joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001347b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001348a
pop dword [ebp - 0x40]
mov eax, 0xb7a14947
add eax, 0x585feb43
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x5d66c537
sub dword [ebp - 0x50], 0xf147fec
mov dword [ebp - 0x4c], 0x24ad0c6a
add dword [ebp - 0x4c], 0xd863fdb
mov dword [ebp - 0x48], 0xdbd350c1
add dword [ebp - 0x48], 0x7078f36d
mov dword [ebp - 0x44], 0x40e0c32d
sub dword [ebp - 0x44], 0x40e0c32d
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x67b7187e
add dword [ebp - 0x50], 0xcbb50d8
mov dword [ebp - 0x4c], 0x9b25a7d9
sub dword [ebp - 0x4c], 0x59b94664
mov dword [ebp - 0x48], 0x970f2db5
add dword [ebp - 0x48], 0xcc603eb7
mov dword [ebp - 0x44], 0x20aa89cd
add dword [ebp - 0x44], 0xdf557633
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3fda3
push 0
call eax
mov ecx, 0x543f
xor ebx, ebx
add ebx, eax
mov esi, 0x454d510
sub esi, 0xf4521910
add esi, dword [ebp - 0x40]
mov edx, 0xb93e647c
sub edx, 0xfd0f2ab5
xor dword [ebp - 0x38], edi
mov edi, dword [esi]
mov dword [ebp - 4], 0x475f7192
sub edi, edx
sub dword [ebp - 4], edi
mov dword [ebx], edi
sub dword [ebp - 0x38], 0x19957e77
add ebx, 0x9f7df757
sub ebx, 0x9f7df753
add esi, 0xa4aa1d4d
sub esi, 0xa4aa1d49
loop 0x1001359e
add eax, 0x143cf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x94ae0415
sub ecx, 0x84ae0415
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40a6bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40f910
cmp edx, dword [eax]
je 0x40a6df
add eax, 8
inc ecx
cmp eax, 0x40f9a0
jl 0x40a6d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40f910]
jne 0x40a80d
mov eax, dword [0xf0e83c]
cmp eax, 1
je 0x40a7e7
test eax, eax
jne 0x40a710
cmp dword [0x40f238], 1
je 0x40a7e7
cmp edx, 0xfc
je 0x40a80d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40a747
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407a00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00407af0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40a78a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00407af0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40e48c
push edi
call fcn.00408150
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407a00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407a10
lea eax, [ebp - 0xa0]
push 0x40e46c
push eax
call fcn.00407a10
push dword [esi + 0x40f914]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407a10
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040c88c
add esp, 0x2c
pop edi
jmp 0x40a80d
lea eax, [ebp + 8]
lea esi, [esi + 0x40f914]
push 0
push eax
push dword [esi]
call fcn.00407af0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100011c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x1c
test eax, eax
je 0x10001268
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], eax
mov ebx, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x10], edx
call edx
mov edi, eax
sub esp, 0x18
lea ecx, [edi + edi]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x10001268
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x10]
call edx
sub esp, 0x18
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x100015d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x100015f4
mov eax, ebx
call dbg.strdupAW
mov ebx, eax
test eax, eax
je 0x100016d4
test esi, esi
je 0x10001609
mov eax, esi
call dbg.strdupAW
mov esi, eax
test eax, eax
je 0x100016b0
test byte [0x10003018], 1
jne 0x10001660
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0
mov edi, eax
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], str.__s___s___Ix__n
mov dword [esp + 8], 0x10005084
mov dword [esp + 4], 0x10003018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10001612
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, 0xe
jmp 0x10001655
Function at 0x10001750
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1000176b
mov eax, ebx
call dbg.strdupAW
mov ebx, eax
test eax, eax
je 0x100017e0
test byte [0x10003018], 1
jne 0x100017a8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 8
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__s___d_:_stub_n
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], str.LoadPerfCounterTextStringsW
mov dword [esp + 4], 0x10003018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10001774
mov eax, 0xe
jmp 0x1000179a

Function at 0x10001850
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1000186b
mov eax, ebx
call dbg.strdupAW
mov ebx, eax
test eax, eax
je 0x100018e0
test byte [0x10003018], 1
jne 0x100018a8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 8
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__s___d_:_stub_n
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], str.UnloadPerfCounterTextStringsW
mov dword [esp + 4], 0x10003018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10001874
mov eax, 0xe
jmp 0x1000189a

Function at 0x100019a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x100019f8
cmp byte [esi + ebx - 1], 0xa
je 0x100019cc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10007084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10001fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x10007094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x10002160
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x10007094]
movzx eax, al
bt eax, esi
jae 0x100021c0
mov ecx, dword [0x10007084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x10002065
test byte [0x10003030], 8
jne 0x10002100
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003040], 8
jne 0x100020b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10002034
cmp esi, 3
jbe 0x10002070
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10005140]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10002034
mov ecx, dword [0x10007094]
test ecx, ecx
je 0x100021a0
mov dword [esp], 0x10003040
call dword [0x10007094]
test al, 8
je 0x1000200b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x1000200b
mov ebx, dword [0x10007094]
test ebx, ebx
je 0x10002180
mov dword [esp], 0x10003030
call dword [0x10007094]
test al, 8
je 0x10001ff6
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x10001ffe
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10007094
call sym._load_func.part.0
jmp 0x10001fbd
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10007094
call sym._load_func.part.0
jmp 0x1000210a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10007094
call sym._load_func.part.0
jmp 0x100020be
mov eax, 0xffffffff
jmp 0x10002065
Function at 0x40208b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
rdtsc
mov dword [ebp - 0x94], eax
mov dword [ebp - 4], 0x1d4c0
xor eax, eax
mov word [ebp - 0x90], ax
push dword [0x49444c]
push 0x405926ec
push 0xba6ff41c
push 0x5786839a
push 0xb98eae03
push 0x493364
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push eax
push 0x97645b3b
push 0xecb13676
push 0x2033723a
push 0x43624eeb
push str._x__u__x__i
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push eax
call fcn.0040243e
add esp, 0xc
mov dword [0x49444c], eax
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x4020a3
rdtsc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 8]
je 0x402094
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 8]
je 0x402162
push dword [0x49444c]
push dword [ebp - 8]
push dword [ebp - 0x94]
call fcn.0040248b
add esp, 0xc
mov dword [0x49444c], eax
xor eax, eax
inc eax
jmp 0x402180
push dword [0x49444c]
push dword [ebp - 8]
push dword [ebp - 0x94]
call fcn.004024c1
add esp, 0xc
mov dword [0x49444c], eax
xor eax, eax
leave
ret
Function at 0x4032fd
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
push esi
push edi
push 0x20
call dword [sym.imp.msvcrt.dll_isspace]
pop ecx
neg eax
sbb eax, eax
inc eax
push eax
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
push 0x1f
lea eax, [ebp - 0x1a0]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0xa
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
and dword [ebp - 0x14], 0
jmp 0x40334d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x4033a2
push str.0xb4243ea0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
add edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add edi, eax
xor esi, edi
mov dword [ebp - 0x1ac], esi
lea eax, [ebp - 0x388]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x403346
push dword [ebp - 0x1b4]
push 0x6b
push dword [ebp - 0x1b4]
push 0x32
push dword [ebp - 0x1b4]
push 5
push dword [ebp - 0x1b4]
push 0xb5
push dword [ebp - 0x1b4]
push 2
call fcn.00402a02
add esp, 0x28
mov dword [ebp - 0x1ac], eax
push 0x73
call dword [sym.imp.msvcrt.dll_isalnum]
pop ecx
push dword [ebp - 0x1b4]
push 0x51
push dword [ebp - 0x1b4]
push 0x25
push dword [ebp - 0x1b4]
push 0xb5
push dword [ebp - 0x1b4]
push 0xd4
push dword [ebp - 0x1b4]
push 0x41
call fcn.00402b10
add esp, 0x28
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1c], 0x6dbdbf
push dword [sym.imp.USER32.dll_GetWindowLongA]
call fcn.0040321c
pop ecx
test eax, eax
je 0x40343e
xor eax, eax
jmp 0x403523
push 0x78
call dword [sym.imp.msvcrt.dll_isalnum]
pop ecx
test eax, eax
je 0x403483
fld qword [0x47e660]
call sub.msvcrt.dll__CIsin
fstp dword [ebp - 0x390]
fld dword [ebp - 0x390]
fcomp qword [0x47e658]
fnstsw ax
test ah, 0x41
je 0x403483
push 0
push 0
push 0
call dword [sym.imp.WLDAP32.dll_Ordinal_12]
add esp, 0xc
cmp eax, 0x59
je 0x403488
jmp fcn.00403529
and dword [ebp - 0x14], 0
jmp 0x403495
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x4034d6
push dword [ebp - 0x1b4]
push 0x7c
push dword [ebp - 0x1b4]
push 0xaf
push dword [ebp - 0x1b4]
push 0x57
push dword [ebp - 0x1b4]
push 0x33
push dword [ebp - 0x1b4]
push 8
call fcn.00402bf2
add esp, 0x28
mov dword [ebp - 0x1ac], eax
jmp 0x40348e
mov dword [0x494428], 0x42274a
push dword [0x494434]
push dword [0x494428]
push dword [ebp - 0x28]
call fcn.00402ce2
add esp, 0xc
mov dword [ebp - 0x28], eax
push 0x42274a
mov dword [ebp - 0x28], 0x40362b
call dword [ebp - 0x28]
push dword [ebp - 0x28]
push 0x4037d0
call fcn.00402d16
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
push 1
call dword [sym.imp.msvcrt.dll_exit]
pop edi
pop esi
leave
ret 0x10
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x7c5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007c51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7c507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c506a
add dl, dl
jne 0x7c5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c50dc
xor eax, eax
add dl, dl
jne 0x7c5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c517d
add dl, dl
jne 0x7c50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7c50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7c5075
mov eax, 1
add dl, dl
jne 0x7c50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c50e1
sub eax, ebx
mov ebx, 1
jne 0x7c5128
mov ecx, 1
add dl, dl
jne 0x7c510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7c513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5136
cmp eax, 0x7d00
jae 0x7c516d
cmp eax, 0x500
jb 0x7c5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
cmp eax, 0x7f
ja 0x7c5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7c519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7c5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406796
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4067ba
xor eax, eax
test eax, eax
je 0x4067cd
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4067cd
xor ecx, ecx
jmp 0x4067d0
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x53dd9c
push eax
push dword fs:[0]
push ebx
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xe7
mov dword [0x98c0ec09], eax
mov eax, dword [0xf6a8b15c]
jecxz 0x401003
xor dword [ecx], ecx
iretd
ljmp 0x2bdb:0xc41a7522
jne 0x40109c
invalid
mov ch, byte [edx + 0x477bf67f]
jle 0x4010d4
salc
rcr cl, 1
cwde
add al, 0x60
sub byte [ecx + 0x485b75a6], bh
adc byte [eax], cl
xor eax, 0x4156615a
clc
or edi, dword [esi + 0x54]
xchg byte [ebx + 0x456a3141], bl
adc dword [edx + 0x30], ecx
jno 0x401110
sbb ebx, edi
cmp al, 0x6e
jae 0x40107e
out dx, al
aad 0x69
sub dword [edi + 0x33], ebx
retf
push ebp
mov cs, edx
mov bl, byte [edx + 0x3812e7a7]
adc eax, 0x31bdc80d
movsd dword es:[edi], dword [esi]
fild qword [eax]
add ch, al
cmpsd dword [esi], dword es:[edi]
dec eax
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402a20
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x43e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x402a6a
push 0x4039a0
push str.Failed_to_get_system_memory_status.
push 0x43f218
call fcn.004036c0
add esp, 8
mov ecx, eax
call fcn.00402ad0
mov eax, 1
jmp 0x402a88
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x64]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0040c700
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c56e
mov esp, ebp
pop ebp
ret
Function at 0x407350
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov dword [ebp - 0xc], 0x15f
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
push 0x40
push 0x3000
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40738f
xor eax, eax
jmp 0x4073e0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040ddb0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push str._j0Xd
mov ecx, dword [ebp - 4]
add ecx, dword [ebp + 0xc]
push ecx
call fcn.0040ddb0
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004072f0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret