joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008dfd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x10008dfd
add byte [eax + 0x4b], dl
inc ebp
dec edi
xor edi, dword [ecx]
cmp dword [eax - 0x7d], ecx
les eax, [ecx + eax*4]
loope 0x10008da3
dec esp
add dword [eax], eax
xor ecx, 0x17512
jne 0x10008e0c
invalid
pop ecx
cmp dword [ebp - 0xce4], 0
jne 0x10008e25
mov dword [ebp - 0x778], 0
jmp 0x10009070
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0x514], eax
push edx
call 0x10008e3f
add byte [edx + 0x36], cl
dec esp
aas
dec ebx
aaa
add esp, 4
sub edx, 0xa59
or edx, 0x83d
add edx, 0x4c71
pop edx
push eax
and eax, 0x151d9
xor eax, 0x5de
pop eax
lea ecx, [ebp - 0x17ac]
mov dword [ebp - 0xce0], ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcdc], eax
xor ecx, ecx
mov word [ebp - 0x23c], cx
xor edx, edx
mov word [ebp - 0x50], dx
push edx
push ecx
add esp, 4
add edx, 0x3ab3
xor edx, 0x13115
and edx, 0x5eaa
xor edx, 0x692a
pop edx
push esi
or esi, 0xd359
xor esi, 0xe527
or esi, 0xef74
pop esi
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1056], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1056]
mov word [ebp - 0x23c], ax
mov ecx, dword [ebp - 0xce0]
mov dx, word [ecx]
mov word [ebp - 0x1058], dx
mov eax, dword [ebp - 0xce0]
add eax, 2
mov dword [ebp - 0xce0], eax
mov cx, word [ebp - 0x1058]
mov word [ebp - 0x50], cx
push esi
push esi
add esp, 4
add esi, 0x53d3
or esi, 0x15c57
or esi, 0x2e79
pop esi
push esi
push esi
add esp, 4
sub esi, 0xbf03
or esi, 0xcf10
jmp 0x10008f47
pop esi
movzx edx, word [ebp - 0x50]
push ebp
mov al, 0x85
sal byte [ebp + 0x15], cl
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
sub eax, ecx
mov dword [ebp - 0x1638], eax
jmp 0x10008fbf
movzx edx, word [ebp - 0x23c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x10008e8d
movzx ecx, word [ebp - 0x23c]
xor ecx, 0x20
movzx edx, word [ebp - 0x50]
cmp ecx, edx
je 0x10008e8d
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
cmp eax, ecx
jge 0x10008fa9
mov dword [ebp - 0x1634], 0xffffffff
jmp 0x10008fb3
mov dword [ebp - 0x1634], 1
mov edx, dword [ebp - 0x1634]
mov dword [ebp - 0x1638], edx
cmp dword [ebp - 0x1638], 0
jne 0x10009008
push ecx
push edx
add esp, 4
add ecx, 0x140cc
and ecx, 0x4bda
xor ecx, 0x6058
jmp 0x10008fe8
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x7a7
jmp 0x10008ff9
pop ebx
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x778], eax
jmp 0x10009070
push ebx
push edx
add esp, 4
jmp 0x10009014
or ebx, 0x1278a
pop ebx
push edx
xor edx, 0xf944
or edx, 0x55c
call 0x10009036
add byte [eax + 0x4e], dl
dec ebp
dec esp
inc esi
dec ebp
inc ebp
xor al, 0x83
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x514]
mov edx, dword [ecx]
mov dword [ebp - 0x514], edx
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0xce4]
je 0x10009066
mov ecx, dword [ebp - 0x514]
cmp dword [ecx + 0x30], 0
jne 0x10008e31
mov dword [ebp - 0x778], 0
Function at 0x10008e3f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x10008dfd
add byte [eax + 0x4b], dl
inc ebp
dec edi
xor edi, dword [ecx]
cmp dword [eax - 0x7d], ecx
les eax, [ecx + eax*4]
loope 0x10008da3
dec esp
add dword [eax], eax
xor ecx, 0x17512
jne 0x10008e0c
invalid
pop ecx
cmp dword [ebp - 0xce4], 0
jne 0x10008e25
mov dword [ebp - 0x778], 0
jmp 0x10009070
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0x514], eax
push edx
call 0x10008e3f
add byte [edx + 0x36], cl
dec esp
aas
dec ebx
aaa
add esp, 4
sub edx, 0xa59
or edx, 0x83d
add edx, 0x4c71
pop edx
