joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc5bd90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x599000]
push edi
jmp 0xc5bdaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc5bdb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc5bda0
mov eax, 1
add ebx, ebx
jne 0xc5bdc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc5bdd4
jne 0xc5bdf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc5bdf3
dec eax
add ebx, ebx
jne 0xc5bde0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xc5bdb8
add ebx, ebx
jne 0xc5bdef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xc5be45
xor ecx, ecx
sub eax, 3
jb 0xc5be0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc5be7a
sar eax, 1
mov ebp, eax
jmp 0xc5be16
add ebx, ebx
jne 0xc5be16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc5bde4
inc ecx
add ebx, ebx
jne 0xc5be24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc5bde4
add ebx, ebx
jne 0xc5be31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc5be26
jne 0xc5be42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc5be26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc5be64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc5be56
jmp 0xc5bda6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc5be64
add edi, ecx
jmp 0xc5bda6
pop esi
mov edi, esi
mov ecx, 0xa7aa
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xc5be82
cmp byte [edi], 0x22
jne 0xc5be82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xc5be87
lea edi, [esi + 0x857000]
mov eax, dword [edi]
or eax, eax
je 0xc5beff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x85d348]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x85d49c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc5beb4
mov ecx, edi
jns 0xc5bee3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x85d4a0]
or eax, eax
je 0xc5bef9
mov dword [ebx], eax
add ebx, 4
jmp 0xc5bed1
call dword [esi + 0x85d4b0]
mov ebp, dword [esi + 0x85d4a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc5bf33
sub esp, 0xffffff80
jmp 0x5692f9
Function at 0x100f05ae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101c5498]
jne 0x100f05b8
repz ret
jmp fcn.100fd262

Function at 0x1010188f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100eda46
and dword [ebp - 4], 0
cmp dword [0x101c6e78], 0
mov ebx, eax
jne 0x10101940
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x101019f1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x101019f1
push eax
call fcn.100ed9d4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101c6e78], eax
call esi
push eax
call fcn.100ed9d4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101c6e7c], eax
call esi
push eax
call fcn.100ed9d4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101c6e80], eax
call esi
push eax
call fcn.100ed9d4
pop ecx
mov dword [0x101c6e88], eax
test eax, eax
je 0x10101940
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100ed9d4
pop ecx
mov dword [0x101c6e84], eax
mov eax, dword [0x101c6e84]
cmp eax, ebx
je 0x10101998
cmp dword [0x101c6e88], ebx
je 0x10101998
push eax
call fcn.100eda4f
push dword [0x101c6e88]
mov esi, eax
call fcn.100eda4f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10101998
test edi, edi
je 0x10101998
call esi
test eax, eax
je 0x1010198f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1010198f
test byte [ebp - 0xc], 1
jne 0x10101998
or dword [ebp + 0x10], 0x200000
jmp 0x101019d1
mov eax, dword [0x101c6e7c]
cmp eax, ebx
je 0x101019d1
push eax
call fcn.100eda4f
pop ecx
test eax, eax
je 0x101019d1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x101019d1
mov eax, dword [0x101c6e80]
cmp eax, ebx
je 0x101019d1
push eax
call fcn.100eda4f
pop ecx
test eax, eax
je 0x101019d1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101c6e78]
call fcn.100eda4f
pop ecx
test eax, eax
je 0x101019f1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x101019f3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10104c6f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [0x101c47f8]
add ecx, 0x205c
mov dword [0x101c47f4], ecx
mov dword [0x101c47f8], 0x879
mov dword [ebp - 0x10], eax
call fcn.1010606a
xor ecx, ecx
mov edx, eax
mov dword [0x101c47f4], 0xfffff7a8
mov esi, dword [eax + 0x3c]
mov dword [0x101c47f8], 0x2416
mov dword [0x101c47f4], 0x1348
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x101c47f4], 0x254a
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x10104de2
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
je 0x10104d78
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x10104d27
mov al, byte [ebp - 0x46]
test al, 1
jne 0x10104db5
jmp 0x10104d81
xor eax, eax
mov dword [0x101c47f4], 0x150d
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x34]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jb 0x10104d0d
jmp 0x10104de2
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov dword [0x101c47f8], 0x2552
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101c47f4], 0xfffff15b
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10104e8a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101c47f4], 0x204b
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
jmp 0x10104f01
lea eax, [ebp - 0x28]
mov dword [0x101c47f8], 0x1bbe
mov dword [0x101c47f4], 0x14
mov dword [ebp - 0x38], eax
call fcn.1010560f
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.10105288
mov dword [0x101c47f4], 0xeeb
mov dword [0x101c47f8], 0xfffffe15
cmp eax, 0
mov dword [ebp - 0x3c], eax
je 0x10104fe3
jmp 0x10104f29
mov eax, dword [ebp - 0x34]
mov cl, byte [eax + 0x101b65e4]
mov dl, byte [eax + 0x101b65b5]
sub dl, cl
mov byte [ebp + eax - 0x28], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x34], eax
je 0x10104eaf
jmp 0x10104f01
mov eax, dword [ebp - 0x3c]
mov dword [0x101c47f4], 0x2578
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.10104fec
mov dword [0x101c47f8], 0x145b
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov edx, dword [ebp - 0x40]
mov dword [edx + 0x3c], 0xd0
mov dword [edx + 0xd0], 0x4550
add edx, 0xffc00000
mov esi, dword [ebp - 0x30]
mov dword [esi + 0x3c], edx
mov edx, dword [ebp - 0x40]
mov dword [esi + 0x40], edx
mov edi, dword [0x101c47f8]
add edi, 0xffffec67
mov dword [0x101c47f4], edi
add edx, 0x1cd9
mov edi, dword [ebp - 0x40]
cmp edi, 0
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], eax
je 0x10104fd9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
add esp, 0x54
pop esi
pop edi
pop ebp
ret
xor eax, eax
add esp, 0x54
pop esi
pop edi
pop ebp
ret
Function at 0x10105102
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101c4800], 0
mov byte [0x101c4804], 0
mov dword [0x101c47f8], 0x2449
mov dword [0x101c47f4], 0x109e
mov dword [0x101c47fc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10105170
xor eax, eax
mov dword [0x101c47fc], 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x1d78
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x101051bc
mov eax, dword [ebp - 0x1c]
mov dword [0x101c47f8], 0x206
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101c47f4]
mov esi, eax
add esi, 0xfffff9d0
mov dword [0x101c47f4], esi
mov esi, dword [0x101c47fc]
add esi, 1
mov dword [0x101c47fc], esi
cmp esi, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jl 0x10105170
jmp 0x10105153
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x3a46
mov esi, 0x100
mov dword [0x101c4808], 0
mov edi, dword [0x101c4800]
mov ebx, dword [ebp - 0x18]
movzx ebx, byte [ebx + eax]
add ebx, edi
mov dword [ebp - 0x2c], eax
xor edi, edi
mov dword [ebp - 0x30], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ebx, edx
mov dword [0x101c4808], ebx
mov dword [0x101c47f8], ecx
mov dword [0x101c47f4], 0xe04
mov eax, ebx
cdq
idiv esi
mov dword [0x101c4800], edx
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov cl, byte [ecx + esi]
mov byte [0x101c4804], cl
mov dword [0x101c47f8], 0x18fd
mov ebx, dword [ebp - 0x18]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x101c4804]
mov edx, dword [0x101c4800]
mov byte [ebx + edx], cl
mov dword [0x101c47f4], 0x169e
mov edx, dword [0x101c47fc]
add edx, 1
mov dword [0x101c47fc], edx
cmp edx, 0x100
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
jl 0x101051bc
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10105ce5
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [0x101c47f8], 0x2455
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [0x101c47f8], 0x15ac
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10105d25
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x10105d52
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x10105d25
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [0x101c47f4]
add edx, 0xffffed2c
mov dword [0x101c47f4], edx
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x10105e4d
xor eax, eax
mov dword [0x101c47f4], 0x2d1a
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x20], eax
jne 0x10105e4d
xor eax, eax
mov dword [0x101c47f4], 0x6a7
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x20], eax
jne 0x10105e4d
xor eax, eax
mov dword [0x101c47f4], 0x468
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x20], eax
jne 0x10105e4d
mov dword [0x101c47f4], 0xffffe829
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff7
mov dword [ebp - 0x24], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2], 0x64
mov dword [ebp - 0x20], eax
jne 0x10105e4d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x20], eax
jne 0x10105e4d
xor eax, eax
mov dword [0x101c47f8], 0x401
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
jne 0x10105e4d
mov eax, 1
mov dword [0x101c47f4], 0x2389
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop ebp
ret
Function at 0x101061e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0xffffff79
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, 0xfffff00e
mov dword [0x101c47fc], 0
mov dword [0x101c4800], 0
mov dword [0x101c480c], 0
mov dword [ebp - 0x14], eax
mov eax, dword [0x101c47f4]
add eax, 0xffffda0d
mov dword [0x101c47f8], eax
mov dword [0x101c47f4], 0x4ad
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edi
je 0x101063c3
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
mov ebx, 0x6b6
mov dword [ebp - 0x40], eax
mov eax, 0x100
mov dword [0x101c47f4], ecx
add edx, 1
mov dword [ebp - 0x44], eax
mov eax, edx
cdq
mov ecx, dword [ebp - 0x44]
idiv ecx
mov dword [0x101c47fc], edx
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ecx + edx]
add ecx, esi
mov eax, ecx
mov dword [ebp - 0x48], edx
cdq
mov ecx, dword [ebp - 0x44]
idiv ecx
mov dword [0x101c4800], edx
mov esi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x48]
mov cl, byte [esi + ecx]
mov byte [0x101c4804], cl
add edi, 0x1ab1
mov dword [0x101c47f4], edi
mov cl, byte [esi + edx]
mov edx, dword [ebp - 0x48]
mov byte [esi + edx], cl
mov edi, dword [0x101c47f8]
add edi, 0xffffe8ac
mov dword [0x101c47f8], edi
mov cl, byte [0x101c4804]
mov edi, dword [0x101c4800]
mov byte [esi + edi], cl
mov edi, dword [0x101c47fc]
movzx edi, byte [esi + edi]
mov ecx, dword [0x101c4800]
movzx ecx, byte [esi + ecx]
add ecx, edi
and ecx, 0xff
mov dword [0x101c480c], ecx
mov dword [0x101c47f8], 0x3cd
mov dword [0x101c47f4], 0x2296
mov cl, byte [esi + ecx]
mov edi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x40]
mov ch, byte [edi + edx]
mov dword [0x101c47f8], 0x31f
mov byte [0x101c4811], ch
mov byte [0x101c4812], cl
xor ch, cl
mov byte [0x101c4810], ch
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x40]
mov byte [edx + esi], ch
mov dword [0x101c47f4], 0xbea
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x3c], ebx
je 0x101063c3
mov eax, 0xfffff74b
mov ecx, dword [0x101c47fc]
mov edx, dword [0x101c4800]
mov esi, dword [0x101c47f8]
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], edi
jmp 0x10106277
mov eax, dword [ebp - 0x3c]
mov dword [0x101c47f4], eax
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101063d3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov dword [0x101c47f4], 0x870
call fcn.10001070
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x1010640d
jmp 0x1010653d
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
jmp 0x1010653d
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x101c47f8], 0xa27
mov dword [0x101c47f4], 0x18d4
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.101059ed
lea ecx, [0x101055ac]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x54], 0x12b200
mov edx, dword [0x101c47e0]
mov dword [esp + 0x64], edx
mov edx, dword [0x101c47e4]
mov dword [esp + 0x70], edx
mov edx, dword [0x101c47e8]
mov dword [esp + 0x50], edx
mov edx, dword [0x101c47ec]
mov dword [esp + 0x68], edx
mov edx, dword [0x101c47f0]
mov dword [esp + 0x60], edx
mov dword [0x101c47f4], 0x352
mov dword [0x101c47f8], 0x139f
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x101064bc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x101064d0
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10106499
