joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f772d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp ecx, 0x1a
jbe 0x100f7906
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
or ebx, 0xffffffff
mov esi, eax
cmp ecx, ebx
je 0x100f77d4
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x100f77ce
cmp edi, ebx
jne 0x100f7836
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac4
mov dword [eax], 0xf
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
mov esi, eax
cmp ecx, ebx
je 0x100f786e
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x100f7868
cmp edi, ebx
jne 0x100f78d4
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac0
mov dword [eax], 0xd
call sym.ucrtbase.dll__invalid_parameter_noinfo
jmp 0x100f793d
mov ecx, dword [0x1010e2c0]
mov edx, ebx
call fcn.10032a89
test eax, eax
je 0x100f7773
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x1010e2c0]
test edi, edi
jne 0x100f780c
xor edx, edx
call fcn.10032a89
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100f7773
mov edx, edi
call fcn.10032a89
test eax, eax
jne 0x100f7827
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
jmp 0x100f7801
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
pop ecx
test edi, edi
je 0x100f7773
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x100f777a
lea eax, [edi + 0x14]
jmp 0x100f777f
mov ecx, dword [0x1010e2c0]
mov edx, ebx
call fcn.10032a89
test eax, eax
je 0x100f77b2
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x1010e2c0]
test edi, edi
jne 0x100f78aa
xor edx, edx
call fcn.10032a89
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100f77b2
mov edx, edi
call fcn.10032a89
test eax, eax
jne 0x100f78c5
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
jmp 0x100f789f
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
pop ecx
test edi, edi
je 0x100f77b2
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x100f77b9
lea eax, [edi + 0x10]
jmp 0x100f77be
test ecx, ecx
jne 0x100f790f
xor eax, eax
inc eax
jmp 0x100f793f
push 0x3a
lea eax, [ecx + 0x40]
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
test eax, eax
je 0x100f793d
cmp eax, 1
jne 0x100f790a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
Function at 0x100f79f0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
pop eax
call fcn.1005d1a0
mov eax, esp
lea ecx, [ebp - 0x30]
push 0x1c
push ecx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualQuery]
test eax, eax
je 0x100f7aaa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x50]
lea ecx, [ebp - 8]
xor esi, esi
mov dword [ebp - 8], esi
call fcn.1009e376
test eax, eax
je 0x100f7a53
cmp dword [ebp - 8], esi
jbe 0x100f7a53
mov esi, dword [ebp - 8]
dec esi
lea eax, [ebx - 1]
add esi, ebx
not eax
and esi, eax
je 0x100f7a61
add esi, ebx
lea eax, [ebx + ebx]
cmp esi, eax
jae 0x100f7a6a
mov esi, eax
mov eax, dword [ebp - 0x10]
lea edi, [ebx - 1]
not edi
add eax, ebx
and edi, dword [ebp - 0xc]
sub edi, esi
cmp edi, eax
jb 0x100f7aaa
push 4
push 0x1000
push esi
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
test eax, eax
je 0x100f7aaa
lea eax, [ebp - 0x14]
push eax
push 0x104
push esi
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualProtect]
test eax, eax
je 0x100f7aaa
xor eax, eax
inc eax
jmp 0x100f7aac
xor eax, eax
lea esp, [ebp - 0x60]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret

Function at 0x100f8233
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, edx
push edi
mov edi, ecx
test esi, esi
jns 0x100f824d
mov edx, esi
call fcn.100f7f23
push dword [ebp + 8]
mov edx, ebx
mov ecx, edi
call fcn.100f8270
pop ecx
test esi, esi
jle 0x100f826b
mov ecx, edi
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.100f7f23
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x417e10
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, 0x190
mov ebx, eax
mov edi, esi
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x417f1a
push ebp
lea ecx, [esp + 0x2c]
mov ebp, 4
push ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x30], 8
mov dword [esp + 0x34], ebp
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea edx, [esp + 0x28]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x24], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Width
push eax
call ebx
test eax, eax
jne 0x417eb9
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
call ebx
test eax, eax
pop ebp
jne 0x417ef5
or esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x417f0f
mov edx, dword [0x4c6aec]
push 0x4c67dc
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x47e769
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
retf
sub ch, byte [edx + 0x55fd7f25]
add dh, byte [ebp + 0x64790e0d]
mov esp, 0x58411a1e
outsd dx, dword [esi]
and ch, 0xff
or byte [esi - 0x16f34cdc], al
imul esi, ebp, 0xa57cb4ce
test dword [edi - 0x58], edi
xchg dword [esi - 0x35c5c2a0], edi
std
imul ebp, edi, 0xaeab5488
invalid
insd dword es:[edi], dx
and byte [edx + 0x3d2662b5], 0x68
std
jne 0x47e790
das
inc ebp
loope 0x47e735
fisub word [edx]
popal
salc
sub eax, 0x6ac22937
ja 0x47e709
fisubr word [edi]
setne cl
jmp 0x81a2a964
xchg esi, eax
sbb esi, ebx
sbb al, 0x55
adc dword [eax + edx - 0x241227d3], eax
test byte [ecx], al
mov edx, 0xfc78ada1
rol dword [ebp - 0x6c], 1
xchg esp, eax
xchg esi, eax
movsd dword es:[edi], dword [esi]
aam 0x52
loope 0x47e7ef
inc edx
and al, bl
pop edx
sub eax, 0xadf25ce1
bound esp, qword [edi]
sal dword [edi - 0x6c42fba6], 0x20
lds ebx, [ecx]
pop edi
in al, dx
mov esp, 0x48a27e71
stc
xor bl, 0xe9
inc eax
enter 0x69c6, 0xffffffffffffffae
loop 0x47e7ac
xor eax, 0x40be8bc9
xchg ecx, eax
invalid

Function at 0x494438
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
cwde
push edx
pop edi
scasb al, byte es:[edi]
pop ss
stosd dword es:[edi], eax
add edx, dword [esi]
invalid
Function at 0x4bb605
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33a0
cmp edx, dword [eax]
je 0x4bb627
add eax, 8
inc ecx
cmp eax, 0x4c3430
jl 0x4bb618
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33a0]
jne 0x4bb755
mov eax, dword [0x4c7d2c]
cmp eax, 1
je 0x4bb72f
test eax, eax
jne 0x4bb658
cmp dword [0x4c32cc], 1
je 0x4bb72f
cmp edx, 0xfc
je 0x4bb755
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb68f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbff0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc480
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb6d2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc480
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09d4
push edi
call fcn.004be350
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbff0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc000
lea eax, [ebp - 0xa0]
push 0x4c09b4
push eax
call fcn.004bc000
push dword [esi + 0x4c33a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc000
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be2c4
add esp, 0x2c
pop edi
jmp 0x4bb755
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33a4]
push 0
push eax
push dword [esi]
call fcn.004bc480
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4032f9
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x411484
call fcn.00410d90
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.00401e46
push 0
push 0x1f4
mov ecx, edi
call fcn.00405fe4
lea eax, [ebp - 0x18]
push 0x45
push eax
call fcn.00405e3f
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.00405e5f
push dword [ebp - 0x18]
call fcn.0040391b
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x404696
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
setne al
ret 8

Function at 0x4046be
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x417660], 0
jne 0x4046f5
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040470a
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call fcn.00404696
push dword [ebp - 0xc]
mov bl, al
call fcn.0040391b
pop ecx
mov al, bl
pop ebx
jmp 0x404706
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
setne al
leave
ret 8

Function at 0x40475c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x417660], 0
jne 0x40478f
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040470a
push dword [eax]
call fcn.004046ac
push dword [ebp - 0xc]
mov bl, al
call fcn.0040391b
pop ecx
mov al, bl
pop ebx
jmp 0x40479d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x4047b5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x417660], 0
jne 0x4047e8
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040470a
push dword [eax]
call fcn.004047a1
push dword [ebp - 0xc]
mov bl, al
call fcn.0040391b
pop ecx
mov al, bl
pop ebx
jmp 0x4047f8
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x404a21
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x417660], 0
jne 0x404a54
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040470a
push dword [eax]
call fcn.00404a00
push dword [ebp - 0xc]
mov bl, al
call fcn.0040391b
pop ecx
mov al, bl
pop ebx
jmp 0x404a70
push 0
push dword [ebp + 8]
call fcn.004046be
test al, al
je 0x404a70
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
setne al
leave
ret 4
Function at 0x405010
Capabilities:
Delete file

Disassembly:
mov eax, 0x4117c4
call fcn.00410d90
sub esp, 0x10
push ebx
push esi
lea ecx, [ebp - 0x1c]
call fcn.004050ca
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
push esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.00404f61
test al, al
je 0x4050a7
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x405092
push dword [esi]
call fcn.004056d6
test al, al
jne 0x40506e
push dword [esi]
call fcn.004047a1
test al, al
jne 0x405090
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4050a7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404fec
push dword [ebp - 0x18]
call fcn.0040391b
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.004050ca
mov dword [ebp - 4], ebx
jmp 0x40502f
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.00404fec
push dword [ebp - 0x18]
call fcn.0040391b
pop ecx
mov al, bl
jmp 0x4050ba
lea ecx, [ebp - 0x1c]
call fcn.00404fec
push dword [ebp - 0x18]
call fcn.0040391b
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40554e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x411830
call fcn.00410d90
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
mov eax, dword [esi]
push 0
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
push 0
mov dword [edi + 0x18], eax
push dword [esi + 0x1c]
call fcn.00410f40
mov ecx, dword [esi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x2c]
adc edx, ebx
push eax
mov dword [edi + 0x24], edx
call fcn.00403a2c
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00405607
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.00401e46
push dword [ebp - 0x24]
call fcn.0040391b
push dword [ebp - 0x18]
call fcn.0040391b
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4058ac
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4058d2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x4058d2
xor al, al
jmp 0x4058f2
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00410f40
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x4090c2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x411d87
call fcn.00410d90
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x413604
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x4135fc
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00404168
push dword [esi + 8]
mov ecx, ebx
call fcn.00404168
push dword [esi + 0xc]
mov ecx, edi
call fcn.00404168
push dword [esi + 0xc]
mov ecx, edi
call fcn.00404168
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4090ce
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x411d87
call fcn.00410d90
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x413604
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x4135fc
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00404168
push dword [esi + 8]
mov ecx, ebx
call fcn.00404168
push dword [esi + 0xc]
mov ecx, edi
call fcn.00404168
push dword [esi + 0xc]
mov ecx, edi
call fcn.00404168
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x410a15
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.004109df
pop ebp
ret 0xc
Function at 0x410b6d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov edx, dword [ecx]
and edx, 7
cmp dword [ebp + 0xc], 5
jb 0x410cbd
add dword [ebp + 0x10], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
lea esi, [eax + ecx]
mov eax, dword [ebp + 0xc]
lea edi, [ecx + eax - 4]
cmp esi, edi
jae 0x410bad
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x410bad
inc esi
jmp 0x410b9e
mov eax, esi
sub eax, ecx
cmp esi, edi
mov dword [ebp - 8], eax
jae 0x410c9d
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x410be2
xor edx, edx
mov cl, byte [esi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x410c0f
cmp cl, 0xff
je 0x410c0f
and edx, 3
shl edx, 1
or edx, 1
inc eax
jmp 0x410b91
dec ecx
shl edx, cl
and edx, 7
je 0x410bc8
movzx ecx, byte [edx + 0x4138b4]
mov edi, esi
sub edi, ecx
cmp byte [edx + 0x4138ac], 0
mov cl, byte [edi + 4]
je 0x410c0a
test cl, cl
je 0x410c0a
cmp cl, 0xff
jne 0x410bc8
mov dword [ebp - 4], eax
jmp 0x410bd7
xor ebx, ebx
mov bh, cl
mov bl, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x410c38
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x410c3f
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x410c73
movzx edi, byte [edx + 0x4138b4]
push 0x18
mov eax, ebx
shl edi, 3
pop ecx
sub ecx, edi
shr eax, cl
test al, al
je 0x410c5e
cmp al, 0xff
jne 0x410c70
push 0x20
mov eax, dword [ebp - 8]
pop ecx
push 1
sub ecx, edi
pop edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x410c2a
mov eax, dword [ebp - 8]
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
add eax, 5
jmp 0x410b91
mov esi, eax
push 3
sub esi, dword [ebp - 4]
pop edi
lea ecx, [esi - 1]
shl edx, cl
and edx, 7
cmp edi, esi
sbb ecx, ecx
pop edi
not ecx
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
pop ebx
mov dword [edx], ecx
leave
ret 0x14
Function at 0x411160
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, ecx
mov esi, edx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
test edi, edi
je 0x41118f
test esi, 7
je 0x41118f
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x411174
cmp edi, 0x10
jb 0x411218
mov dword [esp + 0x14], edi
sub edi, 8
and edi, 0xfffffff8
sub dword [esp + 0x14], edi
add edi, esi
xor eax, dword [esi]
mov ebx, dword [esi + 4]
movzx ecx, bl
mov edx, dword [ebp + ecx*4 + 0xc00]
movzx ecx, bh
xor edx, dword [ebp + ecx*4 + 0x800]
shr ebx, 0x10
movzx ecx, bl
xor edx, dword [ebp + ecx*4 + 0x400]
xor edx, dword [esi + 8]
movzx ecx, al
movzx ebx, bh
xor edx, dword [ebp + ebx*4]
mov ebx, dword [esi + 0xc]
xor edx, dword [ebp + ecx*4 + 0x1c00]
movzx ecx, ah
add esi, 8
shr eax, 0x10
xor edx, dword [ebp + ecx*4 + 0x1800]
movzx ecx, al
xor edx, dword [ebp + ecx*4 + 0x1400]
movzx ecx, ah
mov eax, dword [ebp + ecx*4 + 0x1000]
movzx ecx, bl
xor eax, edx
cmp esi, edi
jne 0x4111b0
xor eax, dword [esi]
mov edi, dword [esp + 0x14]
test edi, edi
je 0x41122f
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x41121c
pop ebp
pop edi
pop esi
pop ebx
ret 8
Function at 0x1915108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01915258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x191512e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x191511a
add dl, dl
jne 0x1915139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x191518c
xor eax, eax
add dl, dl
jne 0x1915146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x191522d
add dl, dl
jne 0x1915155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1915160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x191516b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1915176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1915182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1915125
mov eax, 1
add dl, dl
jne 0x191519a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19151a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1915191
sub eax, ebx
mov ebx, 1
jne 0x19151d8
mov ecx, 1
add dl, dl
jne 0x19151be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19151c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19151b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1915125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x19151ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19151fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19151e6
cmp eax, 0x7d00
jae 0x191521d
cmp eax, 0x500
jb 0x1915218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1915125
cmp eax, 0x7f
ja 0x1915220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1915125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x191524e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1915125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10