joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c9c3
Capabilities:
Create pipe
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002ca26
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002ca17
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002ca15
push 0
push 0x2a5
push 0xc83
push 0xec5
push 0x197c
push 0x882
push 0x300
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x1002ca24
push 0x244d
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1002ca4b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x14]
call fcn.10014fab
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1002da6e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002dabe
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002dab4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002dab2
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1002dabc
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x1002db16
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002daf9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002daf7
push 0
push 0x15fc
push 0x1ae0
push 0
push 0x1c22
push 0x15
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x1002db16
push 0
push 0x15fc
push 0x1ae0
push 0
push 0x1c22
push 0x15
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esp, ebp
pop ebp
ret
Function at 0x10037d3d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0x2c03342e
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0x3b6182ea
push ebx
mov dword [ebp - 0x14], 0xfffffff9
xor ebx, ebx
push edi
mov dword [ebp - 0x10], 0x6a205b29
mov edi, ecx
mov dword [ebp - 8], ebx
jmp 0x10037d7b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x10037d71
mov dword [ebp - 0xc], 0xffffffeb
jmp 0x10037e03
mov dword [ebp - 0x10], 0x26ff23b1
lea ecx, [ebp - 0x28]
push 3
call fcn.1000dfce
mov dword [ebp - 0x10], 2
mov dword [ebp - 8], ebx
jmp 0x10037db5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1c], 0xfffffffa
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x10037da7
mov dword [ebp - 8], ebx
jmp 0x10037dd0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov dword [eax + ecx*4], 0x84bc9c3d
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10037dc0
dec dword [ebp - 0x10]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10037de9
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x28], ebx
je 0x10037e00
push dword [ebp - 0x28]
call fcn.100511a2
pop ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffea
jne 0x10037d8a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp byte [edi], bl
je 0x10037e1b
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100389c1
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 3
xor ebx, ebx
lea ecx, [ebp - 0x20]
pop esi
mov byte [ebp - 2], bl
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0x9a54e587
push esi
call fcn.1000dfce
mov dword [ebp - 0xc], ebx
jmp 0x100389fd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov dword [eax + ecx*4], 0xfff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100389ed
mov dword [ebp - 8], 0xa
jmp 0x10038a74
mov dword [ebp - 0xc], 0x47d2038e
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x14], 0xdfbc43cc
cmp dword [ebp - 0x10], 2
jl 0x10038a29
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, 0xef7d2668
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
sub eax, 0x736d
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [ebp - 8]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
sub ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 0xfffffff6
mov dword [ebp - 0xc], ecx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff0
je 0x10038a0b
mov dword [ebp - 8], ebx
jmp 0x10038ac1
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10038aa4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x8b8
push 0x228b
push 0x25fc
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0xc], ebx
jmp 0x10038ab9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov dword [eax + ecx*4], 0x9209
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10038aa9
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jl 0x10038a7f
cmp dword [ebp - 0x20], ebx
je 0x10038ad5
push dword [ebp - 0x20]
call fcn.100511a2
pop ecx
cmp byte [ebp - 2], bl
je 0x10038af1
push ebx
push ebx
push 0x77f
push 0x21a4
push 0xbdc
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10066055
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10071768]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100571f8
mov dword [ebp - 0x14], eax
cmp dword [0x1065ee28], esi
jne 0x10066148
push 0x800
push esi
push 0x100088d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100660d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10066228
push esi
push esi
push 0x100088d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10066228
push 0x100088f0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10066228
push eax
call ebx
push 0x100088fc
push edi
mov dword [0x1065ee28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000890c
push edi
mov dword [0x1065ee2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008920
push edi
mov dword [0x1065ee30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065ee38], eax
test eax, eax
je 0x10066145
push 0x1000893c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065ee34], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006616d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10066160
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10066182
push 4
pop eax
jmp 0x1006622a
cmp dword [ebp - 0x14], esi
je 0x10066182
push dword [0x1065ee28]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10066167
mov eax, dword [0x1065ee34]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100661e0
cmp dword [0x1065ee38], edi
je 0x100661e0
push eax
call ebx
push dword [0x1065ee38]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100661e0
test eax, eax
je 0x100661e0
call ecx
test eax, eax
je 0x100661d5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100661d5
test byte [ebp - 8], 1
jne 0x100661e0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10066210
mov eax, dword [0x1065ee2c]
cmp eax, edi
je 0x1006620d
push eax
call ebx
test eax, eax
je 0x1006620d
call eax
mov esi, eax
test esi, esi
je 0x1006620d
mov eax, dword [0x1065ee30]
cmp eax, edi
je 0x1006620d
push eax
call ebx
test eax, eax
je 0x1006620d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065ee28]
call ebx
test eax, eax
je 0x10066228
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006622a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10054178
mov esp, ebp
pop ebp
ret
Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c84
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404650
call fcn.00405880
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x4094d8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409532
inc esi
xor edi, edi
cmp edi, 1
jne 0x4094fe
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40950c
cmp edi, 1
jle 0x40950c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408fbc
test eax, eax
jne 0x409532
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409532
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409532
inc edi
dec esi
jne 0x4094ee
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x40953c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409589
xor ebx, ebx
jmp 0x40957e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404c30
test eax, eax
jne 0x40957d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40955f
mov al, byte [ebp - 1]
sub al, 1
jb 0x409594
je 0x40959d
jmp 0x4095a6
call fcn.00407024
mov edi, eax
jmp 0x4095a8
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x4095a8
xor edi, edi
test di, di
je 0x409639
xor ebx, ebx
jmp 0x4095e4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4095e3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095d8
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4095e3
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095b5
xor ebx, ebx
jmp 0x40962e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40962d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409622
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x40962d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095f3
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x62
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408941
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
or edx, edx
and eax, eax
call fcn.0040896c
push edx
mov eax, dword [esp]
add esp, 4
xor dword [esi], ecx
mov edx, edx
inc esi
sub edx, 0x864a6d38
cmp esi, ebx
jne fcn.00408941
or eax, edx
sub eax, edx
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x20ff058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.020ff1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x20ff07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x20ff06a
add dl, dl
jne 0x20ff089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x20ff0dc
xor eax, eax
add dl, dl
jne 0x20ff096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x20ff17d
add dl, dl
jne 0x20ff0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20ff0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20ff0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20ff0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x20ff0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x20ff075
mov eax, 1
add dl, dl
jne 0x20ff0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x20ff0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20ff0e1
sub eax, ebx
mov ebx, 1
jne 0x20ff128
mov ecx, 1
add dl, dl
jne 0x20ff10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x20ff119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20ff105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20ff075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x20ff13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x20ff14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20ff136
cmp eax, 0x7d00
jae 0x20ff16d
cmp eax, 0x500
jb 0x20ff168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20ff075
cmp eax, 0x7f
ja 0x20ff170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20ff075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x20ff19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x20ff075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407288
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x14]
push esi
mov esi, edx
mov dword [ebp - 0x38], ebx
push edi
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
call fcn.004071cc
mov edi, dword [ebp - 0x14]
mov eax, dword [esi + 8]
add edi, 0x23f
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov edx, dword [ebp - 0xc]
mov eax, edx
mov ecx, dword [0x1e0a274]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x407310
push 0x401118
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [0x1e0a274]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x1e0a2b8]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0x1e0a2b8], eax
mov eax, dword [0x1e0a2c0]
cmove eax, dword [ebp - 0x24]
mov dword [0x1e0a2c0], eax
lea eax, [edi + edx]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x1e0a2bc], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x1c]
sub ebx, eax
mov dword [ebp - 8], eax
mov eax, ebx
mov dword [ebp - 0x1c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
cmp dword [0x1e0a274], 0xb03
jne 0x4073e7
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0x40111c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4072d8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x38]
pop edi
pop esi
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407431
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
shr esi, 3
push edi
mov edi, ecx
test esi, esi
je 0x40746f
cmp dword [0x1e0a274], 0x959
jne 0x40745f
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00407288
add edi, 8
dec esi
jne 0x407441
pop edi
pop esi
pop ebp
ret 4