joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ed3c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47ee10
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x800
lea eax, [ebx + 0x30]
push eax
mov eax, dword [ebx + 0xa50]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x834], eax
cmp word [ebx + 0xa2a], 0
je 0x47edfa
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x47ee24
call fcn.0040949c
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x834]
mov edx, ebx
mov eax, dword [ebx + 0xa2c]
call dword [ebx + 0xa28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ee17
lea eax, [ebp - 8]
call fcn.004043e4
ret
Function at 0x401411
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xc350
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
push 0x1388
push dword [ebp - 4]
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextA
push dword [ebp - 4]
call fcn.00401210
mov dword [ebp - 8], eax
push dword [ebp - 4]
call sub.kernel32.dll_GlobalFree
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x401450
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xc350
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
push 0x1388
push dword [ebp - 4]
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextA
or eax, eax
jne 0x401482
mov dword [ebp - 8], 1
jmp 0x401489
mov dword [ebp - 8], 0
push dword [ebp - 4]
call sub.kernel32.dll_GlobalFree
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x4015f3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov edi, dword [ebp + 8]
push edi
call sub.kernel32.dll_IsBadCodePtr
or eax, eax
je 0x401608
jmp 0x401638
cmp word [edi], 0x5a4d
jne 0x401638
add edi, dword [edi + 0x3c]
push edi
call sub.kernel32.dll_IsBadCodePtr
or eax, eax
je 0x40161e
jmp 0x401638
cmp dword [edi], 0x4550
jne 0x40162f
mov dword [ebp - 4], 1
jmp 0x40163f
mov dword [ebp - 4], 0
jmp 0x40163f
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x401a6d
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
push eax
call fcn.00401b1f
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x401ae5
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 4]
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 4
push dword [ebp - 8]
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
cmp eax, 0xffffffff
je 0x401b1b
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call sub.kernel32.dll_RtlMoveMemory
push dword [ebp - 0x14]
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0xc]
mov dword [0x4050db], eax
leave
ret 8

Function at 0x401b34
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401b78
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
leave
ret 0xc
Function at 0x401b7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
push dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push dword [ebp + 0xc]
push 0
push 0
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_CreateProcessA
leave
ret 0xc

Function at 0x401c3b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0x405910
push 0
push 0
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x3515a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x35180d
jne 0x35180d
je 0x3511e6
jne 0x3512ed
add byte [eax], al
add byte [eax], al

Function at 0x353620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x23c
mov edi, dword [ebp + 0xc]
je 0x3537a8
jne 0x3537a8
Function at 0x354860
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x3548b6
jne 0x3548b6
jmp 0x3ea183b2
inc ebp
cmp ebp, dword [esi + edi + 0x18]
jb 0x3548d7
xor eax, eax
jmp 0x354890
mov eax, dword [esp]
je 0x35487c
jne 0x35487c
jmp 0x6841ff8f
movzx ecx, word [eax + ebp*2]
xor eax, eax
cmp dword [esi + edi + 0x14], ecx
jb 0x354890
mov eax, dword [esi + edi + 0x1c]
je 0x3548f9
jne 0x3548f9
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + edi + 0x24]
mov ebx, dword [esi + edi + 0x20]
xor ebp, ebp
je 0x35491b
jne 0x35491b
je 0x3524da
jne 0x35140a
push eax
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ecx, dword [edx]
cmp dword [ecx + 0x7c], 0
je 0x354890
je 0x354938
jne 0x354938
je 0x35369f
jne 0x352cb7
je 0x1e04d66
mov eax, dword [ebx + ebp*4]
add eax, esi
push eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x20]
call dword [eax + 0x24]
je 0x354907
invalid
jne 0x354907
je 0x35268a
jne 0x352922
jmp 0x3c3558a
lea ecx, [esi + ecx*4]
add esi, dword [eax + ecx]
mov eax, esi
je 0x354890
jne 0x354890
je 0x84450990
test eax, eax
je 0x354874
invalid
je 0x354869
jne 0x354869
add eax, esi
add ebx, esi
mov dword [esp], eax
nop word cs:[eax + eax]
nop dword [eax]
je 0x3548d7
jne 0x3548d7
add byte [eax], al
add byte [eax], al
mov esi, dword [edx + 4]
mov edi, dword [ecx + 0x78]
cmp dword [edi + esi + 0x18], 0
je 0x354890
cmp dword [esi + edi + 0x14], 0
je 0x354890
je 0x35489c
jne 0x35489c
push ebp
push ebx
je 0x354a05
jne 0x354a05
je 0x3d8a3b
mov dword [eax + 8], 0
mov dword [eax + 0x10], 0
mov ebx, ecx
push dword [esp + 0x20]
push dword [esp + 0x20]
push eax
je 0x3549d8
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ecx + 0x2474ffcb], cl
and bh, bh
je 0x3549ab
and byte [eax + 0x74], dl
dec ebp
jne 0x3549d8
je 0x3513d2
jne 0x35363b
add byte [eax], al
add byte [eax], al
test edi, edi
je 0x3549fb
push 0x8000
push 0
push edi
call dword [ebx + 0xc]
je 0x3549fb
or al, 0x74
dec ebp
jne 0x3549fb
jmp 0x8171a740
mov ebx, dword [ebp + 0x3c]
cmp dword [ebp + ebx], 0x4550
jne 0x3549fb
mov edi, dword [esp + 0x14]
add ebx, ebp
push 4
je 0x3549ca
jne 0x3549ca
push 0x3000
push 0x14
push 0
je 0x354a1c
jne 0x354a1c
jmp 0xec78322d
push ecx
call fcn.00353620
add esp, 0x10
test eax, eax
je 0x3549f0
mov esi, edi
mov dword [edi + 0x10], 1
jmp 0x3549fb
je 0x35499d
jne 0x35499d
pop ebx
pop ebp
ret
mov eax, esi
pop esi
pop edi
je 0x3549f4
jne 0x3549f4
je 0x6cc0a060
push edi
push esi
mov ebp, dword [esp + 0x18]
and al, 0x18
xor esi, esi
movzx eax, word [ebp]
cmp eax, 0x5a4d
jne 0x3549fb
je 0x3549b1
jne 0x3549b1
call dword [edi]
mov ecx, edi
mov dword [eax + 4], ebp
mov dword [eax], ebx
mov edi, eax
mov dword [eax + 0xc], 0
je 0x354970
jne 0x354970
nop word [eax + eax]
ret
Function at 0x357f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1400
call fcn.00394b40
mov eax, dword [esp + 0x1418]
movdqa xmm4, xmmword [0x39a290]
movdqa xmm6, xmmword [0x39a2a0]
mov esi, 0xfffffc00
pxor xmm2, xmm2
nop
movdqa xmm3, xmm4
movdqa xmm7, xmmword [0x39a2c0]
movdqa xmm0, xmm4
movdqa xmm1, xmm4
movdqa xmm5, xmm4
pand xmm3, xmm6
psrld xmm0, 6
pand xmm1, xmmword [0x39a320]
pcmpeqd xmm3, xmm2
pand xmm3, xmmword [0x39a2b0]
pcmpeqd xmm1, xmm2
pand xmm1, xmmword [0x39a330]
pxor xmm0, xmm3
movdqa xmm3, xmm4
pand xmm3, xmm7
movdqa xmm7, xmmword [0x39a2e0]
pcmpeqd xmm3, xmm2
pand xmm3, xmmword [0x39a2d0]
pand xmm5, xmm7
movdqa xmm7, xmmword [0x39a350]
pcmpeqd xmm5, xmm2
pand xmm5, xmmword [0x39a2f0]
pxor xmm3, xmm0
pand xmm0, xmm6
pcmpeqd xmm0, xmm2
pxor xmm1, xmm5
movdqa xmm5, xmm4
pand xmm5, xmmword [0x39a340]
pcmpeqd xmm5, xmm2
pand xmm5, xmm7
pxor xmm5, xmm1
movdqa xmm1, xmm4
paddd xmm4, xmmword [0x39a2e0]
pand xmm1, xmmword [str._b_b_b_b]
pxor xmm5, xmm3
pand xmm3, xmmword [0x39a2c0]
pcmpeqd xmm1, xmm2
pcmpeqd xmm3, xmm2
pand xmm1, xmmword [0x39a310]
pand xmm3, xmm7
pxor xmm5, xmm1
movdqa xmm1, xmm0
pand xmm0, xmmword [0x39a370]
pandn xmm1, xmmword [0x39a360]
psrld xmm5, 2
por xmm0, xmm1
pxor xmm0, xmm5
pxor xmm0, xmm3
movdqu xmmword [esp + esi + 0x400], xmm0
add esi, 0x10
jne 0x357fb0
mov esi, eax
mov eax, 0xfffffc00
shr esi, 2
nop word [eax + eax]
mov ebx, dword [esp + eax + 0x400]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
mov dword [esp + eax + 0x800], ebx
add eax, 4
jne 0x3580d0
mov eax, dword [esp]
mov edi, dword [esp + 0x400]
xor ebp, ebp
mov ebx, eax
shr ebx, 8
nop
mov ecx, eax
xor ecx, ebp
movzx ecx, cl
mov ecx, dword [esp + ecx*4]
xor ecx, ebx
movzx edx, cl
shr ecx, 8
xor ecx, dword [esp + edx*4]
movzx edx, cl
shr ecx, 8
mov edx, dword [esp + edx*4]
xor edx, edi
xor edx, ecx
mov dword [esp + ebp*4 + 0x800], edx
inc ebp
cmp ebp, 0x100
jne 0x358110
movzx eax, al
Function at 0x35a959
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax], al
push 3
push 0
push 0
push 1
je 0x35a941
jne 0x35a941
je 0x77b9b77e
add al, byte [eax]
add byte [edi], cl
test dword [ecx + 2], esi
add byte [eax], al
je 0x35a9a0
jne 0x35a9a0
je 0x359616
jne 0x35984d
call dword [eax + 0xc]
cmp eax, edi
jne 0x35a981
je 0x35a8d6
jne 0x35a8d6
je 0x35898d
jne 0x35aa0c
jmp 0x3d77f45
jne 0x358913
je 0x35a80b
jne 0x35a80b
add byte [eax], al
add byte [eax], al

Function at 0x35adf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
je 0x35b0ab
jne 0x35b0ab
je 0x3593c2
jne 0x35a2d9
add byte [eax], al
add byte [eax], al
push ebx
push edi
push esi
je 0x35b126
jne 0x35b126
add byte [eax], al
add byte [eax], al

Function at 0x35b180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov byte [esp], 0
jmp 0x35b2a3
je 0x35b306
jne 0x35b306
Function at 0x382fc0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push esi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov esi, dword [edx]
mov dword [eax + 0x10], esi
mov esi, dword [edx + 4]
mov dword [eax + 0x14], esi
mov esi, dword [edx + 8]
mov dword [eax + 0x18], esi
mov esi, dword [edx + 0xc]
mov dword [eax + 0x1c], esi
lea esi, [edx + 0x10]
cmp ecx, 0x100
cmovne esi, edx
mov ecx, str.expand_32_byte_kexpand_16_byte_k
mov edx, 0x39a690
cmove edx, ecx
mov ecx, dword [esi]
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 4]
mov dword [eax + 0x24], ecx
mov ecx, dword [esi + 8]
mov dword [eax + 0x28], ecx
mov ecx, dword [esi + 0xc]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx]
mov esi, dword [edx + 4]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
pop esi
ret

Function at 0x3830f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov dword [esp + 0x78], ecx
mov eax, dword [edx]
mov dword [esp + 0x38], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0xc]
mov dword [esp + 0x44], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x48], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x4c], eax
mov eax, dword [edx + 0x18]
mov dword [esp + 0x50], eax
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x54], eax
mov eax, dword [edx + 0x20]
mov dword [esp + 0x58], eax
mov eax, dword [edx + 0x24]
mov dword [esp + 0x5c], eax
mov ebp, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
mov edi, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x74], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x68], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov ebp, dword [esp + 0x54]
Function at 0x38c660
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x38c6f3
mov dword [eax + 0x48], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x44], 0x5be0cd19
mov dword [eax + 0x40], 0x137e2179
xor eax, eax
ret
mov eax, 1
ret