push eax
and eax, 0x151d9
xor eax, 0x5de
pop eax
lea ecx, [ebp - 0x17ac]
mov dword [ebp - 0xce0], ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcdc], eax
xor ecx, ecx
mov word [ebp - 0x23c], cx
xor edx, edx
mov word [ebp - 0x50], dx
push edx
push ecx
add esp, 4
add edx, 0x3ab3
xor edx, 0x13115
and edx, 0x5eaa
xor edx, 0x692a
pop edx
push esi
or esi, 0xd359
xor esi, 0xe527
or esi, 0xef74
pop esi
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1056], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1056]
mov word [ebp - 0x23c], ax
mov ecx, dword [ebp - 0xce0]
mov dx, word [ecx]
mov word [ebp - 0x1058], dx
mov eax, dword [ebp - 0xce0]
add eax, 2
mov dword [ebp - 0xce0], eax
mov cx, word [ebp - 0x1058]
mov word [ebp - 0x50], cx
push esi
push esi
add esp, 4
add esi, 0x53d3
or esi, 0x15c57
or esi, 0x2e79
pop esi
push esi
push esi
add esp, 4
sub esi, 0xbf03
or esi, 0xcf10
jmp 0x10008f47
pop esi
movzx edx, word [ebp - 0x50]
push ebp
mov al, 0x85
sal byte [ebp + 0x15], cl
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
sub eax, ecx
mov dword [ebp - 0x1638], eax
jmp 0x10008fbf
movzx edx, word [ebp - 0x23c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x10008e8d
movzx ecx, word [ebp - 0x23c]
xor ecx, 0x20
movzx edx, word [ebp - 0x50]
cmp ecx, edx
je 0x10008e8d
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
cmp eax, ecx
jge 0x10008fa9
mov dword [ebp - 0x1634], 0xffffffff
jmp 0x10008fb3
mov dword [ebp - 0x1634], 1
mov edx, dword [ebp - 0x1634]
mov dword [ebp - 0x1638], edx
cmp dword [ebp - 0x1638], 0
jne 0x10009008
push ecx
push edx
add esp, 4
add ecx, 0x140cc
and ecx, 0x4bda
xor ecx, 0x6058
jmp 0x10008fe8
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x7a7
jmp 0x10008ff9
pop ebx
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x778], eax
jmp 0x10009070
push ebx
push edx
add esp, 4
jmp 0x10009014
or ebx, 0x1278a
pop ebx
push edx
xor edx, 0xf944
or edx, 0x55c
call 0x10009036
add byte [eax + 0x4e], dl
dec ebp
dec esp
inc esi
dec ebp
inc ebp
xor al, 0x83
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x514]
mov edx, dword [ecx]
mov dword [ebp - 0x514], edx
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0xce4]
je 0x10009066
mov ecx, dword [ebp - 0x514]
cmp dword [ecx + 0x30], 0
jne 0x10008e31
mov dword [ebp - 0x778], 0
Function at 0x10009036
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x10008dfd
add byte [eax + 0x4b], dl
inc ebp
dec edi
xor edi, dword [ecx]
cmp dword [eax - 0x7d], ecx
les eax, [ecx + eax*4]
loope 0x10008da3
dec esp
add dword [eax], eax
xor ecx, 0x17512
jne 0x10008e0c
invalid
pop ecx
cmp dword [ebp - 0xce4], 0
jne 0x10008e25
mov dword [ebp - 0x778], 0
jmp 0x10009070
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0x514], eax
push edx
call 0x10008e3f
add byte [edx + 0x36], cl
dec esp
aas
dec ebx
aaa
add esp, 4
sub edx, 0xa59
or edx, 0x83d
add edx, 0x4c71
pop edx
push eax
and eax, 0x151d9
xor eax, 0x5de
pop eax
lea ecx, [ebp - 0x17ac]
mov dword [ebp - 0xce0], ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcdc], eax
xor ecx, ecx
mov word [ebp - 0x23c], cx
xor edx, edx
mov word [ebp - 0x50], dx
push edx
push ecx
add esp, 4
add edx, 0x3ab3
xor edx, 0x13115
and edx, 0x5eaa
xor edx, 0x692a
pop edx
push esi
or esi, 0xd359
xor esi, 0xe527
or esi, 0xef74
pop esi
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1056], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1056]
mov word [ebp - 0x23c], ax
mov ecx, dword [ebp - 0xce0]
mov dx, word [ecx]
mov word [ebp - 0x1058], dx
mov eax, dword [ebp - 0xce0]
add eax, 2
mov dword [ebp - 0xce0], eax
mov cx, word [ebp - 0x1058]
mov word [ebp - 0x50], cx
push esi
push esi
add esp, 4
add esi, 0x53d3
or esi, 0x15c57
or esi, 0x2e79
pop esi
push esi
push esi
add esp, 4
sub esi, 0xbf03
or esi, 0xcf10
jmp 0x10008f47
pop esi
movzx edx, word [ebp - 0x50]
push ebp
mov al, 0x85
sal byte [ebp + 0x15], cl
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
sub eax, ecx
mov dword [ebp - 0x1638], eax
jmp 0x10008fbf
movzx edx, word [ebp - 0x23c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x10008e8d
movzx ecx, word [ebp - 0x23c]
xor ecx, 0x20
movzx edx, word [ebp - 0x50]
cmp ecx, edx
je 0x10008e8d
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
cmp eax, ecx
jge 0x10008fa9
mov dword [ebp - 0x1634], 0xffffffff
jmp 0x10008fb3
mov dword [ebp - 0x1634], 1
mov edx, dword [ebp - 0x1634]
mov dword [ebp - 0x1638], edx
cmp dword [ebp - 0x1638], 0
jne 0x10009008
push ecx
push edx
add esp, 4
add ecx, 0x140cc
and ecx, 0x4bda
xor ecx, 0x6058
jmp 0x10008fe8
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x7a7
jmp 0x10008ff9
pop ebx
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x778], eax
jmp 0x10009070
push ebx
push edx
add esp, 4
jmp 0x10009014
or ebx, 0x1278a
pop ebx
push edx
xor edx, 0xf944
or edx, 0x55c
call 0x10009036
add byte [eax + 0x4e], dl
dec ebp
dec esp
inc esi
dec ebp
inc ebp
xor al, 0x83
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x514]
mov edx, dword [ecx]
mov dword [ebp - 0x514], edx
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0xce4]
je 0x10009066
mov ecx, dword [ebp - 0x514]
cmp dword [ecx + 0x30], 0
jne 0x10008e31
mov dword [ebp - 0x778], 0
Function at 0x1006a08a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e9c50
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10002124
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.10002327
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
call fcn.1006a018
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 6
call fcn.10002124
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 7
call fcn.10002124
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1006e13d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e9eff
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
xor edi, edi
mov dword [esi + 4], 0x100eef50
mov dword [esi + 8], 0x100ec3a0
mov dword [esi + 0xc], edi
mov dword [esi], 0x100f51e0
mov dword [esi + 4], 0x100f5214
mov dword [esi + 8], 0x100f5230
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x417ae0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
call fcn.00417a10
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetCurrentPackageId
push esi
call ebx
test edi, edi
mov dword [0x4c57c4], eax
je 0x417b4f
push str.GetSystemTimePreciseAsFileTime
push esi
call ebx
mov ecx, dword [0x4c5aec]
push 0x4c57d8
push ecx
mov dword [0x4c4fbc], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push str.GetTempPath2W
push esi
call ebx
mov dword [0x4c4fb8], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4a09a5
Capabilities:
Encode data using xor

Disassembly:
pushfd
add eax, 0xeb8236a
mov ebx, 0x4c0c0a3c
sbb edi, edi
or esi, esi
lds edi, [ebx + 0x42]
add byte [ebx + 0x1d64adbd], dh
sbb eax, 0x9c4297d2
xlatb
invalid
sub al, 0xa6
mov esi, 0xbf5b7875
jmp 0x4a0946
call 0x66d47adf
jae 0x4a09bb
jnp 0x4a09e0
idiv byte [edi]
push ss
movsb byte es:[edi], byte fs:[esi]
ret
inc ebp
and byte [edi - 0x4523b522], cl
not byte [ecx + 0x79]
sub dl, byte [ebx - 3]
insd dword es:[edi], dx
pop ecx
loopne 0x4a09d1
jbe 0x4a097e
invalid
daa
xlatb
arpl word [edx + 0x57], si
jb 0x4a0a14
clc
out 0x96, al
sbb byte [ecx - 0x63aa7592], dl
retf 0x504d
movsb byte es:[edi], byte [esi]
xchg ah, dh
cmc
in eax, dx
push 0xffffffffffffffed
add ebp, dword [ebp + 1]
xor dl, byte [ebx - 0x7f]
adc esi, edx
sbb ebp, dword [eax - 0x43]
sahf
adc al, 0xa5
jl 0x4a09d6
lodsw ax, word [esi]
cmp eax, 0xfcacfc73
push ebx
inc esi
sub al, 0x60
int1
sbb ebx, edx
adc al, 0xcb
bound edi, qword [ecx + 0x31]
mov bh, 0x4e
push ebx
fldcw word [ebp + 0x57]
fist word [edi]
xchg edi, eax
jnp 0x4a0988
cwde
jl 0x4a09b7
invalid
adc edx, dword [edx]
salc
movsb byte es:[edi], byte [esi]
fidiv dword [ebx - 0x416cf4a9]
out dx, al
cmp byte cs:[eax], 0x53
invalid
Function at 0x4b971d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4b973f
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4b9730
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4b986d
mov eax, dword [0x4c6d2c]
cmp eax, 1
je 0x4b9847
test eax, eax
jne 0x4b9770
cmp dword [0x4c22b8], 1
je 0x4b9847
cmp edx, 0xfc
je 0x4b986d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b97a7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004ba100
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba590
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b97ea
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba590
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bea54
push edi
call fcn.004bc460
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004ba100
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004ba110
lea eax, [ebp - 0xa0]
push 0x4bea34
push eax
call fcn.004ba110
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004ba110
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc3d4
add esp, 0x2c
pop edi
jmp 0x4b986d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004ba590
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10048740
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004a36b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1006b850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
call fcn.10047940
lea ecx, [edi + 0x18]
call fcn.10045440
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 4], 0
mov eax, dword [edi + 8]
shl eax, 3
push eax
mov dword [ebp - 4], 0
call fcn.10047960
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x30], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10049930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, 1
or eax, 0xffffffff
mov cl, byte [esi]
shl edi, cl
dec edi
cmp dword [esi + 4], edx
jle 0x1004996f
push ebx
mov ebx, dword [ebp + 8]
nop
movsx ecx, byte [edx + ebx]
inc edx
xor ecx, eax
sar eax, 8
and ecx, 0xff
and eax, 0xffffff
xor eax, dword [esi + ecx*4 + 0x20]
cmp edx, dword [esi + 4]
jl 0x10049950
pop ebx
not eax
and eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x401472
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edi, dword [0x402050]
cdq
or di, 1
idiv edi
mov edx, dword [0x402050]
mov ebx, esi
add edx, eax
mov eax, 0x402054
call fcn.004013a5
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x401e78
push eax
sub edi, fcn.00401643
push edi
push fcn.00401643
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401065
mov eax, fcn.00401643
mov ebx, esi
mov edx, edi
call fcn.004013a5
mov edx, 0x1b400
mov eax, 0x402054
mov ebx, esi
call fcn.00401280
jmp 0x401065

Function at 0x401583
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x144, 0
mov dword [ebp - 0x24], 6
xor eax, eax
push 0x7f00
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], eax
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.DLL_LoadIconA]
push 0x7f00
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.DLL_LoadCursorA]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.DLL_RegisterClassW]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x144], 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
lea ebx, [eax - 0x47]
call dword [sym.imp.OLE32.DLL_CoUninitialize]
mov eax, dword [ebp - 4]
add eax, ebx
leave
pop edx
pop ecx
pop ebx
ret
Function at 0x1075b478
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1075b5c8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1075b49e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1075b48a
add dl, dl
jne 0x1075b4a9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1075b4fc
xor eax, eax
add dl, dl
jne 0x1075b4b6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1075b59d
add dl, dl
jne 0x1075b4c5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075b4d0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075b4db
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075b4e6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1075b4f2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1075b495
mov eax, 1
add dl, dl
jne 0x1075b50a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075b515
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1075b501
sub eax, ebx
mov ebx, 1
jne 0x1075b548
mov ecx, 1
add dl, dl
jne 0x1075b52e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1075b539
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1075b525
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1075b495
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1075b55f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1075b56a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1075b556
cmp eax, 0x7d00
jae 0x1075b58d
cmp eax, 0x500
jb 0x1075b588
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1075b495
cmp eax, 0x7f
ja 0x1075b590
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1075b495
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1075b5be
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1075b495
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x408770
Capabilities:
Encode data using xor

Disassembly:
inc cx
movq mm4, mm5
inc cx
movq mm0, mm4
pshufb xmm4, xmm2
pshufb xmm0, xmm3
pshufb mm0, mm3
pshufb mm0, mm3
pxor xmm4, xmm5
inc cx
movq mm5, mm7
pxor xmm0, xmm4
inc bx
movq mm1, qword [ebx + edx - 0x40]
pshufb xmm5, xmm2
inc bx
movq mm4, qword [ebx + edx]
inc cx
movq mm2, mm6
pshufb xmm2, xmm3
movdqa xmm3, xmm0
pxor xmm2, xmm5
pshufb xmm0, xmm1
dec ecx
add ecx, 0x10
pxor xmm0, xmm2
pshufb xmm3, xmm4
dec ecx
add ebx, 0x10
pxor xmm3, xmm0
pshufb xmm0, xmm1
dec ecx
and ebx, 0x30
dec eax
sub eax, 1
pxor xmm0, xmm3
inc cx
movq mm1, mm1
inc cx
movq mm5, mm3
pandn xmm1, xmm0
psrld xmm1, 4
inc cx
pand mm0, mm1
pshufb xmm5, xmm0
inc cx
movq mm3, mm2
pxor xmm0, xmm1
pshufb xmm3, xmm1
inc cx
movq mm4, mm2
pxor xmm3, xmm5
pshufb xmm4, xmm0
inc cx
movq mm2, mm2
pxor xmm4, xmm5
pshufb xmm2, xmm3
inc cx
movq mm3, mm2
pxor xmm2, xmm0
pshufb xmm3, xmm4
inc ecx
movq mm5, qword [ecx]
pxor xmm3, xmm1
jne 0x408760
inc cx
movq mm4, qword [edx - 0x60]
inc cx
movq mm0, qword [edx - 0x50]
pshufb xmm4, xmm2
pxor xmm4, xmm5
pshufb xmm0, xmm3
inc bx
movq mm1, qword [ebx + edx + 0x40]
pxor xmm0, xmm4
pshufb xmm0, xmm1
repz ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219