joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4051fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.00404696
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040464b
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.00404696
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040464b
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.00404686
aas
fbstp tbyte [esi + 0x6c]
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
invalid
test edx, esi
cli
invalid
invalid

Function at 0x406032
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [ebp - 0x22f7b], cl
dec dword [ecx - 0x39f7b]
inc dword [ebx - 0x6fb43]
inc dword [eax]
jne 0x406201
invalid
and byte [ebp - 0x77c], 0
cmp dword [ebp - 0x6fc], 1
jne 0x4062b2
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00404696
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.004045f7
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x4065fe
cmp dword [ebp - 0x6fc], 2
jne 0x40636f
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], 0x80
mov byte [ebp - 0x795], 0x81
mov byte [ebp - 0x794], 0x9d
mov byte [ebp - 0x793], 0x8a
mov byte [ebp - 0x792], 0x9c
mov byte [ebp - 0x791], 0xc1
mov byte [ebp - 0x790], 0x8b
mov byte [ebp - 0x78f], 0x83
mov byte [ebp - 0x78e], 0x83
mov byte [ebp - 0x78d], 0xef
call fcn.00404686
push esi
dec esp
in eax, dx
cmp byte [edx + 0xc], ch
invalid
invalid
clc
Function at 0x4014bf
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x128
mov esi, eax
lea eax, [ebp - 0x10]
mov ebx, edx
push eax
mov eax, dword [0x424468]
or eax, 8
mov dword [ebp - 0x120], ecx
push eax
push 0
push edx
push esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x40158a
jmp 0x401528
cmp dword [ebp - 0x120], 0
je 0x401516
sub esp, 0xc
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
add esp, 0xc
jmp 0x40158a
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, edi
call fcn.004014bf
test eax, eax
jne 0x401542
jmp 0x40152e
lea edi, [ebp - 0x115]
push 0x105
push edi
push 0
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x4014f8
sub esp, 0xc
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
push 3
call fcn.004064e1
add esp, 0xc
test eax, eax
je 0x401569
push 0
push dword [0x424468]
push ebx
push esi
call eax
jmp 0x40158a
mov eax, 1
cmp dword [0x424468], 0
jne 0x40158a
push edi
push edi
push ebx
push esi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
pop ebx
setne al
pop esi
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403211
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
cmp dword [ebp + 8], 0
je 0x403242
mov eax, dword [0x414460]
test eax, eax
je 0x403233
sub esp, 0xc
push eax
call sub.USER32.dll_DestroyWindow
add esp, 0xc
mov dword [0x414460], 0
jmp 0x4032c8
cmp dword [0x414460], 0
je 0x40325a
sub esp, 0xc
push 0
call fcn.00406421
add esp, 0xc
jmp 0x4032c8
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [0x4244e8]
jbe 0x4032c8
cmp dword [0x424538], 0
je 0x40329c
test byte [0x42446c], 1
je 0x4032c8
call fcn.004031ef
lea ebx, [ebp - 0x44]
push edx
push eax
push str....__d__
push ebx
call sub.USER32.dll_wsprintfA
pop ecx
pop eax
push ebx
push 0
call fcn.004040bb
pop eax
pop edx
jmp 0x4032c8
sub esp, 0xc
push 0
push 0x4038da
push 0
push 0x6f
push dword [0x424548]
call sub.USER32.dll_CreateDialogParamA
sub esp, 0xc
mov dword [0x414460], eax
push 5
push eax
call sub.USER32.dll_ShowWindow
add esp, 0x18
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x403470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test eax, eax
js 0x4034a1
add eax, dword [0x4244e0]
push 0
push 0
push eax
push dword [0x409014]
mov dword [0x414480], eax
call sub.KERNEL32.dll_SetFilePointer
mov eax, 4
call fcn.004032cd
mov ebx, eax
test eax, eax
js 0x403580
lea eax, [ebp - 0x14]
push ebx
push 4
push eax
push dword [0x409014]
call fcn.00406af6
pop ecx
test eax, eax
je 0x40357b
mov eax, dword [ebp - 0x14]
add dword [0x414480], 4
call fcn.004032cd
mov ebx, eax
test eax, eax
js 0x403580
test esi, esi
je 0x40353e
jmp 0x403547
cmp eax, 0x4000
jle 0x4034fb
mov eax, 0x4000
push edx
push eax
push 0x414560
mov dword [ebp - 0x10], eax
push dword [0x409014]
call fcn.00406af6
pop esi
test eax, eax
je 0x40357b
push ecx
push dword [ebp - 0x10]
push 0x414560
push edi
call fcn.00406ac0
