joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dcc50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549e26
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x597644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2e0]
push 0x2d0
push 0
push eax
call fcn.004dda00
mov esi, dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
lea eax, [ebp - 0x2e4]
add esp, 0xc
mov dword [ebp - 0x2e4], 0x168
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0x551950
push str.http
push 1
push 0
call esi
xor ebx, ebx
test eax, eax
setns bl
test eax, eax
jns 0x4dccf2
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
push str.iexplore.exe
push 2
push 2
call esi
xor ebx, ebx
test eax, eax
setns bl
test ebx, ebx
je 0x4dce36
call fcn.0040d590
mov ecx, eax
test ecx, ecx
je 0x4dce54
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e8], eax
lea eax, [ebp - 0x2e0]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x2e8]
call fcn.0041d7d0
test al, al
jne 0x4dcd62
lea ecx, [ebp - 0x2e0]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4dcd40
sub ecx, edx
lea eax, [ebp - 0x2e0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.0040dcb0
mov esi, dword [ebp - 0x2e8]
mov dword [ebp - 4], 1
cmp dword [esi - 0xc], 0
jge 0x4dcd7a
or eax, 0xffffffff
jmp 0x4dcd95
push str..exe
push esi
call fcn.004deb65
add esp, 8
test eax, eax
jne 0x4dcd91
or eax, 0xffffffff
jmp 0x4dcd95
sub eax, esi
sar eax, 1
mov ecx, dword [esi - 0xc]
test eax, eax
jle 0x4dcdc6
sub ecx, eax
add eax, 4
add ecx, 4
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.0046d640
push 1
push 0
lea ecx, [ebp - 0x2e8]
call fcn.0046d640
mov esi, dword [ebp - 0x2e8]
push 1
push 0
push dword [edi]
push esi
push 0x551950
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x4dce00
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4dce36
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x4dce36
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push 1
push dword [edi]
push esi
call fcn.004dd150
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4dce36
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004982ff
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040ada0
int3
Function at 0x4dce60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549e58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x597644]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push esi
mov dword [ebp - 0x10], 0
call fcn.0040fbf0
push 0x567a88
push 0x567a8c
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00423130
push 0xa
push 0
push dword [esi]
push 0x567a90
push 0x551950
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
mov dword [ebp - 4], 0xffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb esi, esi
add eax, 0xfffffff0
neg esi
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4dcef5
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4dd150
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x597644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
test edi, edi
jne 0x4dd194
xor eax, eax
jmp 0x4dd325
cmp word [edi], 0
je 0x4dd18d
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4dd1a0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x4dd18d
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4dd18d
cmp dword [ebp + 0x14], 0
je 0x4dd1d8
push dword [ebp - 0x6c]
push edi
call fcn.00475890
add esp, 8
test eax, eax
je 0x4dd18d
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 0
call fcn.00415ea0
push esi
push edi
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push 0x55214c
push eax
call fcn.0041dac0
mov esi, dword [ebp - 0x68]
add esp, 0x10
cmp dword [esi - 4], 1
jle 0x4dd218
push dword [esi - 0xc]
lea ecx, [ebp - 0x68]
call fcn.0040c600
mov esi, dword [ebp - 0x68]
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
xor eax, eax
movlpd qword [ebp - 0x60], xmm0
mov word [ebp - 0x22], ax
mov eax, 0xa
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x32], xmm0
movlpd qword [ebp - 0x2a], xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x81
mov word [ebp - 0x34], ax
call fcn.004bb200
mov dword [ebp - 0x74], eax
test eax, eax
je 0x4dd2fc
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4dd294
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4dd2e4
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4dd2e4
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 0
push esi
push 0
push 0
push dword [ebp - 0x74]
call eax
test eax, eax
je 0x4dd2e4
cmp dword [ebp - 0x20], 0
je 0x4dd2e4
mov eax, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4dd2ea
push eax
call esi
push dword [ebp - 0x20]
call esi
mov dword [ebp - 0x6c], 1
jmp 0x4dd2ea
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x74]
call esi
cmp dword [ebp - 0x6c], 0
je 0x4dd2fc
mov esi, 1
jmp 0x4dd31b
push 0xa
push 0
push dword [ebp - 0x70]
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov dword [ebp - 0x70], ecx
mov esi, ecx
lea ecx, [ebp - 0x68]
call fcn.0040cf90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004982ff
mov esp, ebp
pop ebp
ret

Function at 0x521f6a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00521b6f
Function at 0x521f75
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00521cf0

Function at 0x529777
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00528f51

Function at 0x529782
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052918c

Function at 0x529c15
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052999c

Function at 0x532f40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549f50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x597644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
push 0x5332b0
push 0x533200
push 0x5332d0
push 0x533270
push 0x533220
push 0x533320
push 0x533310
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call sub.Cabinet.dll_FDICreate
mov ebx, eax
add esp, 0x24
test ebx, ebx
je 0x53309d
push dword [ebp - 0x20]
push edi
push 0x533330
push edi
push dword [ebp - 0x28]
push esi
push ebx
call sub.Cabinet.dll_FDICopy
add esp, 0x1c
test eax, eax
jne 0x533033
lea ecx, [ebp - 0x20]
call fcn.00415ea0
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push esi
mov dword [ebp - 4], edi
call fcn.005330c0
push eax
push esi
lea eax, [ebp - 0x20]
push str.FDICopy_failed_with_error_code__d_:__s
push eax
call fcn.0041dac0
mov esi, dword [ebp - 0x20]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x533038
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x533038
mov edi, 1
push ebx
call sub.Cabinet.dll_FDIDestroy
add esp, 4
cmp eax, 1
je 0x53309d
lea ecx, [ebp - 0x20]
call fcn.00415ea0
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push esi
mov dword [ebp - 4], 1
call fcn.005330c0
push eax
push esi
lea eax, [ebp - 0x20]
push str.FDIDestroy_failed_with_error_code__d_:__s
push eax
call fcn.0041dac0
mov esi, dword [ebp - 0x20]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x53309d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004982ff
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1079d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1079d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1079d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1079d06a
add dl, dl
jne 0x1079d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1079d0dc
xor eax, eax
add dl, dl
jne 0x1079d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1079d17d
add dl, dl
jne 0x1079d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1079d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1079d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1079d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1079d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1079d075
mov eax, 1
add dl, dl
jne 0x1079d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1079d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1079d0e1
sub eax, ebx
mov ebx, 1
jne 0x1079d128
mov ecx, 1
add dl, dl
jne 0x1079d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1079d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1079d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1079d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1079d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1079d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1079d136
cmp eax, 0x7d00
jae 0x1079d16d
cmp eax, 0x500
jb 0x1079d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1079d075
cmp eax, 0x7f
ja 0x1079d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1079d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1079d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1079d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x402fb6
Capabilities:
Create pipe
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.0040a6d0
mov eax, dword [0x2451e6c]
mov ecx, dword [0x24518fc]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x403094
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov ebx, ecx
mov dword [esp + 0xc], eax
cmp dword [0x2451e6c], 0x959
jne 0x403081
push esi
lea eax, [esp + 0x814]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0x402c04
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call edi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
lea eax, [esp + 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call fcn.00402d97
add ebx, 8
dec dword [esp + 0xc]
jne 0x402fed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40717b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x439a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004053e9
and dword [ebp - 0x14], 0
cmp dword [0x43f438], 0
mov dword [ebp - 0x18], eax
jne 0x40722e
push 0x402254
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4072d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402248
push ebx
call edi
test eax, eax
je 0x4072d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402238
push ebx
mov dword [0x43f438], eax
call edi
push eax
call esi
push 0x402224
push ebx
mov dword [0x43f43c], eax
call edi
push eax
call esi
push 0x402208
push ebx
mov dword [0x43f440], eax
call edi
push eax
call esi
mov dword [0x43f448], eax
test eax, eax
je 0x40722e
push 0x4021f0
push ebx
call edi
push eax
call esi
mov dword [0x43f444], eax
mov eax, dword [0x43f444]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407287
cmp dword [0x43f448], ecx
je 0x407287
push eax
call esi
push dword [0x43f448]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407287
test ebx, ebx
je 0x407287
call edi
test eax, eax
je 0x40727e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40727e
test byte [ebp - 8], 1
jne 0x407287
or dword [ebp + 0x10], 0x200000
jmp 0x4072ba
mov eax, dword [0x43f43c]
cmp eax, dword [ebp - 0x18]
je 0x4072ba
push eax
call esi
test eax, eax
je 0x4072ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4072ba
mov eax, dword [0x43f440]
cmp eax, dword [ebp - 0x18]
je 0x4072ba
push eax
call esi
test eax, eax
je 0x4072ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43f438]
call esi
test eax, eax
je 0x4072d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4072d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004074e6
leave
ret

Function at 0x4074e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x439a90]
jne 0x4074f0
repz ret
jmp fcn.00409794
Function at 0x10048c70
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10048e54
pushal
mov esi, section.UPX1
lea edi, [esi - 0x32000]
push edi
or ebp, 0xffffffff
jmp 0x10048c9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10048ca1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10048c90
mov eax, 1
add ebx, ebx
jne 0x10048cb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10048cc4
jne 0x10048ce3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10048ce3
dec eax
add ebx, ebx
jne 0x10048cd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10048ca8
add ebx, ebx
jne 0x10048cdf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10048d35
xor ecx, ecx
sub eax, 3
jb 0x10048cfb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10048d6a
sar eax, 1
mov ebp, eax
jmp 0x10048d06
add ebx, ebx
jne 0x10048d06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10048cd4
inc ecx
add ebx, ebx
jne 0x10048d14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10048cd4
add ebx, ebx
jne 0x10048d21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10048d16
jne 0x10048d32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10048d16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10048d54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10048d46
jmp 0x10048c96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10048d54
add edi, ecx
jmp 0x10048c96
pop esi
mov edi, esi
mov ecx, 0x1299
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10048d72
cmp byte [edi], 6
jne 0x10048d72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10048d77
lea edi, [esi + 0x45000]
mov eax, dword [edi]
or eax, eax
je 0x10048de6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x480f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x48118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10048da4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4811c]
or eax, eax
je 0x10048de0
mov dword [ebx], eax
add ebx, 4
jmp 0x10048dc1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10048e17
cmp al, 0xef
ja 0x10048e0a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10048dec
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10048df9
mov ebp, dword [esi + 0x48120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10048e4b
sub esp, 0xffffff80
jmp 0x10001500
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.35y0vrmm]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.35y0vrmm]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.35y0vrmm]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.35y0vrmm]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.35y0vrmm]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.35y0vrmm]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x122b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x122b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x122b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x122b06a
add dl, dl
jne 0x122b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x122b0dc
xor eax, eax
add dl, dl
jne 0x122b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x122b17d
add dl, dl
jne 0x122b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x122b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x122b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x122b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x122b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x122b075
mov eax, 1
add dl, dl
jne 0x122b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x122b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x122b0e1
sub eax, ebx
mov ebx, 1
jne 0x122b128
mov ecx, 1
add dl, dl
jne 0x122b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x122b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x122b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x122b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x122b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x122b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x122b136
cmp eax, 0x7d00
jae 0x122b16d
cmp eax, 0x500
jb 0x122b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x122b075
cmp eax, 0x7f
ja 0x122b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x122b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x122b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x122b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10