Function at 0x38c7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x320
mov eax, 0xffffffc0
nop word cs:[eax + eax]
nop
movsd xmm0, qword [ecx + eax + 0x48]
movsd qword [esp + eax + 0x90], xmm0
add eax, 8
jne 0x38c810
mov dword [esp + 0x94], ecx
mov eax, 0xffffff80
mov ecx, dword [edx + eax + 0x80]
mov esi, dword [edx + eax + 0x84]
bswap esi
bswap ecx
mov dword [esp + eax + 0x11c], ecx
mov dword [esp + eax + 0x118], esi
add eax, 8
jne 0x38c830
mov eax, 0xfffffe00
nop word [eax + eax]
mov esi, dword [esp + eax + 0x308]
mov ecx, dword [esp + eax + 0x30c]
mov edi, ecx
shld edi, esi, 0xd
mov edx, esi
shld edx, ecx, 0xd
mov ebx, ecx
shld ebx, esi, 0x1a
xor ebx, edi
mov edi, ecx
shld edi, esi, 3
shld esi, ecx, 3
xor ebx, esi
mov dword [esp + 8], ebx
shr ecx, 6
xor ecx, edx
xor ecx, edi
mov edi, dword [esp + eax + 0x2a0]
mov edx, dword [esp + eax + 0x2a4]
mov esi, edx
shld esi, edi, 0x1f
mov ebx, edx
shld ebx, edi, 0x19
xor ebx, esi
mov esi, edx
shld esi, edi, 0x18
xor ebx, esi
mov esi, edi
shld esi, edx, 0x1f
shld edi, edx, 0x18
shr edx, 7
xor edx, esi
xor edx, edi
mov esi, dword [esp + eax + 0x298]
add esi, dword [esp + eax + 0x2e0]
mov edi, dword [esp + eax + 0x29c]
adc edi, dword [esp + eax + 0x2e4]
add esi, dword [esp + 8]
adc edi, ecx
add esi, ebx
adc edi, edx
mov dword [esp + eax + 0x318], esi
mov dword [esp + eax + 0x31c], edi
add eax, 8
jne 0x38c860
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x54]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x58]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x30], 0
nop word [eax + eax]
Function at 0x38d690
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
push edi
push esi
sub esp, 0xa0
mov esi, dword [esp + 0xb0]
mov edi, dword [esp + 0xb4]
push edi
push 0x20
push dword [esp + 0xc0]
call fcn.0038d460
add esp, 0xc
and byte [edi], 0xf8
mov al, byte [edi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
mov ebx, esp
push edi
push ebx
call fcn.00387780
add esp, 8
push ebx
push esi
call fcn.00387710
add esp, 0xa8
pop esi
pop edi
pop ebx
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1087f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1087f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1087f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087f06a
add dl, dl
jne 0x1087f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087f0dc
xor eax, eax
add dl, dl
jne 0x1087f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087f17d
add dl, dl
jne 0x1087f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1087f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1087f075
mov eax, 1
add dl, dl
jne 0x1087f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1087f0e1
sub eax, ebx
mov ebx, 1
jne 0x1087f128
mov ecx, 1
add dl, dl
jne 0x1087f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1087f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1087f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1087f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1087f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1087f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1087f136
cmp eax, 0x7d00
jae 0x1087f16d
cmp eax, 0x500
jb 0x1087f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1087f075
cmp eax, 0x7f
ja 0x1087f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1087f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1087f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1087f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x409944
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099f8
jmp 0x4099ed
cmp dword [esi + 0x10], 0x1000
jne 0x4099d9
test byte [esi + 0x15], 1
jne 0x4099d9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409998
cmp eax, 2
je 0x409998
cmp eax, 0x10
je 0x409998
cmp eax, 0x20
jne 0x4099ad
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4099ad
mov bl, 1
xor ebp, ebp
jmp 0x4099be
mov eax, dword [esi]
add eax, ebp
call fcn.0040993c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4099b1
test bl, bl
je 0x4099d9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099f8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409970
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx