi
mov dword [edx], edi
xor dword [ebp - 4], 0xd9de40b3
add edx, 0x91f8edcc
add edx, 0x6e071238
add esi, 0xd12e5acc
add esi, 0x2ed1a538
loop 0x1009b843
add eax, 0x1308b
xor ebx, ebx
add ebx, eax
add eax, 0xf0bbe035
add eax, 0xf441fd0
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409b38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x409b47
pop dword [ebp - 0x4c]
mov eax, 0xe88fc65b
add eax, 0x17b0d4ec
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xaeea44dc
sub dword [ebp - 0x5c], 0x6097ff91
mov dword [ebp - 0x58], 0x4b88c96b
add dword [ebp - 0x58], 0xe6aa82da
mov dword [ebp - 0x54], 0x61c76abc
sub dword [ebp - 0x54], 0x157b268e
mov dword [ebp - 0x50], 0xa760da55
sub dword [ebp - 0x50], 0xa760da55
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xccfaf034
add eax, 0x3345e020
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x7fc8173c
sub dword [ebp - 0x5c], 0xb55ade6
mov dword [ebp - 0x58], 0x2b363973
sub dword [ebp - 0x58], 0xe9c9d7fe
mov dword [ebp - 0x54], 0x2cad766e
sub dword [ebp - 0x54], 0xc93e0a02
mov dword [ebp - 0x50], 0xff732b9
add dword [ebp - 0x50], 0xf008cd47
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x8d007536
sub eax, 0x8cbfa4ea
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38e0a
push 0
call eax
mov ecx, 0x2b618f14
sub ecx, 0x2b6149bd
xor esi, esi
add esi, eax
mov edx, 0x659ca51c
add edx, 0x9aa50ae4
add edx, dword [ebp - 0x4c]
mov ebx, 0x8969d5b6
sub ebx, 0x94487a0f
add dword [ebp - 0x30], 0xa37d8c4b
mov edi, dword [edx]
xor dword [ebp - 0x18], 0x2fe242a
add edi, ebx
xor dword [ebp - 0x1c], eax
mov dword [esi], edi
add dword [ebp - 4], 0x4c1f3cd7
add esi, 0xb6532d4c
add esi, 0x49acd2b8
add edx, 0x67e82897
add edx, 0x9817d76d
loop 0x409c6b
add eax, 0x1082f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0xa4e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa4e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa4e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4e06a
add dl, dl
jne 0xa4e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4e0dc
xor eax, eax
add dl, dl
jne 0xa4e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4e17d
add dl, dl
jne 0xa4e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa4e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa4e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa4e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa4e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa4e075
mov eax, 1
add dl, dl
jne 0xa4e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa4e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa4e0e1
sub eax, ebx
mov ebx, 1
jne 0xa4e128
mov ecx, 1
add dl, dl
jne 0xa4e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa4e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa4e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa4e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa4e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa4e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa4e136
cmp eax, 0x7d00
jae 0xa4e16d
cmp eax, 0x500
jb 0xa4e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa4e075
cmp eax, 0x7f
ja 0xa4e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa4e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa4e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa4e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x8c7058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008c71a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8c707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c706a
add dl, dl
jne 0x8c7089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c70dc
xor eax, eax
add dl, dl
jne 0x8c7096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c717d
add dl, dl
jne 0x8c70a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c70b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c70bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c70c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8c70d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8c7075
mov eax, 1
add dl, dl
jne 0x8c70ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c70f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c70e1
sub eax, ebx
mov ebx, 1
jne 0x8c7128
mov ecx, 1
add dl, dl
jne 0x8c710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c7119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c7105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c7075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8c713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c7136
cmp eax, 0x7d00
jae 0x8c716d
cmp eax, 0x500
jb 0x8c7168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c7075
cmp eax, 0x7f
ja 0x8c7170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c7075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8c719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8c7075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0xa23ac0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xa23aca
pushal
call 0xa23ad0
pop ebp
sub ebp, 0x10
sub ebp, 0x623ac0
jmp 0xa23ae6
mov eax, 0x623ac0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5fd
mov edx, 0x2155f1ac
xor byte [eax], dl
inc eax
dec ecx
jne 0xa23afd
jmp 0xa23b10
daa
popal
daa
and eax, 0xacacac90
sub eax, 0xacac546d
lodsb al, byte [esi]
scasd eax, dword es:[edi]
popal
adc al, 0xa9
lodsb al, byte [esi]
lodsb al, byte [esi]
lodsb al, byte [esi]
push ss
test byte [esp + ebp*4 - 0x50b1a454], ch
daa
sub eax, 0xacacaca0
scasd eax, dword es:[edi]
imul edi, esp, 0xd07cc4fc
mov byte [0x115cc4ac], al
jmp [ebp + ebp*4 + 0x30c48880]
Function at 0xa8e940
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0xaf897c]
mov edi, eax
add esp, 4
test edi, edi
jne 0xa8e973
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x10]
jbe 0xa8e9ba
mov eax, dword [esi]
push ecx
call eax
push dword [ebp + 8]
mov eax, dword [esi + 4]
push ebx
push dword [edi + 4]
call eax
mov ebx, dword [edi + 8]
add ebx, dword [esi + 0xc]
push dword [edi + 4]
mov eax, dword [esi + 8]
push ebx
mov dword [ebp - 8], ebx
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 8], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 8]
add esp, 8
xor ebx, ebx
test eax, eax
je 0xa8ea13
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 8], 1
jne 0xa8e9d8
mov ebx, dword [ebp - 0xc]
cmp ebx, dword [esi + 0x10]
jae 0xa8ea47
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0xac523b
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0xac523a
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0xa8ea20
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa8f560
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push esi
push edi
push 0xf0000040
mov esi, ecx
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa8f59b
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret

Function at 0xaa917a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00aa8e3a

Function at 0xab0499
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00ab0318

Function at 0x10001336
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003018]
jne 0x10001340
repz ret
jmp fcn.10001813
Function at 0x9a4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009a41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9a407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9a406a
add dl, dl
jne 0x9a4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9a40dc
xor eax, eax
add dl, dl
jne 0x9a4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9a417d
add dl, dl
jne 0x9a40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9a40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9a4075
mov eax, 1
add dl, dl
jne 0x9a40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9a40e1
sub eax, ebx
mov ebx, 1
jne 0x9a4128
mov ecx, 1
add dl, dl
jne 0x9a410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9a4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9a4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9a4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9a413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9a414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9a4136
cmp eax, 0x7d00
jae 0x9a416d
cmp eax, 0x500
jb 0x9a4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9a4075
cmp eax, 0x7f
ja 0x9a4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9a4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9a419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9a4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401bd7
pop dword [ebp - 0x40]
mov eax, 0x23dd73df
add eax, 0xdc62a7f8
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xf92ed2a9
sub dword [ebp - 0x50], 0xaadc8d5e
mov dword [ebp - 0x4c], 0xf48d1c2f
add dword [ebp - 0x4c], 0x3da63016
mov dword [ebp - 0x48], 0x5c3620e9
add dword [ebp - 0x48], 0xf0162345
mov dword [ebp - 0x44], 0x421c9b40
sub dword [ebp - 0x44], 0x421c9b40
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xd788cbbc
add dword [ebp - 0x50], 0x9ce99d9a
mov dword [ebp - 0x4c], 0xaab3dc5d
add dword [ebp - 0x4c], 0x96b88518
mov dword [ebp - 0x48], 0x6284d21f
sub dword [ebp - 0x48], 0xff1565b3
mov dword [ebp - 0x44], 0x89c9e901
add dword [ebp - 0x44], 0x763616ff
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x35de8a5f
sub eax, 0x359e195f
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x35a97
push 0
call eax
mov ecx, 0xf0ec7920
add ecx, 0xf13cb39
xor edx, edx
add edx, eax
mov esi, 0xc467d9ec
add esi, 0x3bd92614
add esi, dword [ebp - 0x40]
mov ebx, 0xcd978d70
add ebx, 0x54d89e90
xor dword [ebp - 0x1c], eax
mov edi, dword [esi]
sub dword [ebp - 0x30], ecx
sub edi, ebx
add dword [ebp - 0x24], 0x839fce62
mov dword [edx], edi
xor dword [ebp - 0x38], 0xc3f70cd5
add edx, 0xa3d8a490
sub edx, 0xa3d8a48c
add esi, 0xa1cf71a7
add esi, 0x5e308e5d
loop 0x401cf6
add eax, 0x3c8361f
add eax, 0xfc38ce18
mov ebx, eax
add eax, 0xb3c1188f
add eax, 0x4c3ee776
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x851058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008511a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x85107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85106a
add dl, dl
jne 0x851089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8510dc
xor eax, eax
add dl, dl
jne 0x851096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85117d
add dl, dl
jne 0x8510a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8510b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8510bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8510c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8510d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x851075
mov eax, 1
add dl, dl
jne 0x8510ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8510f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8510e1
sub eax, ebx
mov ebx, 1
jne 0x851128
mov ecx, 1
add dl, dl
jne 0x85110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x851119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x851105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x851075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x85113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x851136
cmp eax, 0x7d00
jae 0x85116d
cmp eax, 0x500
jb 0x851168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x851075
cmp eax, 0x7f
ja 0x851170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x851075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x85119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x851075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40b260
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46963b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045e4e4
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b2e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045c407
mov eax, dword [eax]
push 0x7021c0
push eax
call fcn.0044f324
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045e76f
test bl, bl
je 0x40b2e2
push 0x7021c0
lea ecx, [esp + 0xc]
call fcn.0045eaff
push 0x705d10
lea ecx, [esp + 0xc]
call fcn.0045eaff
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b31e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045e76f
jmp 0x40b3e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40b3a2
lea edx, [esp + 0x7c]
push 0x705d0c
push edx
call fcn.0044f324
add esp, 8
test eax, eax
je 0x40b3a2
lea eax, [esp + 0x7c]
push 0x705d08
push eax
call fcn.0044f324
add esp, 8
test eax, eax
je 0x40b3a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b332
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045e76f
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40bbe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40bc42
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc