joyce8/EMBER2024-capa huggingface dataset:
Function at 0x781271
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x78142e
mov dword [esp + 0x24], edx
call 0x781221
sub byte [ebp - 0x72fedb9c], cl
and al, 3
jmp 0x781292
xor eax, 0x1000000
bt bp, bx
jmp 0x781269
and eax, esi
mov eax, dword [eax*4 + 0x7597b0]
lea esp, [esp + 0x48]
jmp 0x781244
mov edi, edx
call 0x781271
add eax, 0xb708efc1
scasb al, byte es:[edi]
setbe bl
jmp 0x7812b7
lea ebp, [ebp*4]
lea ebp, [ebp + 0x7597b0]
mov edi, dword [ebp]
pop ebp
jmp 0x7812a1
lea esp, [esp + 8]
popal
shr eax, 0x10
mov esi, 0xff
jmp 0x78125a
btc bp, sp
pushfd
jmp 0x7812be
and edi, esi
push ebp
mov ebp, edi
jmp 0x78127b
lea esp, [esp + 8]
and edi, 0xff0000
lea ebp, [esp + 0xb5]
jmp 0x781376
lea ebp, [ecx + esi]
jmp 0x781331
mov ebx, dword [ebp]
pop ebp
lea ebp, [ebx*4]
and eax, 0xff000000
neg ebp
jmp 0x7812f1
mov edi, edx
not bp
bswap ebp
btr ebp, edx
jmp 0x781357
xor eax, edi
bswap edi
xor ebp, 0x51f9ae30
btr bp, si
jmp 0x78131b
xor eax, edi
neg ebp
push si
lea esp, [esp + 2]
jmp 0x7813ea
shr edi, 0x18
mov ebp, esi
mov bp, 0xfd4d
movzx edi, byte [edi*4 + 0x7597b0]
jmp 0x781341
push ebp
mov ebp, ecx
add ebp, 4
jmp 0x781307
mov byte [esp], bl
add esp, 1
lea esp, [esp + 1]
jmp 0x78139d
pushal
and edi, ebp
xor eax, edi
push dx
jmp 0x78137e
lea esp, [esp + 0x20]
xor eax, dword [ecx]
push esp
mov edi, dword [esp + 1]
bsr edi, edx
jmp 0x7813ce
mov bp, ax
mov edi, dword [edi*4 + 0x7597b0]
mov ebp, 0xff00
cmc
jmp 0x781394
lea esp, [esp + 4]
lea edi, [ecx + 0x10]
call fcn.0078145d
loope 0x781443
not dword [edx - 0x67e6519f]
push cs
imul ebx, dword [eax - 0x689b8aa4], 0x148960fe
and al, 0x61
pushal
mov dword [esp], edx
popal
and edi, esi
jmp 0x7813bc
mov dword [ecx + 0x1c], edx
mov ebx, 0x75afb4
lea esp, [esp + 0x24]
jmp 0x74e5aa
rdtsc
jmp 0x78147a
sub cl, byte [ecx - 0x2fcce7bf]
jmp 0x7813fb
pushal
mov dword [esp + 0x18], edx
sub esp, 7
lea esp, [esp + 3]
lea esp, [esp + 4]
jmp 0x781544
mov eax, edi
mov edx, dword [eax + 0xc]
stc
jmp 0x781464
mov edi, edx
call fcn.007814ae
popal
shr ecx, 8
mov edi, 0x724c4727
push ebp
mov word [esp], ax
jmp 0x7814c6

Function at 0x78145d
Capabilities:
Encrypt data using aes

Disassembly:
pushfd
xor eax, ebx
mov dword [ecx + 0x14], ebx
jmp 0x781444
lea esp, [esp + 3]
mov dword [edi], eax
mov ax, 0x9cc8
mov eax, dword [ecx + 8]
jmp 0x7813f3
mov dword [ecx + 0x18], eax
xor edx, eax
xor ebx, eax
sub esp, 0x1f
jmp 0x78141f

Function at 0x781498
Capabilities:
Encrypt data using aes

Disassembly:
mov ecx, dword [ecx*4 + 0x7597b0]
jmp 0x78150a
mov esi, edi
jmp 0x7814ee
clc
sub esp, 0x1d
lea esp, [esp + 1]
push esi
jmp 0x7814cd
lea esi, [esi*4]
lea esi, [esi + 0x7597b0]
mov edi, dword [esi]
pop esi
stc
jmp 0x78152d
shr edi, 0x10
sub esp, 5
sub esp, 0xb
and edi, esi
jmp 0x7814e3
lea esp, [esp + 0x48]
and ecx, 0xff0000
jmp 0x781b5c
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x781517
mov edi, edx
call 0x7815ba
and edi, 0xff000000
push edx
xor ecx, edi
mov edi, dword [esp]
jmp 0x781745
Function at 0x781567
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
pushal
jmp 0x78159f
xor ecx, edi
lea edi, [eax*4]
mov edi, dword [esp]
dec di
jmp 0x78170f
push bp
movzx edi, byte [edi*4 + 0x7597b0]
jmp 0x781589
add ebx, 4
adc dh, 0x5f
jmp 0x781603
bsf dx, di
xor ecx, dword [eax]
inc dx
bswap edx
jmp 0x7815c6
mov dword [edi], ecx
mov edx, 0xd05f551c
mov dx, 0xf438
or dl, dl
call fcn.007815ed
sbb ebx, dword [edi + 0x11996a0f]
jae 0x78160d
hlt
add ax, si
inc ebx
insd dword es:[edi], dx
jl 0x781673
salc
inc ecx
ret
lea esp, [esp + 0x30]
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
bts dx, dx
jmp 0x7815e1
btc edx, edx
jmp 0x7816b3
pushfd
xor edx, ecx
cmc
mov dword [eax + 0x1c], edx
jmp 0x7816de
mov dword [eax + 0x18], ecx
lea edx, [0xa4c73c40]
mov edx, dword [esp]
mov edx, dword [eax + 0xc]
jmp 0x781694
pushal
call fcn.0078169d
push 0xa
lea ebp, [edx - 0xdfcc]
pop eax
jmp 0x781724
mov ebp, dword [esp]
xchg bl, bh
lea ebx, [edx - 0x2519]
jmp 0x78172f
and edx, ebp
mov edi, 0x5141e90e
xor ecx, edx
lea edx, [eax*4]
jmp 0x781627
pop edi
mov esi, 0xf8e8212f
mov bl, 0xa2
pop esi
jmp 0x7816ef
lea esp, [esp + 4]
pop ebx
ret

Function at 0x781583
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + 0x7597b0]
shr edi, 0x18
call fcn.00781567
mov eax, dword [0x224648d]
lea esp, [esp + 2]
mov word [esp], cx
jmp 0x781557

Function at 0x78169d
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x30]
cmp ebx, 0x75afd8
jmp 0x7816c4
jne 0x74e5aa
mov ax, word [esp]
xchg si, ax
jmp 0x7816e4

Function at 0x78190b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x1a
pop dword [esp + 5]
lea esp, [esp + 2]
jmp 0x781931

Function at 0x781cbe
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ebx, dword [ebx*4 + 0x7597b0]
jmp 0x781cda

Function at 0x781cf0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
call fcn.00781cbe
and ebx, ecx
jmp 0x781cfc
push ax
lea esp, [esp + 2]
movzx ebx, byte [esi + 0xa]
jmp 0x781cd4
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + 0x759fb0]
sub esp, 0x1a
lea ebx, [ecx + ebp]
xchg byte [esp + 0x15], bh
jmp 0x781d57
push dword [esp + 2]
and edx, ecx
jmp 0x781d27
lea esp, [esp + 2]
movzx ebx, byte [esi + 0xd]
sub esp, 0xe
pop word [esp + 2]
lea esp, [esp + 4]
jmp 0x781d3d

Function at 0x781e44
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xor edi, dword [edx*4 + 0x75a7b0]
push ax
lea esp, [esp + 2]
jmp 0x781e78
lea esp, [esp]
lea esp, [esp + 8]
jmp 0x781e2e
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x74ec4b
je 0x74ec09

Function at 0x784912
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], ebx
jmp 0x784946
lea esp, [esp + 4]
cmp ecx, 0x10
call 0x784930
Function at 0x8588ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
mov dh, 0x13
push word [esp + 3]
xchg edx, eax
mov edi, ebp
jmp 0x859964
not dx
mov dword [esp + 0x10], esi
mov dx, word [esp + 0xf]
not ax
jmp 0x858975
pop word [esp + 5]
bt edx, ebx
mov di, word [esp + 0x14]
xchg dword [esp + 0x14], eax
setne ah
jmp 0x8588fc
mov al, byte [esp + 0x1f]
xchg word [esp + 4], dx
mov dx, ax
xchg edx, edi
mov dword [esp + 7], edi
mov ax, 0xa9f6
jmp 0x858912
lea edx, [ebx*4]
add esp, 0xf
pop dword [esp + 9]
jmp 0x85898c
mov byte [esp + 9], cl
sub esp, 0x11
clc
mov ah, bl
mov dword [esp + 0x1c], ebx
bsr edx, edx
jmp 0x858946
inc di
lea edx, [edi*4]
xchg word [esp + 9], ax
mov di, ax
add esp, 5
cld
jmp 0x85895c
bsf edi, ecx
dec dl
push word [esp + 0x11]
lea esp, [esp + 2]
pop word [esp + 0x10]
bsf eax, esi
jmp 0x858a02
mov word [esp], sp
lea edi, [ebp*4]
rdtsc
sub esp, 0x1d
shr eax, 0xf
mov ah, 0xf9
jmp 0x85892e
xchg edx, eax
xchg dword [esp], edi
lea eax, [esp + 0x3cba61e2]
btc ax, si
jmp 0x858a2a
rdtsc
mov edx, 0x30f6d38e
xchg byte [esp + 6], ah
bswap edx
std
add esp, 0x11
jmp 0x8589c4
xchg byte [esp + 0x11], dh
mov dh, al
bsr eax, edx
clc
setae dh
bsr edx, ebp
jmp 0x8589da
pop di
shl dx, cl
mov dx, di
mov di, dx
jmp 0x858a51
push edx
mov dword [esp + 3], ebp
mov al, dh
xchg byte [esp + 5], al
cld
pop dword [esp]
jmp 0x858a14
not ax
mov dh, byte [esp + 3]
bsf dx, dx
xchg edx, edi
xchg dword [esp], edi
jmp 0x858a66
lea edx, [ebx*4]
sub esp, 3
inc edi
mov dh, ch
mov ax, 0x803d
xchg dh, ah
jmp 0x858a3b
bt eax, eax
mov eax, 0xaba665f9
xchg edi, edx
neg edi
push dword [esp + 2]
mov al, 0xec
jmp 0x8597cf
clc
add ax, 0xf139
mov al, 0xbe
adc eax, 0xe9bbd428
dec edx
neg dl
jmp 0x8589aa
mov dl, ch
bswap eax
mov dword [esp + 4], edx
lea edi, [esi - 0xf4]
mov di, 0xbe87
mov dx, word [esp + 6]
call fcn.008592dc
mov dword [edx - 0x30], 0x8bab42b7
pop es
xchg edi, eax
add ebp, ebp
xor edi, dword [eax + 0x1fb8492e]
pop ds
xchg ebp, eax
add eax, 0x8f499f6c
push es
xchg esp, eax
push cs
loope 0x859845
mov ebx, 0x55bd4e2b
adc ebx, dword [edx + esi + 0x6746a455]
jmp 0x370b094
invalid
std
mov edi, 0x811ebc4f
not di
xchg word [esp + 2], ax
mov edx, esi
pop edx
jmp 0x858a84

Function at 0x858ae9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0xe4ffa7c5
xchg edi, edx
bt edx, esi
push word [esp + 8]
lea esp, [esp]
shl dl, cl
jmp 0x858ad1
mov ah, 0xd6
pop di
neg dh
mov byte [esp + 0xb], dh
mov byte [esp + 3], bh
xchg byte [esp + 7], al
jmp 0x858a98
bsf ax, dx
xchg di, dx
push edi
sub esp, 0xf
add esp, 0xa
rdtsc
jmp 0x858b23
lea eax, [esi + edi]
bswap eax
mov edi, dword [esp + 0x12]
jmp 0x858abd
mov word [esp], bx
mov eax, esp
xchg edx, eax
xchg word [esp], di
xchg edi, eax
mov ah, bl
jmp 0x858b31
lea edx, [ecx*4]
mov dx, word [esp + 0x11]
mov eax, dword [esp + 0x15]
lea eax, [ecx + ebp]
jmp 0x858af4
mov ax, bp
dec di
neg dl
mov edi, eax
mov edx, edi
stc
jmp 0x858b0a
lea esp, [esp + 4]
push word [esp + 4]
mov dh, bl
mov edx, ecx
xchg dword [esp + 0xf], eax
inc edx
jmp 0x858b5f
Function at 0x858f8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, 3
lea edi, [ecx - 0x673d]
dec ah
sub esp, 0x16
jmp 0x858f61
lea esp, [esp + 0x43]
call 0x858f8b
nop
sbb ecx, dword [ebx - 0x90de212]
jl 0x858f85
jne 0x858ef9
leave
or cl, byte [ebx - 0x4314dbfc]
mov dword [esp], edx
std
push sp
xchg dword [esp], eax
setb dh
jmp 0x858f9d
not dh
mov dword [esp], esp
mov al, 0x2c
mov dword [esp], ecx
mov dl, byte [esp + 1]
jmp 0x85903c
rdtsc
mov al, dl
mov ah, 0xed
pop ax
bsr edx, edi
jmp 0x859010
bswap edi
mov dl, byte [esp]
bswap edi
sbb ax, 0x4f
push di
add esp, 1
jmp 0x858fc9
mov edx, 0xad2816ff
mov dx, 0x67fd
not dl
std
mov edx, dword [esp]
sub esp, 2
jmp 0x859025
mov edx, 0x69e66060
mov edx, dword [esp]
inc eax
setnp al
neg dh
sbb eax, 0x74929f35
jmp 0x858ff1
bswap edi
neg edi
xchg word [esp], di
lea edi, [edx + ebx]
mov eax, 0x2b70fb4a
jmp 0x859161
lea esp, [esp + 4]
rdtsc
lea edx, [edi*4]
lea esp, [esp + 1]
mov dh, 0x38
mov ah, byte [esp]
jmp 0x858fdf
mov byte [esp + 3], al
mov al, 0xac
lea edi, [esp - 0xbca4]
clc
bsr ax, bx
lea esp, [esp + 3]
jmp 0x8590c8
pushfd
bswap edi
rdtsc
mov word [esp + 1], ax
lea eax, [eax + edi]
push word [esp]
jmp 0x859054
seto ah
lea esp, [esp + 3]
btr dx, bp
pop edx
jmp 0x8590ad
mov di, word [esp + 0x11]
pop ax
lea esp, [esp + 4]
xchg edi, eax
setge dh
mov edi, ebp
jmp 0x859084
mov di, 0x8f43
dec di
mov dword [esp + 2], esp
mov dh, byte [esp + 1]
xchg di, ax
mov byte [esp + 2], dl
jmp 0x859102
add esp, 2
sub esp, 0x1b
shl eax, 9
bsr edi, ebp
pop eax
mov dword [esp + 0xf], esp
jmp 0x85909a
pop word [esp + 1]
mov al, dl
push dword [esp + 5]
std
mov dword [esp + 6], esp
push dword [esp + 7]
jmp 0x85912e
lea edx, [ecx*4]
lea edi, [ebx + 0x1d]
bswap edi
setne al
setbe dh
xchg dh, ah
jmp 0x8590db
mov edx, esi
call fcn.00859118
sub esp, 9
not dx
mov al, 0x7e
xchg byte [esp + 0x15], al
xchg di, ax
push dword [esp + 0xa]
jmp 0x8591d9
inc dx
neg dh
mov eax, 0x14299206
mov byte [esp], al
mov al, bl
pop dx
jmp 0x859071
mov dl, ch
mov ax, 0xe283
call fcn.0085918c
lea esp, [esp + 1]
lea edx, [edx*4]
clc
xchg word [esp + 2], di
mov dx, word [esp]
inc dl
jmp 0x85925f
mov word [esp + 8], sp
mov byte [esp + 0xc], ah
mov word [esp + 2], ax
add esp, 0x1e
std
mov edx, esi
jmp 0x8591a7
xchg byte [esp + 0xb], al
call 0x8591ef
mov dh, byte [esp + 0xd]
mov byte [esp + 0x1d], ch
push word [esp + 0xf]
lea eax, [ebx*4]
jmp 0x859240
je 0x859261
add ch, bl
into
mov di, sp
mov eax, 0x461d8c52
pop dword [esp + 8]
call fcn.008592a0
jg 0x85923b
jle 0x85926e
call 0x958b259b
cld
ud1
xor al, 0x27
not eax
xchg word [esp + 2], ax
dec edi
sub esp, 4
setnp dh
sub esp, 0xe
in al, dx
push cs
jmp 0x859205
Function at 0x859351
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x38962a29
mov ax, word [esp + 0xa]
jmp 0x859361
bt dx, ax
lea esp, [esp + 0xc]
xchg dword [esp + 1], edi
rdtsc
push dword [esp + 8]
jmp 0x8593a5
mov edx, dword [esp + 0xb]
mov al, 0x16
xchg edi, eax
lea eax, [esi - 0x4512]
jmp 0x859717
xchg dword [esp + 8], edx
push word [esp + 5]
not eax
xchg dl, ah
neg al
pop dword [esp + 7]
jmp 0x85938f
pushfd
mov dx, word [esp]
call fcn.0085941e
pop word [esp + 1]
push dword [esp + 0x14]
mov dword [esp + 0x38], esp
pushfd
jmp 0x8594c3
mov dword [esp], ecx
push edx
pushal
mov dword [esp + 0x1c], ebx
pushal
pop word [esp + 9]
jmp 0x85947d
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp]
mov byte [esp], bh
call fcn.008594a4
push edi
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x34], esi
pushfd
lea esp, [esp + 3]
call fcn.0085952d
add edi, dword [edx + 0x7c880495]
mov byte [esp + 1], bh
jmp 0x859493
sets dl
rdtsc
mov byte [esp + 0x1c], cl
sub esp, 0x11
pushal
lea esp, [esp + 0x59]
jmp 0x859473
rdtsc
rdtsc
sub esp, 0x1e
xchg byte [esp + 9], dl
xchg al, dl
not dl
jmp 0x859571
mov ax, word [esp + 0xa]
mov dh, cl
mov dword [esp + 7], edi
btr di, bp
pop ax
lea edi, [edx - 0x60]
jmp 0x859634

Function at 0x859458
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
mov dword [esp], eax
call fcn.008594f0
lodsd eax, dword [esi]
xor dword [ecx - 0x4f49cc40], esp
mov bl, 0xaa
lds esi, [esp + ebx*4 + 0x66]
mov edx, dword [esp]

Function at 0x8594a4
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp + 1]
mov dword [esp + 0x38], ebp
jmp 0x8594d5

Function at 0x8594f0
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov edx, 0x38962a29
mov ax, word [esp + 0xa]
jmp 0x859361
bt dx, ax
lea esp, [esp + 0xc]
xchg dword [esp + 1], edi
rdtsc
push dword [esp + 8]
jmp 0x8593a5
mov edx, dword [esp + 0xb]
mov al, 0x16
xchg edi, eax
lea eax, [esi - 0x4512]
jmp 0x859717
xchg dword [esp + 8], edx
push word [esp + 5]
not eax
xchg dl, ah
neg al
pop dword [esp + 7]
jmp 0x85938f
pushfd
mov dx, word [esp]
call fcn.0085941e
pop word [esp + 1]
push dword [esp + 0x14]
mov dword [esp + 0x38], esp
pushfd
jmp 0x8594c3
mov dword [esp], ecx
push edx
pushal
mov dword [esp + 0x1c], ebx
pushal
pop word [esp + 9]
jmp 0x85947d
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp]
mov byte [esp], bh
call fcn.008594a4
push edi
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x34], esi
pushfd
lea esp, [esp + 3]
call fcn.0085952d
add edi, dword [edx + 0x7c880495]
mov byte [esp + 1], bh
jmp 0x859493
sets dl
rdtsc
mov byte [esp + 0x1c], cl
sub esp, 0x11
pushal
lea esp, [esp + 0x59]
jmp 0x859473
rdtsc
rdtsc
sub esp, 0x1e
xchg byte [esp + 9], dl
xchg al, dl
not dl
jmp 0x859571
mov ax, word [esp + 0xa]
mov dh, cl
mov dword [esp + 7], edi
btr di, bp
pop ax
lea edi, [edx - 0x60]
jmp 0x859634
Function at 0x85952d
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
call fcn.008580a7
mov eax, dword fs:[0x30]
jmp 0x859545
lea esp, [esp + 1]
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0x8594f6
jmp 0x85950c
mov eax, dword [eax + 8]
jmp 0x85954f
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x85952f
push eax
jmp 0x8580a2

Function at 0x104bf058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104bf1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104bf07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104bf06a
add dl, dl
jne 0x104bf089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104bf0dc
xor eax, eax
add dl, dl
jne 0x104bf096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104bf17d
add dl, dl
jne 0x104bf0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104bf0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104bf0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104bf0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104bf0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104bf075
mov eax, 1
add dl, dl
jne 0x104bf0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104bf0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104bf0e1
sub eax, ebx
mov ebx, 1
jne 0x104bf128
mov ecx, 1
add dl, dl
jne 0x104bf10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104bf119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104bf105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104bf075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104bf13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104bf14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104bf136
cmp eax, 0x7d00
jae 0x104bf16d
cmp eax, 0x500
jb 0x104bf168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104bf075
cmp eax, 0x7f
ja 0x104bf170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104bf075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104bf19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104bf075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x489e70
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5c7abb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0xa72d70]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x489fa8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x489ed6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005b9d73
xor eax, eax
jmp 0x48a01f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.005b9efc
push esi
lea ecx, [esp + 0xc]
call fcn.005ba18b
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0xa61fa8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x489ffd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00489e00
test eax, eax
jne 0x489ffd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00489e00
test eax, eax
jne 0x489ffd
lea eax, [esp + 0x14]
push 0xa61f84
push eax
call fcn.005a8c20
mov esi, eax
add esp, 8
test esi, esi
jne 0x489fdc
lea ecx, [esp + 0x14]
push 0xa61f80
push ecx
call fcn.005a8ba0
mov esi, eax
add esp, 8
test esi, esi
jne 0x489fdc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x489fdf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.005b9eac
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x489eee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005b9d73
xor eax, eax
jmp 0x48a01f
mov byte [esi], 0
push 0xa61f7c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.005b9d73
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x4a9730
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x4a98c8
cmp ebp, ebx
jle 0x4a98c8
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, reloc.OLEAUT32.dll_VariantInit
mov dword [esp + 0x10], edi
jns 0x4a978e
dec eax
or eax, 0xfffffff8
inc eax
je 0x4a9795
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x4a97a4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x4a97ab
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.005b9ab4
add esp, 4
cmp eax, ebx
je 0x4a97cc
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.005b9ab4
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x4a98be
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x4a98a5
mov al, byte [edx]
cmp al, 0xc0
jbe 0x4a9891
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x4a9886
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x4a9894
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x4a9894
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x4a9830
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x4a9821
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret

Function at 0x4ab920
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
call fcn.005bb398
lea eax, [esp + 4]
mov dword [esi], method.CWnd.virtual_0
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
sbb eax, eax
mov dword [esi + 0x44], 0x4d12
inc eax
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], eax
mov eax, esi
pop esi
add esp, 0x190
ret
Function at 0x8c1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8c11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8c107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c106a
add dl, dl
jne 0x8c1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c10dc
xor eax, eax
add dl, dl
jne 0x8c1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c117d
add dl, dl
jne 0x8c10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8c10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8c1075
mov eax, 1
add dl, dl
jne 0x8c10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c10e1
sub eax, ebx
mov ebx, 1
jne 0x8c1128
mov ecx, 1
add dl, dl
jne 0x8c110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8c113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c1136
cmp eax, 0x7d00
jae 0x8c116d
cmp eax, 0x500
jb 0x8c1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c1075
cmp eax, 0x7f
ja 0x8c1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8c119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8c1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10