joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410550
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41061e
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor eax, eax
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402620
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
xor eax, eax
mov al, byte [ebx + 0x38]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x4000000
push 0
push 0
push 0
push edi
push 0x410638
push dword [ebp - 4]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.0040323c
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00405fe0
mov eax, dword [ebp - 0x5c]
call fcn.00403340
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x410603
mov eax, dword [ebp - 0x50]
mov dword [ebx + 0x2c], eax
mov esi, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410625
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.00403034
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41ff02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x41ff11
pop dword [ebp - 0x28]
mov eax, 0x1e769bfe
sub eax, 0x1e349ced
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xaea95f15
add dword [ebp - 0x38], 0x9fa8e636
mov dword [ebp - 0x34], 0xf05cabe1
sub dword [ebp - 0x34], 0xbe295f9c
mov dword [ebp - 0x30], 0xd4b76709
sub dword [ebp - 0x30], 0x886b22db
mov dword [ebp - 0x2c], 0x1c2b5bd3
sub dword [ebp - 0x2c], 0x1c2b5bd3
lea eax, [ebp - 0x38]
push eax
mov eax, 0x6edf47f1
sub eax, 0x6e9d177d
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xb4e4370e
sub dword [ebp - 0x38], 0x4071cdb8
mov dword [ebp - 0x34], 0xf416be0d
sub dword [ebp - 0x34], 0xb2aa5c98
mov dword [ebp - 0x30], 0x6d204da
sub dword [ebp - 0x30], 0xa362986e
mov dword [ebp - 0x2c], 0x7439e613
add dword [ebp - 0x2c], 0x8bc619ed
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xdcbda658
add eax, 0x23848acc
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3f767
push 0
call eax
mov ecx, 0x4f02
xor edx, edx
add edx, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x28]
mov esi, 0x2e9706e0
add esi, 0x305d747d
xor dword [ebp - 4], eax
mov edi, dword [ebx]
sub dword [ebp - 0x1c], 0x1e33dec9
xor edi, esi
xor dword [ebp - 0x14], ebx
mov dword [edx], edi
mov dword [ebp - 0xc], 0x51d91a9c
add edx, 4
add ebx, 0xba29c85e
add ebx, 0x45d637a6
loop 0x420029
add eax, 0xbe903c84
sub eax, 0xbe8f0da9
mov ebx, eax
add eax, 5
mov ecx, 0xde66e352
add ecx, 0x21d91cae
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x411005
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x418cf0
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov eax, dword [ebx + 0x24]
lea edx, [eax - 7]
cmp edx, 2
jbe 0x418dc0
test eax, eax
je 0x418dc0
mov dword [esp], ebx
call fcn.00418480
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_htonl]
mov edi, eax
mov eax, dword [ebx + 0x24]
sub esp, 4
mov dword [esp], 0x54
sub eax, 5
cmp eax, 2
sbb esi, esi
and esi, 0x40
add esi, 0x44
call fcn.0041171c
test eax, eax
je 0x418d78
mov ecx, esi
xor edx, edx
mov byte [eax + 0x21], 0xff
mov byte [eax + 0x20], cl
mov dword [eax + 0x24], edi
mov dword [eax + 0x18], 0
mov word [eax + 0x1c], dx
mov dword [eax + 0x50], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00418b20
mov eax, dword [ebx + 0x24]
sub eax, 5
cmp eax, 1
jbe 0x418da0
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.004111b3
mov dword [esp + 0x20], ebx
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.004187f0
mov eax, dword [ebx + 0x30]
test eax, eax
mov eax, dword [ebx + 8]
je 0x418db1
sub dword [eax + 0x2894], 1
sub dword [eax + 0x2890], 1
mov dword [ebx + 0x24], 7
nop
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x41123f
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x412ae0
push esi
push ebx
sub esp, 0x54
mov esi, dword [esp + 0x64]
mov dword [esp + 0x34], 0x10
mov dword [esp + 0x38], 0
test esi, esi
je 0x412b90
lea edx, [esp + 0x34]
lea eax, [esp + 0x40]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
sub esp, 0x24
cmp eax, 0xffffffff
mov ebx, eax
je 0x412ba0
test byte [esp + 0x39], 0x80
jne 0x412bc0
test esi, esi
je 0x412b7e
mov eax, dword [esp + 0x44]
mov dword [esi], eax
movzx eax, word [esp + 0x42]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
sub esp, 4
mov word [esi + 4], ax
mov ebx, dword [esp + 0x3c]
add esp, 0x54
mov eax, ebx
pop ebx
pop esi
ret
xor edx, edx
xor eax, eax
jmp 0x412b09
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x412bb4
cmp eax, 0x2746
jne 0x412b82
xor ebx, ebx
add esp, 0x54
mov eax, ebx
pop ebx
pop esi
ret
mov ebx, 0xffffffff
jmp 0x412b82
Function at 0x4112bc
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x4129f0
push ebx
sub esp, 0x58
mov ebx, dword [esp + 0x64]
test ebx, ebx
je 0x412ab0
mov eax, 2
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov word [esp + 0x40], ax
movzx eax, word [ebx + 4]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov edx, 0x10
mov word [esp + 0x42], ax
mov eax, dword [ebx]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
sub esp, 0x24
cmp eax, 0xffffffff
mov edx, dword [esp + 0x3c]
je 0x412ac0
add esp, 0x58
mov eax, edx
pop ebx
ret
xor edx, edx
xor eax, eax
jmp 0x412a4e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor edx, edx
cmp eax, 0x2733
setne dl
add esp, 0x58
neg edx
mov eax, edx
pop ebx
ret

