joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbba1ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jbe 0xbba210
mov eax, 1
mov ebx, ecx
add ebx, eax
dec ebx
mov bl, byte [ebx]
mov edi, edx
add edi, eax
dec edi
xor byte [edi], bl
inc eax
dec esi
jne 0xbba1fe
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0xbba5a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0xbba5c5
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x14]
mov eax, edi
call fcn.00bba560
mov ax, word [esi + ebp*2 + 0x16]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x18]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1a]
lea eax, [edi + 6]
call fcn.00bba560
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1c]
lea eax, [edi + 4]
call fcn.00bba560
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x1e]
lea eax, [edi + 2]
call fcn.00bba560
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0xbba5e1
mov dx, word [esi + 0x74]
mov eax, edi
call fcn.00bba560
mov ax, word [esi + 0x76]
add word [edi + 4], ax
mov ax, word [esi + 0x78]
add word [edi + 2], ax
mov dx, word [esi + 0x7a]
lea eax, [edi + 6]
call fcn.00bba560
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xbba730
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0xbba755
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x7c]
mov eax, edi
call fcn.00bba560
mov ax, word [esi + ebp*2 + 0x7e]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x80]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x82]
lea eax, [edi + 6]
call fcn.00bba560
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x84]
lea eax, [edi + 4]
call fcn.00bba560
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x86]
lea eax, [edi + 2]
call fcn.00bba560
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0xbba771
mov dx, word [esi + 0xdc]
mov eax, edi
call fcn.00bba560
mov ax, word [esi + 0xde]
add word [edi + 4], ax
mov ax, word [esi + 0xe0]
add word [edi + 2], ax
mov dx, word [esi + 0xe2]
lea eax, [edi + 6]
call fcn.00bba560
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xbc9750
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0xbc9781
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbc9769
add dl, dl
jne 0xbc978c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbc97dd
xor eax, eax
add dl, dl
jne 0xbc9799
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbc987a
add dl, dl
jne 0xbc97a8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc97b3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc97be
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc97c9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbc97d3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbc9778
mov eax, 1
add dl, dl
jne 0xbc97eb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc97f6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbc97e2
sub eax, ebx
mov ebx, 1
jne 0xbc9829
mov ecx, 1
add dl, dl
jne 0xbc980f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbc981a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbc9806
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbc9778
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbc9840
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbc984b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbc9837
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbc9778
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbc989b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbc9778
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0xbcaf78
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xbcb037
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0xbcb029
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0xbcb012
test esi, esi
jbe 0xbcb029
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.00b08518
test eax, eax
jne 0xbcb004
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0xbcb029
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0xbcafe1
jmp 0xbcb029
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0xbcb029
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xbcb03e
ret
Function at 0xbcba58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0xbcbc07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00b02868
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0xbcba93
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0xbcbaac
lea eax, [ebp - 0x10]
mov edx, dword [0xc15ff8]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00b028c8
jmp 0xbcbabf
lea eax, [ebp - 0x10]
mov edx, dword [0xc15ff8]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00b028c8
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0xbcbacb
adc edx, 0
mov edx, dword [edx*4 + 0xc14608]
call fcn.00b02ac8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00b02aac
push eax
call fcn.00b04a50
mov esi, eax
cmp esi, 0xffffffff
je 0xbcbbd9
mov eax, 0x40
call fcn.00b00724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00b04e80
test eax, eax
je 0xbcbbcc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0xbcbbcc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00b04ef8
mov eax, edi
call fcn.00b00744
mov eax, 0x18
call fcn.00b00724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00b04e80
test eax, eax
je 0xbcbbcc
mov eax, edi
cmp dword [eax], 0x4550
jne 0xbcbbcc
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0xbcbbcc
cmp dx, 0x150
ja 0xbcbbcc
mov eax, edi
call fcn.00b00744
mov eax, 0xe0
call fcn.00b00724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00b04e80
test eax, eax
je 0xbcbbcc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0xbcbbcc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00b028a4
mov eax, edi
call fcn.00b00744
push esi
call fcn.00b04a08
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00b02bd4
jne 0xbcbbf1
inc ebx
cmp ebx, 0x19
jne 0xbcba85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xbcbc0e
lea eax, [ebp - 0x10]
call fcn.00b02868
ret
Function at 0xbd8b24
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test edi, edi
jle 0xbd8bb7
xor ebx, ebx
mov byte [ebp - 9], 0
lea eax, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
mov edx, dword [ebp + 8]
call fcn.00b5a6b4
dec edi
test edi, edi
jl 0xbd8bb7
inc edi
mov dword [ebp - 0x10], edi
xor edx, edx
inc ebx
mov esi, ebx
and esi, 0xff
mov al, byte [ebp + esi - 0x110]
add byte [ebp - 9], al
xor ecx, ecx
mov cl, byte [ebp - 9]
mov cl, byte [ebp + ecx - 0x110]
mov byte [ebp + esi - 0x110], cl
xor ecx, ecx
mov cl, byte [ebp - 9]
mov byte [ebp + ecx - 0x110], al
add al, byte [ebp + esi - 0x110]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
and eax, 0xff
xor cl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + edx], cl
inc edx
dec dword [ebp - 0x10]
jne 0xbd8b60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0xbe7ec8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0xbe7f7b
add edx, ebx
mov eax, edx
mov edi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x20]
add edx, ebx
mov dword [ebp - 4], edx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
cmp edx, 0xffff
jbe 0xbe7f5f
test edi, edi
jbe 0xbe7f7b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00b08518
test eax, eax
jne 0xbe7f50
mov eax, dword [ebp - 8]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0xc]
mov esi, dword [eax]
test esi, esi
je 0xbe7f7b
add ebx, esi
mov esi, ebx
jmp 0xbe7f7b
add dword [ebp - 8], 2
add dword [ebp - 4], 4
dec edi
test edi, edi
ja 0xbe7f25
jmp 0xbe7f7b
mov edi, edx
sub edi, dword [eax + 0x10]
cmp edi, dword [eax + 0x14]
jae 0xbe7f7b
mov eax, edi
shl eax, 2
add eax, dword [ebp - 0xc]
mov esi, dword [eax]
test esi, esi
je 0xbe7f7b
add ebx, esi
mov esi, ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xbf9100
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0xbf9131
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbf9119
add dl, dl
jne 0xbf913c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbf918d
xor eax, eax
add dl, dl
jne 0xbf9149
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbf922a
add dl, dl
jne 0xbf9158
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbf9163
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbf916e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbf9179
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbf9183
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbf9128
mov eax, 1
add dl, dl
jne 0xbf919b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbf91a6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbf9192
sub eax, ebx
mov ebx, 1
jne 0xbf91d9
mov ecx, 1
add dl, dl
jne 0xbf91bf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbf91ca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbf91b6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbf9128
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbf91f0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbf91fb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbf91e7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbf9128
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbf924b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbf9128
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x144c8ac
Capabilities:
Encode data using xor

Disassembly:
jmp 0x144c8b6
pushal
call 0x144c8bc
pop ebp
sub ebp, 0x10
sub ebp, 0x104c8ac
jmp 0x144c8d2
mov eax, 0x104c8ac
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b2
mov edx, 0x511ed3aa
xor byte [eax], dl
inc eax
dec ecx
jne 0x144c8e9
jmp 0x144c8fc
mov ecx, ebp
mov ecx, dword [ecx + 0x3c]
add ecx, 0xf8
add ecx, ebp
mov eax, 0xc
mov edx, 0x28
mul edx
add ecx, eax
mov eax, dword [ecx + 0xc]
add eax, ebp
lea esp, [esp - 4]
mov dword [esp], eax
push eax
push 0x1ffeac
push 0xe4ca00
add dword [esp], ebp
push 0x6b5eacd1
call fcn.0144c946
jmp 0x144c97c
mov ecx, dword [esp + 4]
push 0x1ffeac
push 0xe4ca00
add dword [esp], ebp
push ecx
call fcn.0144c99b
jmp 0x144cbe6
pop edi
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0x144cbf7
mov eax, 0x104c8ac
add eax, ebp
add eax, 0x371
mov ecx, 0x28d
mov edx, 0xd29df77b
xor byte [eax], dl
inc eax
dec ecx
jne 0x144cc0e
jmp 0x144cc21
xchg esi, edi
mov edi, dword [esi + 0x3c]
mov edi, dword [edi + esi + 0xa0]
add edi, esi
lea ebx, [esi]
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x34]
sub ebx, eax
mov edx, dword [edi]
mov ecx, dword [edi + 4]
cmp edx, 0
je 0x144cc96
add edx, esi
add edi, 8
sub ecx, 8
cmp ecx, 0
je 0x144cc3e
mov ax, word [edi]
shr eax, 0xc
and eax, 0xf