pop edx
test eax, eax
jne 0x403530
mov ebx, 0xfffffffe
jmp 0x403580
mov eax, dword [ebp - 0x10]
sub dword [ebp - 0x14], eax
add ebx, eax
add dword [0x414480], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jg 0x4034ef
jmp 0x403580
sub esp, 0xc
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
push 0
push eax
mov eax, dword [ebp + 0x14]
cmp eax, edx
jle 0x40355c
mov eax, edx
push eax
push esi
push dword [0x409014]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x40357b
mov ebx, dword [ebp - 0x10]
add dword [0x414480], ebx
jmp 0x403580
mov ebx, 0xfffffffd
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x406479
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x12c
lea ebx, [ebp - 0x122]
push 0x104
push ebx
call sub.KERNEL32.dll_GetSystemDirectoryA
mov edx, eax
pop eax
cmp edx, 0x104
pop ecx
jbe 0x4064a4
xor edx, edx
jmp 0x4064b1
test edx, edx
je 0x4064b1
xor eax, eax
cmp byte [edx + ebx - 1], 0x5c
jne 0x4064b6
mov eax, 1
push dword [ebp + 8]
add eax, 0x40a43c
push eax
lea eax, [ebx + edx]
push str._s_s.dll
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 8
push 0
push ebx
call sub.KERNEL32.dll_LoadLibraryExA
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x406778
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0x14]
lea edx, [ebp - 8]
mov byte [ebx], 0
push edx
cmp dword [ebp + 0x18], 1
sbb eax, eax
xor al, al
add eax, 0x20119
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x4067f1
push eax
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
test eax, eax
pop ecx
jne 0x4067d9
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, 1
jbe 0x4067dc
mov byte [ebx], 0
mov byte [ebx + 0x3ff], 0
sub esp, 0xc
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x406ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 8]
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
xor edx, edx
add esp, 0xc
test eax, eax
je 0x406aed
xor edx, edx
cmp ebx, dword [ebp - 8]
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x406af6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 8]
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
xor edx, edx
add esp, 0xc
test eax, eax
je 0x406b23
xor edx, edx
cmp ebx, dword [ebp - 8]
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x406bb7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, 0x64
mov esi, dword [ebp + 8]
jmp 0x406bfd
mov eax, dword [0x40a450]
mov dword [ebp - 0x10], eax
mov bl, byte [ebp - 0xe]
call sub.KERNEL32.dll_GetTickCount
mov edx, 0x1a
push esi
mov ecx, edx
xor edx, edx
div ecx
lea eax, [ebp - 0x10]
push 0
push eax
add ebx, edx
push dword [ebp + 0xc]
mov byte [ebp - 0xe], bl
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
jne 0x406c08
dec edi
cmp edi, 0xffffffff
jne 0x406bca
mov byte [esi], 0
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x406c14
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
push dword [ebp + 8]
push 0x4237a8
call fcn.0040675e
push ebx
push 0x4237a8
call fcn.004065b2
add esp, 0xc
mov ebx, eax
test eax, eax
je 0x406cc9
sub esp, 0xc
push eax
call fcn.00406624
add esp, 0xc
cmp byte [0x4244f8], 0
jns 0x406c8c
mov al, byte [ebx]
test al, al
je 0x406cc9
cmp al, 0x5c
jne 0x406c8c
jmp 0x406cc9
sub esp, 0xc
push 0x4237a8
call fcn.00406553
add esp, 0xc
test eax, eax
je 0x406c7a
test byte [eax], 0x10
je 0x406cc9
sub esp, 0xc
push 0x4237a8
call fcn.004066ec
add esp, 0xc
jmp 0x406c92
sub ebx, 0x4237a8
sub esp, 0xc
push 0x4237a8
call fcn.004066e3
add esp, 0xc
cmp eax, ebx
jg 0x406c61
sub esp, 0xc
push 0x4237a8
call fcn.00406721
push 0x4237a8
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
inc eax
setne al
movzx eax, al
jmp 0x406ccb
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x406cd2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
pop edx
xor edx, edx
cmp eax, 0xffffffff
pop ecx
setne dl
neg edx
and edx, eax
push 0
push edx
push dword [ebp + 0x10]
push 0
push 1
push dword [ebp + 0xc]
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
leave
ret 0xc
Function at 0x406d0a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
je 0x406d35
push eax
push eax
mov eax, ebx
and eax, 0xfffffffe
push eax
push esi
call sub.KERNEL32.dll_SetFileAttributesA
pop esi
pop eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x406da6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
push 0x40a454
push 0x422ba8
call sub.KERNEL32.dll_lstrcpyA
test ebx, ebx
pop esi
pop edi
je 0x406e02
push ecx
push 1
push 0
push ebx
call fcn.00406cd2
push edx
push edx
push eax
call sub.KERNEL32.dll_CloseHandle
push eax
push eax
push 0x400
push 0x422ba8
push ebx
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0x14
test eax, eax
je 0x406f64
cmp eax, 0x400
jg 0x406f64
push eax
push 0x400
push 0x422fa8
push dword [ebp + 8]
call sub.KERNEL32.dll_GetShortPathNameA
pop edi
test eax, eax
je 0x406f64
cmp eax, 0x400
jg 0x406f64
push 0x422fa8
push 0x422ba8
push str._s_s_r_n
push 0x4233a8
call sub.USER32.dll_wsprintfA
pop ebx
mov dword [ebp - 0x14], eax
mov eax, dword [0x424498]
pop esi
push dword [eax + 0x128]
push 0x422fa8
call fcn.004067f8
sub esp, 0xc
push 4
push 0xc0000000
push 0x422fa8
call fcn.00406cd2
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x406f64
push ecx
push ecx
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov edx, dword [ebp - 0x14]
mov esi, eax
lea eax, [eax + edx + 0xa]
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov edi, eax
pop eax
test edi, edi
pop edx
je 0x406f56
push eax
push esi
push edi
push dword [ebp - 0x10]
call fcn.00406af6
pop ebx
test eax, eax
je 0x406f56
push ecx
push ecx
push str._Rename__r_n
push edi
call fcn.00406d40
pop ebx
test eax, eax
pop edx
jne 0x406ee6
lea eax, [edi + esi]
push ecx
push ecx
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpyA
add esi, 0xa
pop ebx
mov eax, esi
pop edx
jmp 0x406f1b
add eax, 0xa
push ecx
push ecx
push 0x40a46b
push eax
call fcn.00406d40
mov ebx, eax
pop eax
test ebx, ebx
pop edx
mov eax, esi
je 0x406f1b
lea edx, [edi + esi]
mov eax, dword [ebp - 0x14]
lea ecx, [edx + eax]
jmp 0x406f11
mov al, byte [edx]
dec edx
mov byte [ecx + 1], al
dec ecx
cmp edx, ebx
ja 0x406f0b
sub ebx, edi
lea eax, [ebx + 1]
push dword [ebp - 0x14]
lea eax, [edi + eax]
push 0x4233a8
push eax
call fcn.0040634e
push 0
push 0
push 0
push dword [ebp - 0x10]
call sub.KERNEL32.dll_SetFilePointer
mov edx, dword [ebp - 0x14]
push eax
lea eax, [esi + edx]
push eax
push edi
push dword [ebp - 0x10]
call fcn.00406ac0
push eax
push eax
push edi
call sub.KERNEL32.dll_GlobalFree
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x10]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406f6c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 5
push ebx
push esi
call sub.KERNEL32.dll_MoveFileExA
pop edx
test eax, eax
jne 0x406f92
push eax
push eax
push ebx
push esi
call fcn.00406da6
add esp, 0x10
inc dword [0x424448]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8

Function at 0x406fa1
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ebx
call fcn.00406d0a
add esp, 0xc
mov esi, eax
cmp eax, 0xffffffff
je 0x406ffe
test edi, 1
je 0x406fd3
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_RemoveDirectoryA
jmp 0x406fdc
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
test eax, eax
jne 0x406ff7
and edi, 4
jne 0x406ffe
push edi
push edi
push esi
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
xor eax, eax
pop ebx
pop esi
jmp 0x407000
mov eax, 1
jmp 0x407000
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x40731f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x423fa8], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x423fa8
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.dll_CreateProcessA
pop edx
xor edx, edx
pop ecx
test eax, eax
je 0x40736a
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, edx
leave
ret 4

Function at 0x407395
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x28
lea eax, [ebp - 0x14]
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x28]
push eax
mov byte [ebp - 0x28], 1
mov byte [ebp - 0x27], 0
mov word [ebp - 0x26], 4
mov dword [ebp - 0x24], 0x40a488
mov dword [ebp - 0x20], 0x40a488
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0x40a478
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0
push esi
call sub.KERNEL32.dll_CreateDirectoryA
pop edx
xor edx, edx
pop ecx
test eax, eax
jne 0x407419
call sub.KERNEL32.dll_GetLastError
mov edx, eax
cmp eax, 0xb7
jne 0x407419
push eax
push ebx
push 0x80000007
push esi
call sub.ADVAPI32.DLL_SetFileSecurityA
xor edx, edx
pop ebx
test eax, eax
jne 0x407419
call sub.KERNEL32.dll_GetLastError
mov edx, eax
lea esp, [ebp - 8]
mov eax, edx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x407424
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x423ffc], 0
push ebx
mov esi, dword [ebp + 0x10]
jne 0x407461
xor ebx, ebx
mov edx, ebx
xor ecx, ecx
mov eax, edx
inc ecx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
cmp ecx, 8
jne 0x40743b
mov dword [ebx*4 + 0x423ff8], edx
inc ebx
cmp ebx, 0x100
jne 0x407437
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
not edx
jmp 0x40747d
mov al, byte [ecx - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x423ff8]
dec esi
inc ecx
cmp esi, 0xffffffff
jne 0x40746b
not edx
mov eax, edx
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x10e0d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10e0d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10e0d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e0d06a
add dl, dl
jne 0x10e0d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e0d0dc
xor eax, eax
add dl, dl
jne 0x10e0d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e0d17d
add dl, dl
jne 0x10e0d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e0d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e0d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e0d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10e0d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10e0d075
mov eax, 1
add dl, dl
jne 0x10e0d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e0d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e0d0e1
sub eax, ebx
mov ebx, 1
jne 0x10e0d128
mov ecx, 1
add dl, dl
jne 0x10e0d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e0d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e0d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e0d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10e0d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e0d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e0d136
cmp eax, 0x7d00
jae 0x10e0d16d
cmp eax, 0x500
jb 0x10e0d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e0d075
cmp eax, 0x7f
ja 0x10e0d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e0d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10e0d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10e0d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x436c90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x1867848]
xor edx, edx
cmp eax, edx
jne 0x436cb6
xor eax, eax
mov byte [eax + 0x1867748], al
inc eax
cmp eax, 0x100
jl 0x436c9e
mov dword [0x1867848], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x1867748
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x436d47
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x436d1a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x436ce8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x436dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x436e13
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x436dfa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x43b2d1
cmp eax, 8
jg 0x43b2d1
cmp dword [esp + 0x8c], 2
jl 0x43b2d1
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x43b2d1
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x43b2d1
mov eax, dword [esp + 0x80]
test eax, eax
je 0x43b137
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x43b2ba
mov ebp, dword [0x4a5644]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x43b169
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x43b2a1
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x43b189
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x4a5634]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x43b1c8
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x4a5638]
lea ecx, [esp + 0x28]
push ecx
call dword [0x4a5678]
test eax, eax
jne 0x43b288
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.0043a6c0
cmp eax, 1
jne 0x43b2b2
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.0043af70
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x43b17d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x43b2ba
jmp 0x43b154
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.0043a2c0
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c