Function at 0x4112c1
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x4125c0
push ebx
sub esp, 0x38
lea eax, [esp + 0x1c]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x1c], 0x10
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x412612
mov eax, dword [esp + 0x24]
mov dword [ebx], eax
movzx eax, word [esp + 0x22]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [ebx + 4], ax
sub esp, 4
xor eax, eax
add esp, 0x38
pop ebx
ret

Function at 0x4112f8
Capabilities:
Resolve dns

Disassembly:
jmp 0x4123d0
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x24]
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
test eax, eax
je 0x4123ef
cmp word [eax + 8], 2
je 0x412410
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
sub esp, 4
cmp eax, 0xffffffff
je 0x412424
mov edx, dword [esp + 0x20]
mov dword [edx], eax
xor eax, eax
add esp, 0x18
pop ebx
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ecx], eax
add esp, 0x18
xor eax, eax
pop ebx
ret
mov eax, 0xffffffff
jmp 0x412408
Function at 0x4113e3
Capabilities:
Get socket status

Disassembly:
jmp 0x412c30
push ebp
push edi
mov edx, 0x10624dd3
push esi
push ebx
sub esp, 0x23c
mov ecx, dword [esp + 0x258]
mov ebx, dword [esp + 0x254]
mov esi, dword [esp + 0x250]
mov dword [esp + 0x28], 0
mov dword [esp + 0x12c], 0
mov eax, ecx
mul edx
mov eax, dword [ebx]
shr edx, 6
mov dword [esp + 0x20], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
test al, 1
mov dword [esp + 0x24], ecx
je 0x412c9c
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], 1
test al, 2
je 0x412cac
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
lea eax, [esp + 0x20]
lea ebp, [esp + 0x12c]
lea edi, [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esi + 1]
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
test eax, eax
js 0x412d35
mov dword [ebx], 0
jne 0x412d00
xor eax, eax
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.00411514
sub esp, 8
test eax, eax
jne 0x412d30
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00411514
sub esp, 8
test eax, eax
je 0x412cea
or dword [ebx], 2
jmp 0x412cea
or dword [ebx], 1
jmp 0x412d13
mov eax, 0xffffffff
jmp 0x412cec

Function at 0x411591
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x4122e0
push ebx
sub esp, 0x1a8
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
mov ebx, eax
jne 0x412350
movzx edx, word [esp + 0x10]
cmp dl, 1
jne 0x412333
shr dx, 8
cmp dx, 1
jne 0x412333
mov dword [esp], 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
sub esp, 4
add esp, 0x1a8
mov eax, ebx
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 0xffffffff
add esp, 0x1a8
mov eax, ebx
pop ebx
ret
mov ebx, 0xffffffff
jmp 0x412329
Function at 0x4115af
Capabilities:
Set socket configuration

Disassembly:
jmp 0x412690
sub esp, 0x3c
mov eax, dword [esp + 0x44]
cmp eax, 9
ja case.0x4126a0.60
jmp dword [eax*4 + 0x428f24]
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
sete al
movzx eax, al
neg eax
add esp, 0x3c
ret
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0x8004667e
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
jmp 0x4126e0
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x20
mov dword [esp + 0xc], eax
nop
lea esi, [esi]
mov eax, dword [esp + 0x40]
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
jmp 0x4126e0
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1002
mov dword [esp + 0xc], eax
jmp 0x412740
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1001
mov dword [esp + 0xc], eax
jmp 0x412740
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 4
mov dword [esp + 0xc], eax
jmp 0x412740
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1006
mov dword [esp + 0xc], eax
jmp 0x412740
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1005
mov dword [esp + 0xc], eax
jmp 0x412740
mov eax, 0xffffffff
jmp 0x4126eb

Function at 0x41162c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
jmp 0x412660
sub esp, 0x1c
xor eax, eax
cmp dword [esp + 0x20], 2
mov dword [esp + 8], 0
mov dword [esp], 2
sete al
add eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
add esp, 0x1c
ret
Function at 0x414690
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
mov esi, eax
mov eax, edx
lea edx, [esi + 0xc8]
sub esp, 0x2c
mov ebx, dword [esi + 0xc8]
mov byte [esp + 0x14], cl
cmp ebx, edx
je 0x414796
mov ebp, ecx
jmp 0x4146ca
mov ebx, dword [ebx]
cmp ebx, edx
je 0x414790
cmp word [ebx + 8], ax
jne 0x4146c0
cmp byte [ebx + 0x21], cl
jne 0x4146c0
cmp ebx, edx
mov byte [esp + 0x14], cl
mov ecx, ebp
je 0x414796
mov ebp, 1
movzx ecx, cl
cmp ecx, dword [esi + 0x2c]
jae 0x414720
imul ecx, ecx, 0x3c
mov eax, dword [esi + 0x28]
shr edi, 0xc
mov dword [esp + 0x14], edi
add eax, ecx
lea edi, [eax + edi*2]
movzx ecx, word [edi + 6]
test cx, cx
je 0x414720
sub ecx, 1
test cx, cx
mov word [edi + 6], cx
je 0x41480c
nop
lea esi, [esi]
movzx eax, byte [ebx + 0x20]
mov dword [esp], ebx
mov dword [esp + 0x14], edx
mov edi, eax
call fcn.00411131
mov eax, dword [ebx + 0x50]
and edi, 0xf
mov edx, dword [esp + 0x14]
test eax, eax
je 0x414757
test ebp, ebp
je 0x41474e
movzx ecx, word [ebx + 0x1c]
sub dword [esi + 0xb8], ecx
sub dword [eax], 1
je 0x4147f0
mov dword [esp], ebx
mov dword [esp + 0x14], edx
call fcn.004114d3
mov eax, dword [esi + 0xc8]
mov edx, dword [esp + 0x14]
cmp eax, edx
je 0x41482d
mov edx, dword [eax + 0xc]
add edx, dword [eax + 0x10]
mov eax, edi
mov dword [esi + 0x50], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [esp + 0x14], cl
mov ecx, ebp
mov ebx, dword [esi + 0xd8]
lea ebp, [esi + 0xd8]
mov dword [esp + 0x18], ebp
cmp ebx, ebp
je 0x414823
cmp word [ebx + 0x1e], 0
je 0x414823
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov edx, dword [esp + 0x18]
movzx ecx, byte [esp + 0x14]
jmp 0x4147cf
mov ebx, dword [ebx]
cmp ebx, edx
je 0x414823
cmp word [ebx + 0x1e], 0
je 0x414823
cmp word [ebx + 8], ax
jne 0x4147c2
cmp byte [ebx + 0x21], cl
jne 0x4147c2
cmp ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, ebp
je 0x414823
xor ebp, ebp
jmp 0x4146e8
or dword [eax + 4], 0x100
mov dword [esp], eax
mov dword [esp + 0x14], edx
call fcn.00411438
mov edx, dword [esp + 0x14]
jmp 0x414757
movzx ecx, byte [esp + 0x14]
mov edi, 1
shl edi, cl
not edi
and word [eax + 4], di
jmp 0x414720
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
jmp 0x414780
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.10023120
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.10023120
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.10023120
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x1004cad
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 8], ebx
jne 0x1004cc5
xor eax, eax
jmp 0x1004d45
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x1004d43
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x7fff
jae 0x1004d39
push esi
call sub.cmutil.dll_CmMalloc
mov edi, eax
cmp edi, ebx
je 0x1004d39
push ebx
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004d39
cmp byte [edi], bl
mov eax, edi
je 0x1004d39
mov cl, byte [eax]
cmp cl, 9
je 0x1004d37
cmp cl, 0xa
je 0x1004d37
cmp cl, 0xd
je 0x1004d37
inc eax
cmp byte [eax], bl
jne 0x1004d1f
jmp 0x1004d39
mov byte [eax], bl
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 4

Function at 0x42b4c6
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0042b545
jae 0x42b4d2
xor ecx, ecx
call fcn.0042b545
jae 0x42b4fc
xor eax, eax
call fcn.0042b545
jae 0x42b50d
mov al, 0x10
call fcn.0042b545
adc al, al
jae 0x42b4ee
jne 0x42b53a
stosb byte es:[edi], al
jmp 0x42b4d3
call fcn.0042b551
dec ecx
loop 0x42b519
mov eax, ebp
call fcn.0042b54f
jmp 0x42b53b
lodsb al, byte [esi]
shr eax, 1
je 0x42b561
adc ecx, 2
mov ebp, eax
jmp 0x42b53b
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0042b54f
cmp eax, 0x7d00
jae 0x42b539
cmp eax, 0x500
jae 0x42b53a
cmp eax, 0x7f
ja 0x42b53b
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x42b4d3
pop ebp
ret 8
Function at 0x105cd1f0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov edi, ebx
cmp al, 0x60
shr al, 5
pushfd
push dword [esp + 4]
mov al, 0x2e
bt ecx, 1
pushal
call fcn.103a13e5
invalid

Function at 0x105d43ac
Capabilities:
Check for software breakpoints

Disassembly:
not ah
movzx eax, bl
call fcn.103a45f6
add byte [eax], al
dec edi
jo 0x103a4136
outsb dx, byte [esi]
push eax
jb 0x103a413e
outsb dx, byte [esi]
je 0x103a413d
jb 0x103a411b
add bh, dl
push ebp
invalid
popfd
add byte [ecx], ch
ja 0x103a4188
dec ebx
cmp eax, 0x42ed5ac5
inc ecx
popfd
test al, 0xb4
sti
mov al, 0xbe
xor al, byte [ecx + 0x3ad753f2]
inc ecx
and al, 0x4f
jmp 0x103a4149
jb 0x103a4110
insd dword es:[edi], dx
pop eax
sbb dl, cl
stosb byte es:[edi], al
and al, 0xbf
insb byte es:[edi], dx
dec ebp
mov eax, dword [0x620a3bc9]
salc
mov dword [ecx + 0x22b492e5], ecx
mov edi, 0xc9a14d6c
cmp ecx, dword [edx]
invalid
in eax, 0x92
mov ah, 0x22
out 0xc5, al
xchg esp, eax
mov dh, 0x5d
imul eax, dword [edi - 0x1a], 0x6e0c0fa6
fldln2
xor byte [edi + 0x4a22de8], al
in eax, 0x92
lodsb al, byte [esi]
invalid
fld xword [edx - 0x777e063]
cmp bh, 0xcc
pop esp
scasb al, byte es:[edi]
pop dword [edx + 0x39ca0aa5]
or eax, 0x3541fec9
outsb dx, byte [esi]
jmp 0x103a41ab
sbb al, 0x86
ret
mov byte [esp + 4], ah
repne scasb al, byte es:[edi]
pushfd
pushfd
mov word [esp], 0xb238
pushfd
lea esp, [esp + 0x30]
jne 0x105d9614
not al
movsx ax, bl
lea eax, [ecx*2 - 0x46460776]
mov eax, ebp
mov byte [edi - 1], 0
jmp 0x103a40c2
Function at 0x404240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40429c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40429c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40428a
cmp esi, edx
jae 0x40429c
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404278
cmp esi, edx
jae 0x40429c
cmp word [esi], 0
je 0x40429c
mov eax, esi
lfence
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x406720
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x406759
mov eax, dword [esi + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x406750
mov eax, dword [eax]
push 1
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x4c758c]
mov ecx, dword [ebp - 4]
call edi
mov esi, dword [esi]
mov eax, dword [ebx + 4]
cmp esi, eax
jne 0x406732
mov ecx, dword [eax + 4]
mov dword [ecx], 0
mov eax, dword [eax]
test eax, eax
je 0x40677b
mov esi, dword [eax]
push 0xc
push eax
call fcn.00450975
add esp, 8
mov eax, esi
test esi, esi
jne 0x406768
mov eax, dword [ebx + 4]
mov dword [eax], eax
mov eax, dword [ebx + 4]
mov dword [eax + 4], eax
mov dword [ebx + 8], 0
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
cmp esi, eax
je 0x4067bd
mov eax, dword [esi + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x4067b4
mov eax, dword [eax]
push 1
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x4c758c]
mov ecx, dword [ebp - 4]
call edi
mov esi, dword [esi]
mov eax, dword [ebx + 0xc]
cmp esi, eax
jne 0x406796
mov ecx, dword [eax + 4]
mov dword [ecx], 0
mov eax, dword [eax]
test eax, eax
je 0x4067e3
nop dword [eax]
mov esi, dword [eax]
push 0xc
push eax
call fcn.00450975
add esp, 8
mov eax, esi
test esi, esi
jne 0x4067d0
mov eax, dword [ebx + 0xc]
mov dword [eax], eax
mov eax, dword [ebx + 0xc]
mov dword [eax + 4], eax
mov dword [ebx + 0x10], 0
mov esi, dword [0x4fa644]
test esi, esi
jne 0x40685d
push str.sciter.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x406853
push str.SciterAPI
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40684c
mov ecx, edi
call dword [0x4c758c]
call edi
mov dword [0x4fa644], eax
mov esi, dword [eax + 0x26c]
mov ecx, esi
call dword [0x4c758c]
call esi
test eax, eax
je 0x406853
mov dword [0x4fa640], eax
jmp 0x406853
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [0x4fa644]
test esi, esi
je 0x40687f
mov esi, dword [esi + 0x148]
mov ecx, esi
push ebx
push 0x406150
push dword [ebp + 8]
call dword [0x4c758c]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.004a32de
int3