joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfd8990
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0xfd89f5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0xfd89b0
mov eax, 0x270
jmp 0xfd8acf
cmp eax, 0x4e0
jb 0xfd8acf
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0xfd8a10
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0xfd8a60
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret
Function at 0xfeb020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x20], 0xbf14bd53
mov dword [esp + 0x24], 0x832d8133
mov dword [esp + 0x28], 0x8786852a
mov eax, 0xff5cd55c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xa32ac4]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xe5
and ecx, 0x1a
sub ecx, edx
add cl, 5
mov byte [esp + eax + 0xa32ac4], cl
inc eax
cmp eax, 0xff5cd568
jne 0xfeb060
mov dword [esp + 0x48], 0x61f47fd6
mov dword [esp + 0x4c], 0x65f463f6
mov dword [esp + 0x50], 0x698767bc
mov dword [esp + 0x54], 0x6dc06b85
mov dword [esp + 0x58], 0x51f36fc1
mov dword [esp + 0x5c], 0x55f853f3
mov dword [esp + 0x60], 0x59f757fe
mov dword [esp + 0x64], 0x5dc85bc9
mov dword [esp + 0x68], 0x41405f84
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 0x48]
add cl, 0x90
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 0x24
jne 0xfeb0e0
movzx ecx, word [esp + 0x48]
lea eax, [esp + 0x15c]
test cx, cx
je 0xfeb121
lea edx, [esp + 0x4a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xfeb110
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0xfeb151
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xfeb140
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0xfeb181
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xfeb170
mov word [eax], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x6f6c6c82
mov byte [esp + 0x4c], 0x8c
mov eax, 0xc8
mov ecx, 0xf6d85a37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x80]
mov edi, eax
xor edi, ecx
and edi, edx
xor edi, ecx
mov edx, 0xbe
sub edx, edi
lea esi, [edi + 0x493d2e41]
or esi, 1
sub esi, edi
lea ebx, [esi - 0x493d2e41]
neg esi
and esi, 2
mov edi, ebx
and edi, 0xfd
imul edi, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
xor edx, 1
add edx, edi
add edx, ebx
mov byte [esp + eax - 0x80], dl
inc eax
dec ecx
cmp eax, 0xcd
jne 0xfeb1b0
movzx eax, byte [esp + 0x48]
test al, al
je 0xfeb22d
lea ecx, [esp + 0x49]
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0xfeb220
jmp 0xfeb231
mov edi, dword [esp + 4]
mov byte [edi], 0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x38]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.00fdae40
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x1013794]
mov ecx, 0xae6ce794
xor ecx, dword [0x101379c]
add eax, ecx
inc eax
jmp eax
Function at 0x12ee060
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov dword [esp], 0x11102ffe
mov eax, esp
mov ecx, 0x21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x225a3100]
or esi, edx
and edx, ecx
lea edi, [esi + esi]
not edi
add edi, esi
or edi, edx
add edi, 0xed2e790f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x1d
jne 0x12ee080
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
ret

Function at 0x12eee60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x12eee80
mov eax, dword [esp]
mov edx, dword [0x101965c]
test edx, edx
je 0x12eeef8
xor ebx, ebx
mov ecx, dword [0x1019660]
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x12eeed0
inc ebx
cmp edx, ebx
jne 0x12eeec0
jmp 0x12eeef8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x12eeef8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x1019664]
call fcn.012eca80
add esp, 0x20
test edi, edi
je 0x12eef02
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x12eef0e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12ef1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x12ef1f0
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 4], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x698232ac]
xor ecx, eax
mov ebx, ecx
and ebx, 0x5f
add ebx, ebx
xor ecx, 0xa0
sub ebx, ecx
mov byte [esp + eax + 0x698232ac], bl
inc eax
cmp eax, 0x967dcd58
jne 0x12ef270
mov eax, dword [esp]
mov edi, dword [0x101965c]
test edi, edi
je 0x12ef2e5
xor ebx, ebx
mov ebp, dword [0x1019660]
nop
nop
nop
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0x12ef2c1
inc ebx
cmp edi, ebx
jne 0x12ef2b0
jmp 0x12ef2e5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x12ef2e5
lea eax, [esp + 0xc]
push esi
push eax
push edx
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x1019664]
call fcn.012eca80
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1307ede
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
pushal
call 0xba52e837
pop edx
xor dword [ebp + 0x72], 0x412cbb3
add byte [eax], al
add bh, bh
dec dword [ebx + 0x85d]
dec ebp
cmp al, byte [eax]
add byte [eax], al
mov ecx, dword [ebp - 4]
rol ebx, 1
clc
jns 0x1307eee
jne 0x1307f5b
and dl, byte [edx]
loop 0x1307f87
add byte [eax], 0xf0
invalid
jo 0x1307f5d
add byte [ebp + 0x2d1956bd], cl
adc bh, dh
cmova ecx, dword [ecx + 0x75]
cli
mov eax, 0x48692121
mov edx, 0xf0055000
sub edx, 0xf0000000
lea eax, [ebp + 0x122d1adc]
push eax
push dword fs:[0]
mov dword fs:[0], esp
add byte [ecx + ecx*4 + 0x25], ah
add byte [eax], al
add byte [eax], al
call 0x1307f94
pop eax
jmp 0x1307fa9
cmpsb byte [esi], byte es:[edi]
mov al, byte [0x8864f746]
lodsb al, byte [esi]
or ecx, dword [edi - 0x56]
je 0x130801b
mov edi, 0x810fef36
add al, byte [eax]
add byte [eax], al
jno 0x1307fb1
mov ebx, esi
sub eax, edx
mov bh, 0x87
mov ebx, edi
and eax, 0xfffff000
sbb bx, 0x5a53
call 0x1307fcd
shr byte [esi], 0xb5
dec ecx
and ah, bl
pop eax
pushal
call 0x1307fe6
jp 0x1307f9a
cld
pushfd
into
push ds
and al, 0x1c
inc ecx
xchg esi, eax
aaa
add dword [edx + 0x4591d345], 0x8b0f5f52
add byte [eax], al
add byte [eax], al
popal
pop ebx
mov ecx, edx
xor edi, edi
cmp word [eax], 0x5a4d
jne 0x1308008
movzx edx, word [eax + 0x3c]
add edx, eax
cmp dword [edx], 0x4550
je 0x1308010
sub eax, 0x1000
inc edi
jmp 0x1307ff3
mov dword [ebp + 0x122d0935], eax
pop dword fs:[0]
add byte [eax], al
add esp, 4
lea edx, [ebp + 0x122d1aef]
push edx
push dword fs:[0]
mov dword fs:[0], esp
mov edx, eax
add eax, ecx
sub eax, 0x1000
mov esi, 0xdf9d0001
in eax, 0xa9
je 0x1308073
mov esi, 0x5405c
test esi, esi
jne 0x130805b
mov esi, dword [edx + 0x3c]
add esi, edx
mov esi, dword [esi + 0x80]
add esi, edx
mov esi, dword [esi + 0x10]
add esi, edx
mov ecx, esi
add ecx, 8
mov dword [ebp + 0x122d174d], ecx
mov esi, dword [esi]
mov ecx, esi
jmp 0x130807f
lea esi, [eax + 0xc]
mov dword [ebp + 0x122d174d], esi
mov esi, dword [eax + 4]
and esi, 0xffff0000
cmp esi, 0x80000000
jbe 0x13080be
mov esi, 1
test esi, esi
je 0x13080bb
mov esi, ecx
cmp esi, 0xbff00000
jb 0x13080b0
cmp esi, 0xbfff0000
ja 0x13080b0
and esi, 0xffff0000
jmp 0x13080b9
mov esi, dword [esi + 1]
and esi, 0xffff0000
jmp 0x13080be
mov esi, dword [eax + 0x1c]
xor eax, eax
cmp eax, 0x32
je 0x13080e4
cmp word [esi], 0x5a4d
je 0x13080d5
sub esi, 0x10000
inc eax
jmp 0x13080c0
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
je 0x1308126
jmp 0x13080cc
pop dword fs:[0]
add esp, 4
popal
ret
xchg esi, eax
pop dword fs:[0]
add esp, 4
jns 0x1308142
jmp 0x1308142
mov ebx, 0x126cddfe
mov cx, ds
mov bx, 0x9db3
and cl, 4
push eax
movsx ebx, dx
pop ebx
test cl, cl
jne 0x1308182
mov bx, 0x9f46
mov dword [ebp + 0x122d1555], 1
movsx ebx, cx
jmp 0x13081b7
mov cx, ds
mov bh, ch
cmp cx, 0x1f
jne 0x13081ac
clc
mov dword [ebp + 0x122d1555], 1
jae 0x13081a4
mov bh, 0x9c
jmp 0x13081b7
mov dword [ebp + 0x122d1555], 0
cmc
mov dword [ebp + 0x122d00c1], eax
or bx, 0x2a68
mov ebx, 0xb8248f2
mov dword [ebp + 0x122d0a45], eax
pushal
call fcn.013081e4
jmp 0xc26ccf46
Function at 0x1307fe6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
pushal
call 0xba52e837
pop edx
xor dword [ebp + 0x72], 0x412cbb3
add byte [eax], al
add bh, bh
dec dword [ebx + 0x85d]
dec ebp
cmp al, byte [eax]
add byte [eax], al
mov ecx, dword [ebp - 4]
rol ebx, 1
clc
jns 0x1307eee
jne 0x1307f5b
and dl, byte [edx]
loop 0x1307f87
add byte [eax], 0xf0
invalid
jo 0x1307f5d
add byte [ebp + 0x2d1956bd], cl
adc bh, dh
cmova ecx, dword [ecx + 0x75]
cli
mov eax, 0x48692121
mov edx, 0xf0055000
sub edx, 0xf0000000
lea eax, [ebp + 0x122d1adc]
push eax
push dword fs:[0]
mov dword fs:[0], esp
add byte [ecx + ecx*4 + 0x25], ah
add byte [eax], al
add byte [eax], al
call 0x1307f94
pop eax
jmp 0x1307fa9
cmpsb byte [esi], byte es:[edi]
mov al, byte [0x8864f746]
lodsb al, byte [esi]
or ecx, dword [edi - 0x56]
je 0x130801b
mov edi, 0x810fef36
add al, byte [eax]
add byte [eax], al
jno 0x1307fb1
mov ebx, esi
sub eax, edx
mov bh, 0x87
mov ebx, edi
and eax, 0xfffff000
sbb bx, 0x5a53
call 0x1307fcd
shr byte [esi], 0xb5
dec ecx
and ah, bl
pop eax
pushal
call 0x1307fe6
jp 0x1307f9a
cld
pushfd
into
push ds
and al, 0x1c
inc ecx
xchg esi, eax
aaa
add dword [edx + 0x4591d345], 0x8b0f5f52
add byte [eax], al
add byte [eax], al
popal
pop ebx
mov ecx, edx
xor edi, edi
cmp word [eax], 0x5a4d
jne 0x1308008
movzx edx, word [eax + 0x3c]
add edx, eax
cmp dword [edx], 0x4550
je 0x1308010
sub eax, 0x1000
inc edi
jmp 0x1307ff3
mov dword [ebp + 0x122d0935], eax
pop dword fs:[0]
add byte [eax], al
add esp, 4
lea edx, [ebp + 0x122d1aef]
push edx
push dword fs:[0]
mov dword fs:[0], esp
mov edx, eax
add eax, ecx
sub eax, 0x1000
mov esi, 0xdf9d0001
in eax, 0xa9
je 0x1308073
mov esi, 0x5405c
test esi, esi
jne 0x130805b
mov esi, dword [edx + 0x3c]
add esi, edx
mov esi, dword [esi + 0x80]
add esi, edx
mov esi, dword [esi + 0x10]
add esi, edx
mov ecx, esi
add ecx, 8
mov dword [ebp + 0x122d174d], ecx
mov esi, dword [esi]
mov ecx, esi
jmp 0x130807f
lea esi, [eax + 0xc]
mov dword [ebp + 0x122d174d], esi
mov esi, dword [eax + 4]
and esi, 0xffff0000
cmp esi, 0x80000000
jbe 0x13080be
mov esi, 1
test esi, esi
je 0x13080bb
mov esi, ecx
cmp esi, 0xbff00000
jb 0x13080b0
cmp esi, 0xbfff0000
ja 0x13080b0
and esi, 0xffff0000
jmp 0x13080b9
mov esi, dword [esi + 1]
and esi, 0xffff0000
jmp 0x13080be
mov esi, dword [eax + 0x1c]
xor eax, eax
cmp eax, 0x32
je 0x13080e4
cmp word [esi], 0x5a4d
je 0x13080d5
sub esi, 0x10000
inc eax
jmp 0x13080c0
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
je 0x1308126
jmp 0x13080cc
pop dword fs:[0]
add esp, 4
popal
ret
xchg esi, eax
pop dword fs:[0]
add esp, 4
jns 0x1308142
jmp 0x1308142
mov ebx, 0x126cddfe
mov cx, ds
mov bx, 0x9db3
and cl, 4
push eax
movsx ebx, dx
pop ebx
test cl, cl
jne 0x1308182
mov bx, 0x9f46
mov dword [ebp + 0x122d1555], 1
movsx ebx, cx
jmp 0x13081b7
mov cx, ds
mov bh, ch
cmp cx, 0x1f
jne 0x13081ac
clc
mov dword [ebp + 0x122d1555], 1
jae 0x13081a4
mov bh, 0x9c
jmp 0x13081b7
mov dword [ebp + 0x122d1555], 0
cmc
mov dword [ebp + 0x122d00c1], eax
or bx, 0x2a68
mov ebx, 0xb8248f2
mov dword [ebp + 0x122d0a45], eax
pushal
call fcn.013081e4
jmp 0xc26ccf46
Function at 0x401120
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 4
push 0x40
push 0x3000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esp, ebp
pop ebp
ret
Function at 0x405870
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x405896
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4058f0
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x4058b7
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x4058e1
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x4058d7
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x4058df
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x4058ae
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x40cb44], ecx
jmp 0x40588d
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x541b3fa7
nop
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4b834098
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0xfad058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00fad1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xfad07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfad06a
add dl, dl
jne 0xfad089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfad0dc
xor eax, eax
add dl, dl
jne 0xfad096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfad17d
add dl, dl
jne 0xfad0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfad0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfad0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfad0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xfad0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xfad075
mov eax, 1
add dl, dl
jne 0xfad0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfad0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfad0e1
sub eax, ebx
mov ebx, 1
jne 0xfad128
mov ecx, 1
add dl, dl
jne 0xfad10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfad119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfad105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfad075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xfad13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfad14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfad136
cmp eax, 0x7d00
jae 0xfad16d
cmp eax, 0x500
jb 0xfad168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfad075
cmp eax, 0x7f
ja 0xfad170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfad075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xfad19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xfad075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4223ca
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x528c60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041fc10
mov dword [ebp - 0x14], eax
cmp dword [0x52a798], edi
jne 0x4224bb
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x422448
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42259b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42259b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42259b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x52a798], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x52a79c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x52a7a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x52a7a8], eax
test eax, eax
je 0x4224b8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x52a7a4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4224e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4224d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4224f5
push 4
pop eax
jmp 0x42259d
cmp dword [ebp - 0x14], edi
je 0x4224f5
push dword [0x52a798]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4224da
mov eax, dword [0x52a7a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x422553
cmp dword [0x52a7a8], esi
je 0x422553
push eax
call ebx
push dword [0x52a7a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x422553
test eax, eax
je 0x422553
call ecx
test eax, eax
je 0x422548
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x422548
test byte [ebp - 8], 1
jne 0x422553
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x422583
mov eax, dword [0x52a79c]
cmp eax, esi
je 0x422580
push eax
call ebx
test eax, eax
je 0x422580
call eax
mov edi, eax
test edi, edi
je 0x422580
mov eax, dword [0x52a7a0]
cmp eax, esi
je 0x422580
push eax
call ebx
test eax, eax
je 0x422580
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x52a798]
call ebx
test eax, eax
je 0x42259b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x42259d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420bc0
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0xeb133da
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x7ca90b39
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4032f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x495c2c]
mov ecx, dword [0x4956bc]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403369
mov edi, dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
mov esi, ecx
mov dword [ebp - 4], eax
cmp dword [0x495c2c], 0x959
jne 0x40335a
push 0
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push esi
call fcn.004030b0
add esi, 8
sub dword [ebp - 4], 1
jne 0x40331a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret