joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d220
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x1013546c]
call fcn.10015bd0
fld dword [0x10135470]
push 0xa
add eax, 0x64
push 0xa
push eax
call fcn.10015bd0
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000d317
push 1
mov ecx, 0x791070
call ecx
add esp, 4
test al, al
je 0x1000d317
push esi
mov edx, 0x83c080
call edx
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x10135490], 1
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x74cd30
je 0x1000d2cf
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x74cd30], 0xc3
mov eax, dword [ebp - 4]
push eax
push 1
push 0x74cd30
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x771310
call esi
mov byte [0x771310], 0xc3
jmp 0x1000d2ff
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x74cd30], 0x55
mov eax, dword [ebp - 4]
push eax
push 1
push 0x74cd30
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x771310
call esi
mov byte [0x771310], 0x55
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push 1
push 0x771310
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x1000d320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x1013546c]
call fcn.10015bd0
fld dword [0x10135470]
push 0xa
add eax, 0x78
push 0xa
push eax
call fcn.10015bd0
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000d465
push 1
mov ecx, 0x791070
call ecx
add esp, 4
test al, al
je 0x1000d465
push esi
mov edx, 0x83c080
call edx
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x10135494], 1
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x626190
je 0x1000d3f6
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x626190], 0xc3
mov eax, dword [ebp - 4]
push eax
push 1
push 0x626190
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x72d1b0
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x72d1b0], 0xc3
mov eax, dword [ebp - 4]
push eax
push 1
push 0x72d1b0
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x6d9116
call esi
mov byte [0x6d9116], 0
jmp 0x1000d44d
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x626190], 0x55
mov eax, dword [ebp - 4]
push eax
push 1
push 0x626190
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x72d1b0
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x72d1b0], 0x55
mov eax, dword [ebp - 4]
push eax
push 1
push 0x72d1b0
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x6d9116
call esi
mov byte [0x6d9116], 1
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push 1
push 0x6d9116
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1000df90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1001a018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000dfd7
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001520d
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x1000e0ec
cmp dword [ebp - 0x1e], 0x36
jne 0x1000e0ec
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x100a3aec
je 0x1000e017
mov esi, 0x100a3b1c
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x100a3b4c]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x100a3b50]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x100a3b54]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x100a3b58]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x100a3b4c]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x100a3b50]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x100a3b54]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x100a3b58]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x100a3b4c]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x100a3b50]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x100a3b54]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x100a3b58]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001520d
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.1001520d
mov esp, ebp
pop ebp
ret 8
Function at 0x1000fa50
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [0x1001a018]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push edi
lea esi, [esp + 0x10]
call fcn.100019f0
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x8c140]
mov eax, str.ServerInfo.sse
call fcn.10001b30
test al, al
jne 0x1000fab1
push str._Error__ReadMainFile_1:_Failed_to_calculate_CRC_for_the_main_file.
call fcn.10014240
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.1001520d
mov esp, ebp
pop ebp
ret
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.ServerInfo.sse
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000faf5
push str._Error__ReadMainFile_2:_Failed_to_open_the_main_file.
call fcn.10014240
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.1001520d
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x8c13c
je 0x1000fb2f
push str._Error__ReadMainFile_3:_Unexpected_size_for_the_main_file.
call fcn.10014240
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.1001520d
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x8c13c
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000fb59
push str._Error__ReadMainFile_4:_Failed_to_read_the_main_file_data.
jmp 0x1000fb0a
mov dword [esp + 0x410], 0x1a927d46
mov dword [esp + 0x414], 0x295de8b4
mov dword [esp + 0x418], 0x6c2e8f70
mov dword [esp + 0x41c], 0x3a8ef79b
mov dword [esp + 0x420], 0x81a12f59
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov eax, ecx
sub eax, edx
mov edx, ecx
shr edx, 8
and dl, cl
or dl, byte [esp + eax + 0x410]
mov al, byte [esi + ecx]
not al
xor dl, al
mov byte [esi + ecx], dl
inc ecx
cmp ecx, 0x8c13c
jb 0x1000fb92
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.1001520d
mov esp, ebp
pop ebp
ret

Function at 0x10011630
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101353a0], 2
jne 0x100116ab
mov edx, dword [0x10133894]
mov eax, dword [0x10133890]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov ax, word [0x10133898]
lea edx, [ebp - 0x10]
push esi
mov ecx, 0xe
push edx
mov dword [ebp - 0x10], 0x3f30ec1
mov word [ebp - 4], ax
call fcn.10010c90
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
mov dword [0x1013539c], 1
mov dword [0x101353a0], 3
call esi
mov dword [0x101353a4], eax
call esi
mov dword [0x101353a8], eax
mov eax, 0x7530
mov dword [0x101353ac], eax
mov dword [0x101353b0], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100116b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [0x101353a0], 3
push esi
jne 0x100116e4
cmp dword [0x101353b8], ebx
je 0x100116e4
lea eax, [ebp - 8]
lea ecx, [ebx + 5]
push eax
mov dword [ebp - 8], 0x51bf05c1
mov byte [ebp - 4], bl
call fcn.10010c90
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1013539c], ebx
mov dword [0x101353a0], ebx
call esi
mov dword [0x101353a4], eax
call esi
pop esi
mov dword [0x101353ac], ebx
mov dword [0x101353b0], ebx
mov dword [0x101353b4], ebx
mov dword [0x101353b8], ebx
mov dword [0x101353a8], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100119c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d128f
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d128f], 0x1d
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d128f
call esi
push 0x10011a30
push 0x4d13c2
mov bl, 0xe9
call fcn.10014010
push 0x10011b90
push 0x4d2782
call fcn.10014010
push 0x10011c60
push 0x830c3a
call fcn.10014010
add esp, 0x18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10013df0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x10135574]
push esi
test eax, eax
jne 0x10013e1d
mov eax, dword [0xe8c578]
push 0x10013f20
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x10135574], eax
test eax, eax
je 0x10013e68
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10013e4e
mov edx, dword [0xe8c578]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov esi, 0x10135570
call fcn.10013e70
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0xe8c578]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov esi, 0x10135570
call fcn.10013e70
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10013f80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push esi
call edi
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push eax
push 1
push esi
mov byte [esi], cl
call edi
pop edi
pop esi
pop ebp
ret

Function at 0x10013fb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
fld dword [ebp + 8]
mov edx, dword [ebp - 4]
fstp dword [esi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push esi
call edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10013fe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 8
push esi
call edi
fld qword [ebp + 0xc]
mov edx, dword [ebp + 8]
fstp qword [esi]
lea ecx, [ebp + 8]
push ecx
push edx
push 8
push esi
call edi
pop edi
pop esi
pop ebp
ret

Function at 0x10014010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call edi
cmp bl, 0xff
je 0x10014031
mov byte [esi], bl
mov ecx, dword [ebp + 0xc]
sub ecx, esi
sub ecx, 5
lea edx, [ebp - 4]
push edx
mov dword [esi + 1], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10014050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 0xc]
push esi
push ecx
push edi
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100140e0
Capabilities:
Allocate or change rwx memory
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x101331cc]
push edi
push 0x10017b18
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x1001422f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0xc
jb 0x1001422f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1001422f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x10014148
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 4]
push edi
push ebx
cmp edx, dword [esi + 8]
jne 0x100141bf
mov eax, dword [esi]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
lea edx, [ecx*4 + 0xc]
cmp eax, edx
jb 0x1001422e
xor ebx, ebx
test ecx, ecx
je 0x10014224
lea esp, [esp]
mov edi, dword [esi + ebx*4 + 0xc]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 4
push edi
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
cmp ebx, dword [esi]
jb 0x10014180
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
lea edx, [ecx*8 + 0xc]
cmp eax, edx
jb 0x1001422e
mov dword [ebp - 4], 0
test ecx, ecx
je 0x10014224
mov eax, dword [ebp - 4]
add eax, eax
add eax, eax
add eax, eax
mov edi, dword [eax + esi + 0x10]
mov ebx, dword [eax + esi + 0xc]
add edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 8]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push ebx
mov dword [ebx], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [esi]
jb 0x100141e3
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100142b0
Capabilities:
Get common file path
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x1001a018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x100142e9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001520d
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
lea edx, [ebp - 0x108]
push edx
mov byte [ebp - 0x105], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x100142d9
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x10e]
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
and ecx, 0xf5fb
shl edx, 0x10
or ecx, edx
xor ecx, 0x15ca2020
push ecx
movzx ecx, word [ebp - 0x130]
shl ecx, 0xe
mov edx, eax
shr edx, 2
or ecx, edx
push ecx
mov ecx, dword [ebp - 0x11c]
shl ecx, 0x10
or ecx, eax
imul eax, eax
imul ecx, ecx, 0x14ce1989
push ecx
sub eax, 0x13b06451
push eax
push 0x12ba1074
push str._08X__08X__08X__08X__08X
push 0x10135690
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x1c
mov eax, 0x10135690
call fcn.1001520d
mov esp, ebp
pop ebp
ret

Function at 0x100143a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x405b7c
call esi
mov cx, word [ebp + 0xc]
lea edx, [ebp - 4]
push edx
mov word [0x405b7c], cx
mov eax, dword [ebp - 4]
push eax
push 2
push 0x405b7c
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 2
push 0x40cc40
call esi
mov dx, word [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov word [0x40cc40], dx
mov ecx, dword [ebp - 4]
push ecx
push 2
push 0x40cc40
call esi
lea edx, [ebp + 0xc]
push edx
push 0x40
push 1
push 0x595275
call esi
lea eax, [ebp + 0xc]
push eax
mov byte [0x595275], bl
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0x595275
call esi
lea edx, [ebp + 0xc]
push edx
push 0x40
push 1
push 0x81105c
call esi
lea eax, [ebp + 0xc]
push eax
mov byte [0x81105c], bl
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0x81105c
call esi
lea edx, [ebp + 0xc]
push edx
push 0x40
push 2
push 0x5952aa
call esi
lea eax, [ebp + 0xc]
push eax
mov word [0x5952aa], di
mov ecx, dword [ebp + 0xc]
push ecx
push 2
push 0x5952aa
call esi
lea edx, [ebp + 0xc]
push edx
push 0x40
push 2
push 0x81109d
call esi
mov word [0x81109d], di
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push ecx
push 2
push 0x81109d
call esi
mov edx, dword [ebp + 8]
mov dword [0x101338d4], ebx
mov dword [0x101338d0], edi
mov dword [0x101338cc], edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001520d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001a018]
jne 0x10015217
repz ret
jmp fcn.100156c9
Function at 0x401000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x11583cc
call fcn.0040121c
mov edi, 0x94
mov eax, edi
call fcn.004011dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x11583cc], ecx
mov eax, dword [esi + 4]
mov dword [0x11583d0], eax
mov edx, dword [esi + 8]
mov dword [0x11583d4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x11583d8], esi
cmp ecx, 2
je 0x401060
or esi, 0x8000
mov dword [0x11583dc], esi
shl eax, 8
add eax, edx
mov dword [0x11583cc], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40109b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40109b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010b3
cmp eax, 0x20b
je 0x4010a0
mov dword [ebp - 0x1c], esi
jmp 0x4010c7
cmp dword [ecx + 0x84], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4010c1
cmp dword [ecx + 0x74], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401224
pop ecx
test eax, eax
jne 0x4010f3
cmp dword [0x11583cc], 1
jne 0x4010e0
call fcn.00401224
push 0x1c
call fcn.00401224
push 0xff
call fcn.00401224
pop ecx
pop ecx
call fcn.00401224
mov dword [ebp - 4], esi
call fcn.00401224
test eax, eax
jge 0x40110c
push 0x1b
call fcn.00401224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x11583cc], eax
call fcn.00401224
mov dword [0x11583d0], eax
call fcn.00401224
test eax, eax
jge 0x401132
push 8
call fcn.00401224
pop ecx
call fcn.00401224
test eax, eax
jge 0x401143
push 9
call fcn.00401224
pop ecx
push 1
call fcn.00401224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401159
push eax
call fcn.00401224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40117a
movzx eax, word [ebp - 0x40]
jmp 0x40117d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40119b
push edi
call fcn.00401220
call fcn.00401224
jmp 0x4011cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401224
ret

Function at 0x401228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x18f000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401252
push 0xfca37c
jmp 0x40125e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret
Function at 0xa9a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa9a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa9a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9a06a
add dl, dl
jne 0xa9a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9a0dc
xor eax, eax
add dl, dl
jne 0xa9a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9a17d
add dl, dl
jne 0xa9a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa9a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa9a075
mov eax, 1
add dl, dl
jne 0xa9a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9a0e1
sub eax, ebx
mov ebx, 1
jne 0xa9a128
mov ecx, 1
add dl, dl
jne 0xa9a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa9a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa9a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9a136
cmp eax, 0x7d00
jae 0xa9a16d
cmp eax, 0x500
jb 0xa9a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa9a075
cmp eax, 0x7f
ja 0xa9a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa9a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa9a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa9a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10