joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c658
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403518
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x41c6b9
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x41c6b9
cmp byte [ebp - 0x102], 0
je 0x41c6b9
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403744
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41da48
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x28], 0
je 0x41dac9
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41da7a
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41da8c
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x41da98
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.0041d8d4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41dabd
push ebp
mov eax, dword [ebp - 4]
call fcn.0041d9b8
pop ecx
mov ebx, eax
cmp bl, 2
je 0x41da98
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f8c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x430714
cmp dword [edi], 0
jne 0x41f93c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x430710]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x42f730
mov ecx, 2
call fcn.00402690
mov edx, 0x41f898
lea eax, [esi + 5]
call fcn.0041f8b8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041f8b8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41f911
mov dword [0x430710], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41fa60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41fab0]
test si, 4
je 0x41fa74
or bl, 1
test si, 8
je 0x41fa7e
or bl, 4
test si, 1
je 0x41fa88
or bl, 8
test si, 2
je 0x41fa92
or bl, 0x10
test si, 0x10
je 0x41fa9c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41faab
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x41fab4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41faec]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41facd
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41fadc
or bl, 4
test esi, 0x20000000
je 0x41fae7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x423bb8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x423d5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40aeac]
call fcn.00402aa4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403518
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x423d33
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0041bdf8
test al, al
je 0x423d26
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x423d6c
lea eax, [ebp - 0x254]
call fcn.00406c20
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x423d26
xor eax, eax
push ebp
push 0x423d1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x423da4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x423d08
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403744
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x423d08
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423d26
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x423c29
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0040d7e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423d64
lea eax, [ebp - 0x260]
call fcn.00403518
ret
Function at 0x423f48
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4306e8]
cmp byte [eax + 0x85], 0
jne 0x423fb9
cmp dword [0x430720], 0
jne 0x423f7a
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x423f04
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x430720], eax
cmp dword [0x43071c], 0
jne 0x423f95
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x43071c], eax
cmp dword [0x430724], 0
jne 0x423fb9
push esp
push 0
push 0
push 0x423ea8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x430724], eax
pop edx
ret

Function at 0x4240a8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4240bf
add esp, 0xfffffff0
call fcn.00402c80
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00410090
mov dl, 1
mov eax, dword [0x40abf0]
call fcn.00402aa4
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, dword [0x40abf0]
call fcn.00402aa4
mov dword [ebx + 0x88], eax
xor eax, eax
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x40], 0x80000018
mov dword [ebx + 0x58], 0x1f4
mov dword [ebx + 0x5c], 0x32
mov dword [ebx + 0x60], 0x9c4
mov byte [ebx + 0x68], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, dword [0x4112a0]
call fcn.00414160
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x424218
mov eax, dword [0x42fa58]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004144f8
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x42584c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x42fa58]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040923c
test eax, eax
je 0x4241a0
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00406674
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00409264
test eax, eax
je 0x4241b4
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403744
mov eax, dword [0x42f9e4]
cmp byte [eax], 0
jne 0x4241e5
mov eax, ebx
call fcn.004242fc
mov byte [ebx + 0x3d], 1
mov byte [ebx + 0x3e], 1
mov byte [ebx + 0x3f], 1
mov byte [ebx + 0x7e], 1
xor eax, eax
mov dword [ebx + 0x80], eax
cmp byte [ebp - 1], 0
je 0x42420d
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424550
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4306e8]
cmp dword [eax + 0x24], 0
je 0x4245e0
cmp dword [ebx + 0x74], 0
jne 0x4245dd
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4244e4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x70]
cmp dword [eax + 8], 0
je 0x4245dd
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4245ac
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x70]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4245dd
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x70]
call fcn.0040bc68
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4245b8
inc dword [ebx + 0x74]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x424ec8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x84], 0
je 0x424efd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004035fc
jmp 0x424f07
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.004035b0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x425ad0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x64]
test esi, esi
je 0x425b08
mov eax, esi
call fcn.0041ad08
test al, al
je 0x425b08
mov eax, dword [ebx + 0x64]
call fcn.0041ab70
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x425b08
push 0
mov eax, dword [ebx + 0x64]
call fcn.0041ab70
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x679a5446
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x470616f7
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x42c3a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x40], 0
mov dword [ebp - 8], 0x4000
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 2
call fcn.0042d515
test eax, eax
je 0x42c3dd
jmp 0x42c57e
push dword [ebp - 8]
push 0x40
call dword [0x4090b8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42c3f6
jmp 0x42c57e
mov dword [ebp - 0x3c], 0x74654e57
mov dword [ebp - 0x38], 0x6d756e45
mov dword [ebp - 0x34], 0x6f736552
mov dword [ebp - 0x30], 0x65637275
mov dword [ebp - 0x2c], 0x41
lea eax, [ebp - 0x3c]
push eax
push 0x409e70
call dword [0x409104]
push eax
call dword [0x4090f4]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.0042d4d9
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x42c555
and dword [ebp - 0x44], 0
jmp 0x42c46d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jae 0x42c553
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 1
je 0x42c52d
or dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409e78
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x150]
push eax
call dword [0x4090c4]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
je 0x42c52d
push dword [ebp - 0x154]
call dword [0x409110]
lea eax, [ebp - 0x150]
push eax
call dword [0x409118]
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409a34
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
call fcn.0042a7ed
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 2
je 0x42c54e
mov eax, dword [ebp - 0x44]
shl eax, 5
add eax, dword [ebp - 0xc]
push eax
call fcn.0042c3a2
jmp 0x42c466
jmp 0x42c560
cmp dword [ebp - 0x40], 0x103
je 0x42c560
jmp 0x42c56d
cmp dword [ebp - 0x40], 0x103
jne 0x42c432
push dword [ebp - 0xc]
call dword [0x4090a0]
push dword [ebp - 4]
call fcn.0042d50f
leave
ret 4

Function at 0x49f418
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x49f418
lcall 0x5de5, 0x8b10c483
jmp loc.00aad1b0
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x416bf3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4213dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f9de
and dword [ebp - 0x14], 0
cmp dword [0x81e434], 0
mov dword [ebp - 0x18], eax
jne 0x416ca6
push 0x403fe0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416d4e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fd4
push ebx
call edi
test eax, eax
je 0x416d4e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fc4
push ebx
mov dword [0x81e434], eax
call edi
push eax
call esi
push 0x403fb0
push ebx
mov dword [0x81e438], eax
call edi
push eax
call esi
push 0x403f94
push ebx
mov dword [0x81e43c], eax
call edi
push eax
call esi
mov dword [0x81e444], eax
test eax, eax
je 0x416ca6
push 0x403f7c
push ebx
call edi
push eax
call esi
mov dword [0x81e440], eax
mov eax, dword [0x81e440]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416cff
cmp dword [0x81e444], ecx
je 0x416cff
push eax
call esi
push dword [0x81e444]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416cff
test ebx, ebx
je 0x416cff
call edi
test eax, eax
je 0x416cf6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416cf6
test byte [ebp - 8], 1
jne 0x416cff
or dword [ebp + 0x10], 0x200000
jmp 0x416d32
mov eax, dword [0x81e438]
cmp eax, dword [ebp - 0x18]
je 0x416d32
push eax
call esi
test eax, eax
je 0x416d32
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416d32
mov eax, dword [0x81e43c]
cmp eax, dword [ebp - 0x18]
je 0x416d32
push eax
call esi
test eax, eax
je 0x416d32
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x81e434]
call esi
test eax, eax
je 0x416d4e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416d50
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b55e
leave
ret
Function at 0x427f00
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00427f8f
jae 0x427f0e
xor ecx, ecx
call fcn.00427f8f
jae 0x427f3d
xor eax, eax
call fcn.00427f8f
jae 0x427f4d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00427f8f
adc al, al
jae 0x427f2f
jne 0x427f79
stosb byte es:[edi], al
jmp 0x427f11
call fcn.00427f9b
sub ecx, ebx
jne 0x427f56
call fcn.00427f99
jmp 0x427f75
lodsb al, byte [esi]
shr eax, 1
je 0x427f83
adc ecx, ecx
jmp 0x427f72
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00427f99
cmp eax, 0x7d00
jae 0x427f72
cmp ah, 5
jae 0x427f73
cmp eax, 0x7f
ja 0x427f74
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x427f11
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x4013bb
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c0a0
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40c2cf
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov ebp, dword [sym.imp.USER32.dll_ReleaseDC]
nop dword [eax]
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0xa9
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0xec
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0x9f
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
xor byte [edi + ebx], 0xd
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0x78
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0xa4
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0x53
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
xor byte [edi + ebx], 0xab
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0x92
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0x6b
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
xor byte [edi + ebx], 7
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0xe7
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
xor byte [edi + ebx], 0x59
push str.dHJdvghcgyhushgjdshgj
push 0x4d7888
call fcn.00402d5b
add esp, 8
push eax
call fcn.00406113
add esp, 4
push 0
push 0
call ebp
add byte [edi + ebx], 0x62
inc ebx
cmp esi, ebx
jne 0x40c0c0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100012b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
push esi
push edi
lea esi, [ecx - 0x3eb]
add edx, 0xfffff841
lea edi, [ecx + 0xcf]
cmp edi, esi
je 0x100014b4
mov eax, dword [esp + 0xc]
xor esi, esi
push ebx
mov dword [eax + 0x88], 0x1000f0f0
nop word [eax + eax]
mov ecx, dword [eax + 0x80]
sub ecx, dword [eax + 0x70]
add ecx, 0xc683c
add dword [eax + 0x74], ecx
mov ecx, dword [eax + 0x88]
mov edx, dword [esi + ecx]
add esi, 4
mov ecx, dword [eax + 0x3c]
xor ecx, dword [eax + 0xd4]
sub ecx, 0x11
movzx ebx, dl
add dword [eax + 0x70], ecx
mov ecx, dword [eax + 0xf0]
or dword [eax + 0x120], ecx
movzx ecx, byte [eax + 0x50]
mov edx, dword [eax + 0x54]
imul ebx, ecx
mov ecx, dword [eax + 0x8c]
mov byte [edx + ecx], bl
inc dword [eax + 0x54]
mov ecx, dword [eax + 0x34]
xor ecx, 0xc
sub dword [eax + 0x74], ecx
mov ecx, 0xfff62729
sub ecx, dword [eax + 0x20]
add dword [eax + 0xf4], ecx
mov ecx, dword [eax + 0xe8]
sub dword [eax + 0x74], ecx
mov ecx, dword [eax + 0x118]
add ecx, 0xfffcbb5f
add ecx, dword [eax + 0x74]
imul ecx, dword [eax + 0x10c]
mov dword [eax + 0x10c], ecx
mov ecx, dword [eax + 0x34]
sub ecx, 0xc
add dword [eax + 0xa4], ecx
mov ecx, dword [eax + 0x118]
add ecx, 0x18ad75
mov dword [eax + 0x70], ecx
add ecx, 0xffe7528b
add dword [eax + 0xf4], ecx
mov ecx, dword [eax + 0xfc]
sub ecx, dword [eax + 0xac]
sub ecx, 2
imul ecx, dword [eax + 0xcc]
mov dword [eax + 0xcc], ecx
mov ecx, dword [eax + 0x80]
add ecx, 0xfff3bac7
add ecx, dword [eax + 0xbc]
add dword [eax + 0x10c], ecx
mov ecx, dword [eax + 0x70]
xor ecx, 0x18ad74
imul ecx, dword [eax + 0xd4]
mov dword [eax + 0xd4], ecx
cmp esi, 0x8790
jl 0x100012f0
cmp dword [eax + 0x80], 0x5f15
pop ebx
je 0x10001412
mov dword [eax + 0x100], 0x10262a70
mov ecx, dword [eax + 0xc8]
add ecx, dword [eax + 0xc]
add ecx, dword [eax + 8]
xor ecx, 0xcb736a66
xor esi, esi
mov dword [eax + 0x128], ecx
nop dword [eax]
mov edx, dword [eax + 0x90]
mov ecx, dword [eax + 0x78]
xor dword [edx + esi], ecx
add esi, 4
mov ecx, dword [eax + 0xc4]
add dword [eax + 0x78], ecx
mov ecx, dword [eax + 0xd4]
xor ecx, 0x10
imul ecx, dword [eax + 0xbc]
mov dword [eax + 0xbc], ecx
mov ecx, dword [eax]
xor ecx, 0xfff9c156
imul ecx, dword [eax + 0xcc]
mov dword [eax + 0xcc], ecx
cmp esi, 0xc8774
jl 0x10001430
mov edx, dword [eax + 0xb0]
cmp dword [eax + 0x34], edx
ja 0x1000149b
mov ecx, dword [eax + 0x90]
mov dword [eax + 0x84], ecx
lea eax, [edi - 0x25a]
pop edi
pop esi
ret
mov ecx, dword [eax + 0x94]
add ecx, edx
add ecx, dword [eax + 0x74]
imul ecx, dword [eax]
mov dword [eax], ecx
lea eax, [edi - 0x25a]
pop edi
pop esi
ret
mov eax, edx
xor eax, dword [esp + 0x20]
xor eax, 0x27f3
cmp esi, eax
je 0x100014cf
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 4]
sub eax, edx
xor dword [ecx + 0x74], eax
lea eax, [edi - 0x25a]
pop edi
pop esi
ret