joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053e20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x100]
mov byte [ebp + 0xb], cl
mov cl, byte [eax + 0x101]
mov byte [ebp - 1], cl
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x10053e80
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], ecx
inc byte [ebp + 0xb]
movzx ecx, byte [ebp + 0xb]
lea esi, [ecx + eax]
mov dl, byte [esi]
add byte [ebp - 1], dl
movzx ecx, byte [ebp - 1]
add ecx, eax
mov bl, byte [ecx]
mov byte [esi], bl
mov byte [ecx], dl
xor ecx, ecx
mov cl, byte [esi]
add ecx, edx
and ecx, 0xff
mov cl, byte [ecx + eax]
xor byte [edi], cl
inc edi
dec dword [ebp + 0xc]
jne 0x10053e4b
pop edi
pop esi
pop ebx
mov cl, byte [ebp + 0xb]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 1]
mov byte [eax + 0x101], cl
leave
ret

Function at 0x10055d6f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
cmp dword [0x100b9c70], 0
mov eax, dword [0x1009e0d0]
mov dword [ebp - 4], eax
jne 0x10055e5d
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10055e52
xor eax, eax
cmp dword [ebp - 0x88], 2
push esi
sete al
test eax, eax
mov dword [0x100b5214], eax
je 0x10055e20
push 0x100031cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x10055e51
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100031b0
push edi
call esi
test eax, eax
mov dword [0x100b9c5c], eax
je 0x10055e04
mov dword [0x100b5210], 0x4000
push 0x100031a4
push edi
call esi
push 0x1000318c
push edi
mov dword [0x100b9c60], eax
call esi
mov dword [0x100b9c64], eax
jmp 0x10055e51
push 0x10003180
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10055e51
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10003170
push edi
call esi
push 0x10003160
push edi
mov dword [0x100b9c54], eax
call esi
mov dword [0x100b9c58], eax
pop esi
mov dword [0x100b9c70], 1
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [0x100b5214]
call fcn.10007179
leave
ret
Function at 0x10056651
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x170
push esi
xor esi, esi
push edi
inc ecx
movzx edi, byte [ecx + 1]
xor edx, edx
mov dh, byte [ecx - 1]
mov dl, byte [ecx]
add ecx, 4
shl edx, 8
or edx, edi
movzx edi, byte [ecx - 2]
shl edx, 8
or edx, edi
mov dword [ebp + esi*4 - 0x170], edx
inc esi
cmp esi, 0x10
jb 0x10056661
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0x30]
push 0x40
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x168]
pop esi
mov ecx, dword [edx + 0x2c]
xor ecx, dword [edx + 0x18]
xor ecx, dword [edx - 8]
xor ecx, dword [edx]
add edx, 4
mov edi, ecx
shr edi, 0x1f
add ecx, ecx
or edi, ecx
dec esi
mov dword [edx + 0x34], edi
jne 0x1005669d
mov ecx, dword [eax]
mov edi, dword [eax + 8]
and dword [ebp - 4], 0
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 4]
and dword [ebp - 8], 0
push ebx
mov ebx, dword [eax + 0x10]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x170]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ebx
mov ebx, ecx
shl ecx, 5
shr ebx, 0x1b
or ebx, ecx
mov ecx, dword [ebp - 8]
cmp ecx, 0x3c
mov dword [ebp - 0x1c], ebx
jge 0x1005670c
cmp ecx, 0x28
jl 0x10056707
mov ecx, esi
or ecx, edi
and ecx, edx
mov ebx, esi
jmp 0x10056720
cmp ecx, 0x14
jl 0x10056714
mov ecx, edx
xor ecx, esi
xor ecx, edi
jmp 0x10056728
test ecx, ecx
jl 0x10056726
mov ecx, edx
not ecx
and ecx, esi
mov ebx, edx
and ebx, edi
or ecx, ebx
jmp 0x10056728
xor ecx, ecx
mov edi, dword [ebp - 0xc]
mov edi, dword [edi]
add edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x1c]
add edi, ecx
mov ecx, dword [ebp - 4]
add ebx, edi
cmp cx, 0x3c
jl 0x10056747
mov ecx, 0xca62c1d6
jmp 0x1005676f
cmp cx, 0x28
jl 0x10056754
mov ecx, 0x8f1bbcdc
jmp 0x1005676f
cmp cx, 0x14
jl 0x10056761
mov ecx, 0x6ed9eba1
jmp 0x1005676f
test cx, cx
jl 0x1005676d
mov ecx, 0x5a827999
jmp 0x1005676f
xor ecx, ecx
add dword [ebp - 0xc], 4
mov edi, edx
shr edx, 2
shl edi, 0x1e
or edi, edx
mov edx, dword [ebp - 0x18]
add ecx, ebx
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp word [ebp - 4], 0x50
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ecx
jl 0x100566e3
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], esi
mov dword [eax + 4], edx
lea ecx, [ebp - 0x30]
mov esi, ecx
mov edx, eax
push 5
sub edx, esi
pop esi
mov dword [eax + 8], edi
pop ebx
mov edi, dword [edx + ecx]
add dword [ecx], edi
add ecx, 4
dec esi
jne 0x100567bd
push 5
pop ecx
lea esi, [ebp - 0x30]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret
Function at 0x10056ae2
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x10056b2f
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, edx
sub ecx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov esi, dword [edi + edx]
mov ecx, dword [edx]
lea ebx, [ecx + esi]
add eax, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + edx], eax
mov ebx, ecx
xor ebx, esi
and ebx, eax
or ecx, esi
xor ebx, ecx
shr ebx, 0x1f
add edx, 4
dec dword [ebp + 0x14]
mov eax, ebx
jne 0x10056b06
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x10056d22
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x10056d6f
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
sub ecx, esi
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], edx
mov edi, dword [ebx + esi]
mov edx, dword [esi]
mov ecx, edi
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + esi], ecx
xor ecx, edi
xor edx, edi
or ecx, edx
xor ecx, edi
shr ecx, 0x1f
add esi, 4
dec dword [ebp + 0x14]
mov eax, ecx
jne 0x10056d46
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1005c791
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.1005c710
test eax, eax
je 0x1005c7d2
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push 0x100032ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8
Function at 0x1005c9f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x1005cb2b
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x1005cb00
test eax, eax
jne 0x1005cb00
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x1005ca40
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x1005cb2b
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x1005cb00
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x1005cf70
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4
Function at 0x10062a7b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009c224
call fcn.1009babc
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea ecx, [esi + 0x10]
mov dword [ebp - 4], edi
mov dword [esi], 0x10003368
mov dword [esi + 0xc], edi
call fcn.10009b78
push 0x1000bcd0
push fcn.10009b78
lea eax, [esi + 0x348]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x340], edi
mov dword [esi + 0x344], edi
push 3
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
push 0x1c
lea eax, [esi + 0x35c]
push eax
mov byte [ebp - 4], 1
call fcn.1009bbb9
push 0x10062896
push 0x1006244d
push 3
push 0x1c
lea eax, [esi + 0x3b0]
push eax
mov byte [ebp - 4], 2
call fcn.1009bbb9
lea ecx, [esi + 0x404]
call fcn.10009b78
lea ecx, [esi + 0x420]
call fcn.10009b78
lea ecx, [esi + 0x44c]
call fcn.1000bba9
xor eax, eax
lea edi, [esi + 0x40]
mov ecx, 0xc0
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10068280
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1009e0d0]
mov dword [ebp - 4], eax
mov eax, dword [0x100b9cdc]
push ebx
xor ebx, ebx
cmp eax, ebx
jg 0x100683a4
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x5c]
push eax
push 0x100034b4
push 0x80000002
mov dword [ebp - 0x6c], 0x50
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
call edi
mov esi, eax
cmp esi, ebx
jne 0x10068346
mov edx, dword [ebp - 0x5c]
lea ecx, [ebp - 0x58]
push ecx
push 0x100034a8
push edx
call edi
mov esi, eax
cmp esi, ebx
jne 0x10068346
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x60]
push eax
push 0x100034a0
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x10068346
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x64]
push edx
push 0x1000348c
push eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x10068346
mov edx, dword [ebp - 0x64]
lea ecx, [ebp - 0x68]
push ecx
push 0x10003488
push edx
call edi
mov esi, eax
cmp esi, ebx
jne 0x10068346
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x70]
push edx
push ebx
push 0x10003480
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp - 0x68]
cmp eax, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10068356
push eax
call edi
mov eax, dword [ebp - 0x64]
cmp eax, ebx
je 0x10068360
push eax
call edi
mov eax, dword [ebp - 0x60]
cmp eax, ebx
je 0x1006836a
push eax
call edi
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x10068374
push eax
call edi
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
je 0x1006837e
push eax
call edi
pop edi
cmp esi, ebx
pop esi
jne 0x1006839f
cmp dword [ebp - 0x70], 4
jne 0x1006839f
mov eax, dword [ebp - 0x54]
mov dword [0x100b9cdc], eax
pop ebx
mov ecx, dword [ebp - 4]
call fcn.10007179
mov esp, ebp
pop ebp
ret
call fcn.10068060
mov ecx, dword [ebp - 4]
pop ebx
call fcn.10007179
mov esp, ebp
pop ebp
ret
Function at 0x10086590
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movq mm7, qword [0x100b79a8]
mov eax, ecx
sar eax, 3
and ecx, 7
movq mm0, qword [edx]
pxor mm0, mm7
pxor mm1, mm1
pxor mm2, mm2
punpcklbw mm1, mm0
punpckhbw mm2, mm0
psraw mm1, 9
psraw mm2, 9
packsswb mm1, mm2
pxor mm1, mm7
movq qword [edx], mm1
add edx, 8
sub eax, 1
jne 0x1008659f
test ecx, ecx
je 0x100865e7
movzx eax, byte [edx]
sub eax, 0x80
sar eax, 1
add eax, 0x80
mov byte [edx], al
add edx, 1
sub ecx, 1
jne 0x100865ce
ret

Function at 0x100865f0
Capabilities:
Encode data using xor

Disassembly:
movq mm7, qword [0x100b79a8]
mov eax, ecx
sar eax, 3
and ecx, 7
movq mm0, qword [edx]
pxor mm0, mm7
paddsb mm0, mm0
pxor mm0, mm7
movq qword [edx], mm0
add edx, 8
sub eax, 1
jne 0x100865ff
test ecx, ecx
je 0x1008663f
movzx eax, byte [edx]
sub eax, 0x80
add eax, eax
add eax, 0x80
cmp eax, 0xff
jle 0x10086635
mov eax, 0xff
mov byte [edx], al
add edx, 1
sub ecx, 1
jne 0x1008661a
ret
Function at 0x55aa2b36
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x55aa2b90
push eax
push 0x55aa169a
call fcn.55aa2bce
push 7
push 0x55c010bc
push dword [eax + 0x30]
call fcn.55aa2f26
cmp eax, 0
jne 0x55aa2b6a
inc eax
jmp 0x55aa2b92
push 0x55aa16b2
call fcn.55aa2bce
push 7
push 0x55c010bc
push dword [eax + 0x30]
call fcn.55aa2f26
cmp eax, 0
jne 0x55aa2b8b
inc eax
jmp 0x55aa2b92
pop eax
mov eax, dword [eax]
jmp 0x55aa2b44
xor eax, eax
ret

Function at 0x55aa2ba8
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x55aa2bbc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x55aa2bce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x55c010bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0x18
stosw word es:[edi], ax
cmp ax, 0
jne 0x55aa2bdc
pop edi
pop esi
leave
ret 4

Function at 0x55aa2bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x55c010bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0x18
stosb byte es:[edi], al
cmp al, 0
jne 0x55aa2bfe
pop edi
pop esi
leave
ret 4

Function at 0x55aa2e31
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x55aa2e82
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x55aa2e82
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x55aa2e89
add edx, 4
loop 0x55aa2e49
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x55aa2e90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x55aa2edc
cmp dx, 0x41
jb 0x55aa2ec1
cmp dx, 0x5a
jbe 0x55aa2ec7
cmp dx, 0x61
jb 0x55aa2ed3
cmp dx, 0x7a
ja 0x55aa2ed3
xor dx, 0x20
jmp 0x55aa2ed5
jmp 0x55aa2eef
cmp dx, word [edi]
je 0x55aa2edc
jmp 0x55aa2eef
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x55aa2ead
mov eax, dword [eax + 0x18]
jmp 0x55aa2ef7
mov eax, dword [eax]
cmp ebp, eax
jne 0x55aa2ea2
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x55bfda7a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call sub.KERNEL32.DLL_GetTickCount
mov esi, 0x1f4
mov dword [0x55c01200], eax
push esi
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x55c01204], eax
sub eax, dword [0x55c01200]
xor ecx, ecx
cmp eax, esi
pop esi
setge cl
dec ecx
mov eax, ecx
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0xa10058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa101a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa1007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1006a
add dl, dl
jne 0xa10089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa100dc
xor eax, eax
add dl, dl
jne 0xa10096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1017d
add dl, dl
jne 0xa100a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa100b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa100bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa100c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa100d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa10075
mov eax, 1
add dl, dl
jne 0xa100ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa100f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa100e1
sub eax, ebx
mov ebx, 1
jne 0xa10128
mov ecx, 1
add dl, dl
jne 0xa1010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa10119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa10105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa10075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa1013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa10136
cmp eax, 0x7d00
jae 0xa1016d
cmp eax, 0x500
jb 0xa10168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa10075
cmp eax, 0x7f
ja 0xa10170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa10075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa1019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa10075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4195ec
Capabilities:
Terminate process

Disassembly:
call fcn.004195f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x100018c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100018e5
push 0
push 0
push 0
push 0x10001770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100065d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005e424]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1000668c
cmp byte [esi + 0x3d], 0
je 0x1000668c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000667a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10006641
sub eax, 1
je 0x10006645
sub eax, 2
jne 0x1000667a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004cf19
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10006663
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000667a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004cf19
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004cf19
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1004cf19
mov esp, ebp
pop ebp
ret