joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10226090
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 4]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], eax
mov eax, edx
ret

Function at 0x102260c0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x102260d9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x102264b0
Capabilities:
Get mac address on windows

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
call sub.iphlpapi.dll_GetAdaptersInfo
mov eax, dword [esp]
test eax, eax
jbe 0x10226579
push esi
push edi
push eax
call fcn.1022ef86
mov ecx, dword [esp + 0xc]
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test esi, esi
mov eax, 1
je 0x1022656e
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x10226526
mov esi, dword [esi]
inc eax
test esi, esi
jne 0x1022650c
push esi
call fcn.1022ee9d
add esp, 4
pop edi
pop esi
pop ecx
ret 8
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 0x199]
mov dl, byte [esi + 0x198]
xor eax, eax
push ecx
mov al, byte [esi + 0x197]
push edx
xor ecx, ecx
push eax
mov cl, byte [esi + 0x196]
xor edx, edx
mov dl, byte [esi + 0x195]
xor eax, eax
mov al, byte [esi + 0x194]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push str._02X__02X__02X__02X__02X__02X
push ecx
call fcn.1022e8c2
add esp, 0x20
push esi
call fcn.1022ee9d
add esp, 4
pop edi
pop esi
pop ecx
ret 8

Function at 0x10226820
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x1022682c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x102268bf
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x10226889
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.102268d0
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x1022685e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x102268f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x102269ed
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x10226942
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x1022696e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.102268d0
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x102269af
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x10226931
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x10228db0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x104a9ac4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x10228dc3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x10228e04
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x104a9b6c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x10228e36
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10228e3a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x10228e2b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x10228e58
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10228e5c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x10228e4d
xor ecx, ecx
mov eax, 0x104a9ad4
xor ebx, ebx
mov bl, byte [ecx + 0x104a9b7c]
cmp byte [esp + ebx + 0x14], 0
je 0x10228e87
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x104a9b94]
cmp byte [esp + ebx + 0x14], 0
je 0x10228e9e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x10228e6e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x10228df7
lea edx, [esp + 0x84]
push edx
call fcn.10228ee0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x102416c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10241702
call fcn.10244185
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10241702
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x102416f9
xor eax, eax
jmp 0x1024170a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10241710
pop edi
pop esi
pop ebx
ret 4
Function at 0x401813
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401852
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401852
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401852
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401852
cmp dword [ecx + 0x74], 0xe
jbe 0x401852
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40c7b6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c1c8
push 0x41c1c0
push str.FlsAlloc
push 0x1f
call fcn.0040c675
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c7ea
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a118]
call esi
jmp 0x40c7f0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40c834
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c1d8
push 0x41c1d0
push str.FlsGetValue
push 0x21
call fcn.0040c675
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c86b
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a118]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40c873
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c1e0
push 0x41c1d8
push str.FlsSetValue
push 0x22
call fcn.0040c675
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c8ad
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41a118]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x410040
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4100dd
push ebx
push esi
call fcn.00410009
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040ff9d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41008a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4100dc
push edi
push eax
call fcn.0040cf65
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4100aa
call fcn.0040c508
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4100db
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040ff9d
add esp, 0x20
test eax, eax
jne 0x4100c9
push edi
call fcn.0040c508
jmp 0x4100d1
push ebx
call fcn.0040c508
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x415ba7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x422020]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x415be7
cmp byte [ebx], 0xa
jne 0x415be7
or byte [edi + eax + 0x28], 4
jmp 0x415bec
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x415ceb
mov dl, byte [eax]
cmp dl, 0x1a
je 0x415cce
inc eax
cmp dl, 0xd
je 0x415c18
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x415c3e
cmp eax, ecx
jae 0x415c4c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x415c00
jmp 0x415ceb
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415cc9
cmp dword [ebp - 0x10], 0
je 0x415cc9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x422020]
test byte [eax + edi + 0x28], 0x48
je 0x415ca3
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x415c8e
mov byte [esi], dl
jmp 0x415c9f
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x422020]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x415ceb
cmp byte [ebp - 1], 0xa
jne 0x415cb2
cmp esi, ebx
jne 0x415cb2
mov byte [esi], 0xa
jmp 0x415cea
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00415b17
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x415ceb
mov byte [esi], 0xd
jmp 0x415cea
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x422020]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x415ce8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x415ceb
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x415cf4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x422020]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x415d3a
cmp word [ebx], dx
jne 0x415d3a
or byte [eax + edi + 0x28], 4
jmp 0x415d3f
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x415ea2
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x415e82
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x415d80
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x415db6
cmp eax, edx
jae 0x415dc4
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x415d5b
jmp 0x415ea2
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415e7d
cmp dword [ebp - 0x18], 0
je 0x415e7d
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x422020]
test byte [eax + edi + 0x28], 0x48
je 0x415e53
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x415e17
mov word [esi], cx
jmp 0x415e4e
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x422020]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x422020]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x422020]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x415ea2
pop eax
cmp word [ebp - 4], ax
jne 0x415e63
cmp esi, ebx
jne 0x415e63
mov word [esi], ax
jmp 0x415e9f
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00415b17
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x415ea2
push 0xd
pop eax
jmp 0x415e5e
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x422020]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x415e9c
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x415ea2
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x418840
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41886d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41886d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4010f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c004]
jne 0x4010fe
repz ret
jmp fcn.004014d0

Function at 0x408cec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404b1f
and dword [ebp - 0x14], 0
cmp dword [0x42ec74], 0
mov dword [ebp - 0x18], eax
jne 0x408d9f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408e47
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408e47
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42ec74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42ec78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42ec7c], eax
call edi
push eax
call esi
mov dword [0x42ec84], eax
test eax, eax
je 0x408d9f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ec80], eax
mov eax, dword [0x42ec80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408df8
cmp dword [0x42ec84], ecx
je 0x408df8
push eax
call esi
push dword [0x42ec84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408df8
test ebx, ebx
je 0x408df8
call edi
test eax, eax
je 0x408def
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408def
test byte [ebp - 8], 1
jne 0x408df8
or dword [ebp + 0x10], 0x200000
jmp 0x408e2b
mov eax, dword [0x42ec78]
cmp eax, dword [ebp - 0x18]
je 0x408e2b
push eax
call esi
test eax, eax
je 0x408e2b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408e2b
mov eax, dword [0x42ec7c]
cmp eax, dword [ebp - 0x18]
je 0x408e2b
push eax
call esi
test eax, eax
je 0x408e2b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42ec74]
call esi
test eax, eax
je 0x408e47
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408e49
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010f4
leave
ret
Function at 0x421040
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42cdb0]
push ebx
mov ebx, dword [0x2bd2234]
push edi
mov edi, dword [0x2bd46b4]
call fcn.00420fb0
cmp dword [0x2bd46b4], 0x2f
jne 0x4210ad
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00420fe0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010f4
add esp, 0x24
ret
Function at 0x421330
Capabilities:
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x421348
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x421391
mov dword [0x2bd431c], 0x8e46a6f0
cmp dword [0x2bd46b4], 0x3dc
jne 0x42138f
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x42133f
mov dword [ebp - 0x10], 0
jmp 0x4213a3
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x421446
cmp dword [0x2bd46b4], 0xa5f
jne 0x4213cc
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x10], 0x84620b
jne 0x4213f1
mov eax, dword [0x42dbd0]
mov dword [0x2bd46b4], eax
mov ecx, dword [0x2bd46b4]
add ecx, 0xa231
mov dword [0x2bd46b4], ecx
cmp dword [0x2bd46b4], 0x141
jne 0x421441
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov dword [0x42f1a0], 0xec58acac
mov dword [0x42f1a4], 0xffffffff
jmp 0x42139a
call fcn.004210d0
jmp dword [0x2bd2234]
Function at 0xb890b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b89200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb890d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb890c2
add dl, dl
jne 0xb890e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb89134
xor eax, eax
add dl, dl
jne 0xb890ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb891d5
add dl, dl
jne 0xb890fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb89108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb89113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb8911e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb8912a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb890cd
mov eax, 1
add dl, dl
jne 0xb89142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb8914d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb89139
sub eax, ebx
mov ebx, 1
jne 0xb89180
mov ecx, 1
add dl, dl
jne 0xb89166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb89171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb8915d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb890cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb89197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb891a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb8918e
cmp eax, 0x7d00
jae 0xb891c5
cmp eax, 0x500
jb 0xb891c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb890cd
cmp eax, 0x7f
ja 0xb891c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb890cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb891f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb890cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0x3af3
push 0x40000
call dword [sym.imp.KERNEL32.DLL_HeapCreate]
mov dword [0xa0e70c], eax
cmp dword [0xa0e70c], 0
jne 0x401096
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [0xa0e70c]
push ecx
call fcn.00401000
add esp, 8
push eax
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 4], edx
push 0x2724
push 0
mov eax, dword [0xa0e70c]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [0xa0e710], eax
push 0xc0
push 0x259e
mov ecx, dword [0xa0e710]
push ecx
push 0x4dd7f0
call fcn.00401110
add esp, 0x10
mov edx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 4], edx
push 0xe94a694
push str.0xb14d300
call dword [sym.imp.WINMM.dll_sndPlaySoundA]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
push edx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]