mov eax, dword [esp + 0x10]
mov dword [esp + 0x58], eax
mov dword [0x101c47f8], 0x2416
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x44], edx
mov dword [0x101c47f4], 0x64f
call fcn.10105ce5
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x20], ecx
jne 0x10106400
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10104e8a
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x20], eax
jmp 0x10106400
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
Function at 0xcd3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00cd31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xcd307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcd306a
add dl, dl
jne 0xcd3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcd30dc
xor eax, eax
add dl, dl
jne 0xcd3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcd317d
add dl, dl
jne 0xcd30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xcd30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xcd3075
mov eax, 1
add dl, dl
jne 0xcd30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcd30e1
sub eax, ebx
mov ebx, 1
jne 0xcd3128
mov ecx, 1
add dl, dl
jne 0xcd310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcd3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcd3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcd3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcd313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcd314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcd3136
cmp eax, 0x7d00
jae 0xcd316d
cmp eax, 0x500
jb 0xcd3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcd3075
cmp eax, 0x7f
ja 0xcd3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcd3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xcd319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xcd3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40a580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x6040c100]
push esi
push edi
mov edi, dword [ebp + 8]
add ebx, eax
push edi
movsb byte es:[edi], byte [esi]
shr dword [edx + 0x5c], cl
push edi
mov ebp, dword [eax + 0x65]
rol dword [ebx - 0x39c4d53c], cl
jbe fcn.0040a550
mov esi, eax
test esi, esi
jne 0x40a600
push 0x3a
push edi
call ebx
mov esi, eax
cmp dword [ebx], 8
je 0x40a5aa
je 0x40a5c0
lea eax, [esi - 0x55]
pop edi
pop esi
sbb dword [ebp - 0x3e], ebx
pop esi
and al, 0x8b
jno 0x40a622
mov esi, dword [ecx + 0x5f]
pop esi
pop ebx
pop ebp
mov al, 4
add byte [eax - 0x6f6f6f70], dl
sub eax, 0x148b5590
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
push edi
mov dword [ebp - 4], 0x18000000
jge 0x40a5f9
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [eax], 0
je 0x40a5f9
clc
dec esp
cwde
or al, 0xb2
test ecx, ecx
jne 0x40a5f0
lea eax, [ebx*4 + 4]
push esi
push eax
call dword [0xc540c15c]
or dword [esi + 4], 7
clc
lodsb al, byte [esi]
cld
mov dword [ebp - 0xc], edi
jle 0x40a64a
mov eax, dword [ebp + 0xc]
mov esi, edi
in eax, dx
invalid
jg 0x40a666
inc ebp
push ebp
mov ecx, dword [eax + esi]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
sub dword [ecx + 4], 0x40
mov dword [esi], eax
mov edx, dword [ebp - 4]
add edx, eax
mov ebp, edi
clc
add esi, 4
dec eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
loop 0x40a692
mov eax, dword [ebp - 4]
lea ecx, [eax + eax*2]
add dword [eax - 0x77], edx
inc ebp
test al, 0xff
adc eax, sym.imp.MSVCRT.dll_malloc
add esp, 4
xor ecx, ecx
insd dword es:[edi], dx
fisttp dword [ecx - 0xf7407bb]
jle 0x40a6bd
invalid
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
sub eax, ecx
mov ecx, dword [ebp - 4]
sub eax, 0x5d891045
or al, 0x89
pop ebp
call 0x71cc5a6c
adc byte [ebp - 0x65b2ace9], cl
lea esp, [0xf05589fc]
mov esi, dword [ecx + 0x10]
lea edx, [edi]
push ebx
dec ebp
lcall 0xf055, 0x89fc258d
mov dword [edi], esi
mov eax, dword [esp + ecx*8]
sahf
lea edx, [ebp - 0x4d]
push esi
fld dword [ecx]
call fcn.0040abf0
ror byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
sub eax, ecx
add dword [edx], 0xfffffff5
add eax, 0xc458bf0
dec eax
dec edx
xor ah, al
jne 0x40a67f
mov edi, dword [ebp - 0xc]
mov ebp, dword [eax]
call 0xc838d049
iretd
invalid
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x21b43172
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x4c175ecd
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219