cmp eax, 3
jne 0x144cc8c
mov ax, word [edi]
and eax, 0xfff
add eax, edx
add dword [eax], ebx
dec ecx
dec ecx
add edi, 2
jmp 0x144cc5e
jmp 0x144cc9f
mov eax, 0x104c8ac
add eax, ebp
add eax, 0x419
mov ecx, 0x1e5
mov edx, 0x847b060
xor byte [eax], dl
inc eax
dec ecx
jne 0x144ccb6
jmp 0x144ccc9
mov edi, dword [esi + 0x3c]
mov edi, dword [edi + esi + 0x80]
add edi, esi
cmp dword [edi + 0xc], 0
je 0x144cd88
mov eax, dword [edi + 0xc]
add eax, esi
push eax
call dword [ebp + 0xe1d200]
cmp eax, 0
jne 0x144cd03
mov eax, dword [edi + 0xc]
add eax, esi
push eax
call dword [ebp + 0xe1d20c]
cmp dword [edi + 0xc], 0
je 0x144cd88
cmp dword [edi], 0
jne 0x144cd21
cmp dword [edi + 0x10], 0
je 0x144cd7c
push ebp
push ebp
pop edx
xchg ebp, edi
mov edi, dword [ebp + 0x10]
xchg ebp, edi
add ebp, esi
cmp dword [ebp], 0
je 0x144cd7c
mov ecx, dword [ebp]
push eax
lea esp, [esp - 4]
mov dword [esp], edx
or ecx, ecx
jns 0x144cd50
push ecx
jmp 0x144cd5f
add ecx, esi
add ecx, 2
lea esp, [esp - 4]
mov dword [esp], ecx
push eax
call dword [edx + 0xe1d204]
mov edx, dword [esp]
lea esp, [esp + 4]
mov dword [ebp], eax
pop eax
add ebp, 4
jmp 0x144cd2d
pop ebp
add edi, 0x14
jmp 0x144ccd5
push esp
push dword fs:[0]
push 0x104ceab
push ebp
lea esp, [esp - 4]
mov dword [esp], esi
xchg esi, eax
mov esi, dword [eax + 0x3c]
xchg esi, eax
mov eax, dword [eax + esi + 0x28]
add eax, esi
jmp eax

Function at 0x144c946
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 4]
mov dword [esp], ebp
lea ebp, [esp]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0x144c966
mov ebp, dword [esp]
lea esp, [esp + 4]
ret 0xc
Function at 0x144ca27
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x144ca58
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x144ca36
add dl, dl
jne 0x144ca6b
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x144cadb
xor eax, eax
add dl, dl
jne 0x144ca80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x144cbb0
add dl, dl
jne 0x144ca93
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x144caa2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x144cab1
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x144cac0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x144cace
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x144ca4b
mov eax, 1
add dl, dl
jne 0x144caed
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x144cafc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x144cae0
sub eax, ebx
mov ebx, 1
jne 0x144cb43
mov ecx, 1
add dl, dl
jne 0x144cb21
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x144cb30
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x144cb14
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x144ca4b
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x144cb5e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x144cb6d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x144cb51
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x144ca4b
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x144cbd8
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x144ca4b
pop ebp
sub edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for foreground window switch
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x403008]
cmp eax, 0
jne 0x401021
mov eax, dword [0x40300c]
cmp eax, 0
jne 0x401021
jmp 0x4010b6
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 4], eax
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401021
mov dword [ebp - 0x14], eax
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jl 0x401021
lea eax, [ebp - 8]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401021
mov eax, dword [0x403008]
cmp eax, 0
je 0x401093
push 0x3e8
call sub.KERNEL32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401067
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
je 0x401021
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
cmp eax, ebx
je 0x401067
mov eax, dword [0x40300c]
cmp eax, 0
je 0x4010b6
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401093
cmp eax, dword [ebp - 0x14]
je 0x401093
push dword [0x403000]
mov eax, 0x40301a
mov ebx, 0x40322a
sub ebx, eax
push ebx
push 0x40301a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push 0x40
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
push dword [0x403004]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push dword [eax]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
cmp al, 0x2d
int 0
add byte [esp + ecx - 0x43ffff30], bh
invalid
Function at 0x414f6f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00415300
mov ebx, esp
lea eax, [ebp - 0x24]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x414fc8
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
call fcn.00415023
dec eax
neg eax
sbb eax, eax
and ax, 0x1000
add eax, 0x11000
add eax, edi
cmp esi, eax
jae 0x414fcc
xor eax, eax
jmp 0x41501b
call fcn.00415023
cmp eax, 1
je 0x414ffc
cmp esi, edi
jbe 0x414feb
mov eax, esi
push 0x4000
sub eax, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 4
push 0x1000
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call fcn.00415023
dec eax
lea ecx, [ebp - 8]
neg eax
sbb eax, eax
push ecx
and eax, 0x103
inc eax
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx