joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036b72
Capabilities:
Check for trap flag exception

Disassembly:
jmp 0x1001b97f
pushfd
or dword [esp], reloc.KERNEL32.dll_GetCurrentProcess
popfd
rdtsc
nop
jmp 0x1001b996
ret
jmp 0x1001b974

Function at 0x10036f28
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x1001b183
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x1001b19d
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1001b18c
pop esi
jmp 0x1001b1a8
ret 4
jmp 0x10036f61
jmp 0x1001b176

Function at 0x1008efb5
Capabilities:
Check http status code

Disassembly:
mov byte [esp + 2], al
bsf cx, cx
mov dword [esp], ebx
lea esp, [esp + 4]
and dword [esp + 0x14], esi
jmp 0x1001d764
jmp 0x1008ef70

Function at 0x100d01a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 5], bl
sub esp, 0xe
bswap ebx
mov byte [esp + 0x10], bl
add dx, dx
jmp 0x100cffc8
mov esi, esp
xchg word [esp + 0xd], si
rdtsc
rdtsc
not ebx
pop bp
jmp 0x100cff7d
xchg bh, bl
sete cl
push dword [esp + 2]
call fcn.100cffd7
pop dword [esp]
xor esi, eax
pop ebp
call fcn.100d0105
stosd dword es:[edi], eax
sub edi, dword [ebx - reloc.KERNEL32.dll_GetCurrentProcess]
pop ecx
mov eax, 0x310ff29b
rdtsc
rdtsc
xor ah, dh
add esp, 0x15
sub esp, 3
xchg ebp, eax
jmp 0x100cffa4
xchg dword [esp + 8], ebx
pop word [esp + 0xf]
mov cx, 0xdeb2
mov ebx, dword [esp + 1]
cmc
lea esi, [edi*4]
jmp 0x100cff93
jmp 0x100cfff6

Function at 0x100d0481
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, ebp
pop si
neg bp
add esp, 0xc
not si
jmp 0x100d04ba
not cl
lea edx, [edi*4]
xchg ch, cl
rdtsc
jmp 0x100d04f1
clc
btc bx, bx
mov bl, byte [esp + 5]
rdtsc
pop dword [esp]
pop ebp
jmp 0x100d04a4
mov ebx, 0xf6945777
btc si, ax
rol bp, cl
bsf cx, sp
mov ecx, 0x422ce666
bts di, dx
jmp 0x100d053a
clc
lea edi, [edx + ebp]
cpuid
mov eax, ebx
lea ebx, [esp + edx]
xchg dl, al
jmp 0x100d065b
lea ecx, [edi + edi]
mov cl, byte [esp]
mov dx, word [esp]
seto al
rcl cx, cl
cpuid
jmp 0x100d0524
neg esi
lea eax, [esi*4]
lea ebx, reloc.KERNEL32.dll_GetCurrentProcess
mov di, word [esp]
bswap esi
mov ah, 0xa
xchg edx, eax
mov eax, dword [esp]
lea ebx, [esi*4]
xchg dh, dl
jmp 0x100d05d5
Function at 0x100d079c
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov word [esp + 0xd], di
jmp 0x100d0ee8
xchg dword [esp + 5], edx
mov ch, byte [esp + 8]
pop word [esp + 8]
neg bp
adc bx, bx
jmp 0x100d082d
pop bx
pop dword [esp + 3]
mov esi, 0xe373f976
dec dh
xchg bl, cl
bsr edi, esp
jmp 0x100d07e9
pop bx
mov byte [esp + 0xa], cl
mov cx, word [esp + 5]
shl ah, cl
jmp 0x100d0840
push word [esp + 8]
bsr di, bx
mov ax, sp
not ah
mov cl, 0x2f
clc
jmp 0x100d0817
mov ax, 0x3e10
pop dword [esp + 3]
bts ax, bp
pop esi
mov bh, byte [esp + 1]
jmp 0x100d08ce
pop word [esp]
mov ah, al
std
xchg word [esp], bx
xchg esi, edi
sub esp, 0x12
jmp 0x100d0803
mov dh, bl
pop ebp
mov edx, dword [esp]
lea ebx, [ebx + edi]
lea eax, [eax + ebx]
cpuid
call fcn.100d0895
dec bp
cpuid
push dword [esp + 0x12]
mov di, 0xa260
neg ebx
mov ebp, ebx
jmp 0x100d094e
mov bp, 0xe4b6
mov dword [esp + 7], eax
adc bp, bx
sub esp, 1
jmp 0x100d09e0
mov dword [esp + 0x1e], esi
add esp, 0x24
pop cx
mov ebx, dword [esp + 0xf]
std
setns cl
jmp 0x100d0938
neg bh
push word [esp + 1]
mov dword [esp], esp
mov ebx, 0x548aac84
mov byte [esp + 2], dh
mov ch, 0x7b
jmp 0x100d0857
rcl cl, 6
lea edi, [edx + edi]
mov dx, 0xc9d7
lea esp, [esp + 2]
jmp 0x100d09c6
lea esi, reloc.KERNEL32.dll_GetCurrentProcess
mov edi, dword [esp + 5]
mov bp, 0xdac
push esp
mov bl, 0xff
seto dh
jmp 0x100d0984
lea esi, [ebx*4]
neg bh
xchg dh, cl
shr di, 0xf
jmp 0x100d0ab5
mov word [esp + 0xd], sp
pop dword [esp + 3]
xchg esi, ecx
xchg ecx, eax
push dword [esp + 0xb]
jmp 0x100d09b0
not bx
xchg dword [esp + 0xc], ebx
xchg word [esp + 5], ax
mov ebx, esp
setbe dl
pop dword [esp + 6]
jmp 0x100d099a
dec bp
lea esi, reloc.KERNEL32.dll_GetCurrentProcess
neg ebp
add esp, 2
mov esi, 0x274109c0
inc ah
jmp 0x100d0a73
btc edx, ecx
lea esp, [esp + 0xf]
xchg bx, bp
cpuid
inc dx
bt di, bp
jmp 0x100d09f7
std
call 0x100d0a47
mov bh, byte [esp + 0xd]
pop cx
mov ebx, dword [esp]
push dword [esp + 5]
mov ecx, dword [esp + 1]
lea eax, [edi*4]
jmp 0x100d0a1d
pop ebx
mov di, word [esp]
add si, 0xf2d3
ror di, cl
push di
dec bl
jmp 0x100d096a
mov cx, word [esp + 3]
lea esp, [esp + 4]
cpuid
lea ebx, reloc.KERNEL32.dll_GetCurrentProcess
mov edx, 0x4df67762
lea ebx, reloc.KERNEL32.dll_GetCurrentProcess
jmp 0x100d0b59
pop dx
mov bh, 0xe4
add esp, 6
add esp, 8
mov ah, bl
std
jmp 0x100d0c12
mov bx, word [esp + 9]
mov edi, 0xef40ef12
rdtsc
push word [esp + 0xe]
rdtsc
neg edi
jmp 0x100d0c42
Function at 0x100d0a79
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x100d0afd
xchg edx, esi
push word [esp + 0x19]
bsf di, bp
mov eax, dword [esp + 1]
mov bh, byte [esp + 0x25]
bswap eax
jmp 0x100d0b25
mov dword [esp + 5], esp
pushal
mov cl, byte [esp + 0xe]
pop edi
xchg bx, di
not ax
jmp 0x100d0ad2
push word [esp + 3]
pop si
rdtsc
or edi, 0x76793e7e
jmp 0x100d0b3a
mov dx, word [esp + 0x21]
popal
mov byte [esp], bh
mov dl, byte [esp + 6]
pop bx
xchg word [esp], ax
jmp 0x100d0b0f
pop word [esp + 1]
btr dx, bp
mov bp, word [esp]
sub esp, 0x1b
xchg word [esp + 0x1c], ax
xchg byte [esp + 0x12], bl
jmp 0x100d0ba3
xchg dword [esp + 0x12], eax
mov eax, ecx
mov word [esp + 0x11], bp
neg cl
jmp 0x100d0bca
xchg bp, cx
mov bl, ah
mov ch, byte [esp + 0xb]
mov word [esp + 0x11], bx
pop dword [esp + 1]
btr dx, bx
jmp 0x100d0b6f
neg ecx
mov dl, 0xa7
push dword [esp + 0x1a]
mov esi, edx
btc ebp, esi
bswap esi
jmp 0x100d0b85
add esp, 3
cmc
neg di
setns dl
xchg word [esp + 3], bx
jmp 0x100d0bf3
pop word [esp]
btr di, bp
not bx
xchg ecx, edi
cmc
btr edx, eax
jmp 0x100d0bb4
xchg byte [esp + 0xd], al
mov dword [esp + 1], eax
xchg bp, ax
mov cl, byte [esp + 0xd]
pop edx
jmp 0x100d0d68
neg di
cpuid
add esp, 9
clc
mov bh, 0x18
rdtsc
jmp 0x100d0bdd
lea esp, [esp]
sub esp, 0x1e
mov ebp, edi
xchg word [esp + 0x16], ax
call fcn.100d0c92
in eax, 0x14
xchg dword [esi], ebp
bswap esi
xchg byte [esp + 1], dh
pop bp
dec ecx
lea ecx, [ecx*4]
mov ebp, dword [esp]
jmp 0x100d0c51
rdtsc
mov si, bx
clc
mov byte [esp + 3], ah
mov ebp, 0xe9ebb17e
lea esp, [esp + 0xa]
jmp 0x100d0c67

Function at 0x100d0f6d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov byte [esp + 1], bh
mov dword [esp], ebp
jmp 0x100d0f26
push bp
call 0x100d0f68
sbb eax, 0x9d6e0b9b
popfd
dec edi
jne 0x100d0f31
xchg edx, eax
cmc
add al, 0xeb
inc ebp
leave
pop ecx
cmp bl, cl
daa
call 0xfe2fa4f
je 0x100d0f6a
add esp, dword [eax - 0x73]
and al, 2
mov dword [esp + 0x28], esi
call 0x100d0f6d
scasd eax, dword es:[edi]
and byte [esi - 0x2c3ddf2f], dh
pop ebp
int 0x94
mov fs, word [bp + di]
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x55
aas
call 0x100d0f43
push dword [esp]
jmp 0x100d0f76
lea esp, [esp + 1]
push dword [esp + 6]
lea esp, [esp + 2]
lea esp, [esp + 1]
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0x100d0fbd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x100d0f9f
Function at 0x100012b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006d57
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x1000a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x414], edi
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x420], 0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], 0
push ecx
push 0xf003f
push 0
push eax
push 0x80000001
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x414], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001390
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
mov ecx, edi
call fcn.10005740
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005f62
mov esp, ebp
pop ebp
ret
Function at 0x10001c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, edx
mov byte [ebp - 0x10], 0x74
mov al, 1
xor al, byte [ebp - 0x10]
mov cl, 7
xor cl, byte [ebp - 0x10]
mov ah, 6
mov byte [ebp - 0xf], al
mov ch, 0x47
mov byte [ebp - 0xe], cl
mov bl, 0x11
mov cl, byte [ebp - 0x10]
mov bh, 0x46
mov byte [ebp - 1], 0x18
xor ah, cl
mov al, byte [ebp - 1]
xor bl, cl
xor al, cl
mov byte [ebp - 2], 0x18
mov byte [ebp - 7], al
xor ch, cl
mov al, byte [ebp - 2]
xor bh, cl
mov byte [ebp - 0xc], ah
xor al, cl
mov byte [ebp - 5], 0
mov dl, 0x5a
mov byte [ebp - 6], al
mov dh, 0x10
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0xf]
mov byte [ebp - 0xb], ch
xor dl, cl
mov byte [ebp - 0xa], bh
xor dh, cl
mov byte [ebp - 9], dl
push eax
mov byte [ebp - 8], dh
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x10001d2e
movaps xmm0, xmmword [0x100080f0]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x6f5a5b41
mov byte [ebp - 0x14], 0
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x13
jb 0x10001ce4
lea eax, [ebp - 0x27]
mov byte [ebp - 0x14], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
call fcn.10001200
push 0
push 0xc8
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call esi
test eax, eax
je 0x10001d2e
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10002470
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x1000a040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x138], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x100024e4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
push dword [ebp - 0x138]
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
je 0x10002500
lea eax, [ebp - 0x134]
push eax
push esi
call ebx
test eax, eax
jne 0x100024c3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10005f62
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x12c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10005f62
mov esp, ebp
pop ebp
ret 4
Function at 0x10002520
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006ead
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
mov eax, dword [0x1000a040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.10006092
xorps xmm0, xmm0
mov dword [ebp - 0x30], eax
add esp, 4
mov dword [eax], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call fcn.10001740
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100025c2
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x100025f8
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100025ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100025ee
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100063dc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10005f62
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x468760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5d000]
push edi
or ebp, 0xffffffff
jmp 0x468782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x468789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x468778
mov eax, 1
add ebx, ebx
jne 0x46879b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4687ac
jne 0x4687cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4687cb
dec eax
add ebx, ebx
jne 0x4687b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x468790
add ebx, ebx
jne 0x4687c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x46881d
xor ecx, ecx
sub eax, 3
jb 0x4687e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x468852
sar eax, 1
mov ebp, eax
jmp 0x4687ee
add ebx, ebx
jne 0x4687ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4687bc
inc ecx
add ebx, ebx
jne 0x4687fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4687bc
add ebx, ebx
jne 0x468809
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4687fe
jne 0x46881a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4687fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46883c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46882e
jmp 0x46877e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46883c
add edi, ecx
jmp 0x46877e
pop esi
mov edi, esi
mov ecx, 0x5e8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46885a
cmp byte [edi], 1
jne 0x46885a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46885f
lea edi, [esi + 0x66000]
mov eax, dword [edi]
or eax, eax
je 0x4688d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x68968]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x689e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46888c
mov ecx, edi
jns 0x4688bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x689e4]
or eax, eax
je 0x4688d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4688a9
call dword [esi + 0x689e8]
popal
jmp 0x40af0f
Function at 0x401831
Capabilities:
Encode data using xor

Disassembly:
test bh, ch
imul edi, edx, 0x232fe70c
mov ebp, ecx
push edx
mov edi, ebx
imul edx, ebx
mov ah, 0xf7
lea ebx, [0xaf40734f]
xor cl, ah
mov edx, ebp
mov dh, bh
dec edx
adc al, 0x9b
adc ecx, edi
imul edx, eax
or al, 0x25
call 0x401831
js 0x401821
mov ah, dh
imul esi, ecx
jmp 0x401829
mov edx, edx
cmp ecx, 0x4e51
pop ebx
dec dl
add ecx, esi
sbb ecx, 0xabf420f
test esi, esi
jae 0x401843
mov al, 0x67
add ebx, 0x2fb9
jne 0x401857
imul ecx, ecx
mov ecx, 0xf115c51a
movsx ebp, bl
sub ebx, 0x7cf
test dh, bh
imul ecx, ebx, 0xdd2b0961
sub al, 0x89
inc esi
dec esi
or dl, dl
mov dl, 0x2a
test ebp, 0x83d8bbc6
lea eax, [0xf771]
dec cl
xor eax, 0xf67
dec eax
mov dh, dl
imul edx, eax
sbb al, 0x1a
movsx ebp, di
push ebx
xor esi, ecx
push ebx
dec edx
test ecx, eax
add al, dh
imul esi, esi, 0x948945e4
movzx edi, di
and ah, dl
mov al, 0x16
xor ecx, 0xb972
adc esi, ecx
dec esi
sbb eax, 0x125537c2
imul edi, edi, 0
mov ah, 0x68
add eax, 0xc0833c1c
lea eax, [0x29daf024]
add edi, 0x5d8
xor edx, 0xd27b73ed
sub edi, 0x5d7
test cl, bh
imul eax, ecx
mov eax, 0xd4214f70
xor al, cl
mov ch, dl
imul esi, ebx, 0x95fa4edf
cmp ecx, edx
cmp edi, 0x94
jl 0x4018b5
mov eax, 0xb2e49a3b
movzx edi, ch
imul ecx, eax
ret
Function at 0x10646058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106461a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1064607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1064606a
add dl, dl
jne 0x10646089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106460dc
xor eax, eax
add dl, dl
jne 0x10646096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1064617d
add dl, dl
jne 0x106460a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106460b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106460bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106460c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106460d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10646075
mov eax, 1
add dl, dl
jne 0x106460ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106460f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106460e1
sub eax, ebx
mov ebx, 1
jne 0x10646128
mov ecx, 1
add dl, dl
jne 0x1064610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10646119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10646105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10646075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1064613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1064614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10646136
cmp eax, 0x7d00
jae 0x1064616d
cmp eax, 0x500
jb 0x10646168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10646075
cmp eax, 0x7f
ja 0x10646170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10646075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1064619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10646075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x402c00
pop dword [ebp - 0x4c]
mov eax, 0x402c00
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xb04417b6
add dword [ebp - 0x5c], 0x9e0e2d95
mov dword [ebp - 0x58], 0x6d7fa1a8
sub dword [ebp - 0x58], 0x3b4c5563
mov dword [ebp - 0x54], 0x7d6fa99e
sub dword [ebp - 0x54], 0x31236570
mov dword [ebp - 0x50], 0xa7d4bf38
sub dword [ebp - 0x50], 0xa7d4bf38
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x5946d00a
add eax, 0xa6f9b082
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x92ac66df
add dword [ebp - 0x5c], 0xe1c60277
mov dword [ebp - 0x58], 0x1245aced
sub dword [ebp - 0x58], 0xd0d94b78
mov dword [ebp - 0x54], 0xabd2c8f4
add dword [ebp - 0x54], 0xb79ca378
mov dword [ebp - 0x50], 0xe6a8fb5d
sub dword [ebp - 0x50], 0xe6a8fb5d
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3660e
push 0
call eax
mov ecx, 0x46c2
mov esi, eax
mov edi, str.eI_
add edi, dword [ebp - 0x4c]
mov edx, 0x690c445e
xor dword [ebp - 4], 0xd6f49871
mov ebx, dword [edi]
xor dword [ebp - 0x20], ecx
add ebx, edx
xor dword [ebp - 0xc], ebx
mov dword [esi], ebx
add esi, 4
add edi, 0xd13a53a8
sub edi, 0xd13a53a4
loop 0x402d06
add eax, 0xa18878e5
add eax, 0x5e7894f6
xor ebx, ebx
add ebx, eax
add eax, 0x170b2a8d
add eax, 0xe8f4d578
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x413d11
Capabilities:
Enumerate process modules

Disassembly:
push ebp
push ebx
mov edx, 0x10e
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x413d18
call fcn.0042dad0
mov edx, dword [esp + 0x448]
lea ecx, [esp]
call fcn.00418000
mov dword [0x4b4001], 0x4000096
mov dword [0x4b4001], 0x400009a
push dword [esp + 0x444]
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x42c], eax
mov dword [0x4b4001], 0x400009b
cmp dword [esp + 0x42c], 0
je 0x413e95
mov dword [0x4b4001], 0x400009c
lea ebp, [esp + 4]
mov dword [ebp], 0x428
mov dword [0x4b4001], 0x400009d
lea eax, [esp + 4]
push eax
push dword [esp + 0x430]
call sub.KERNEL32.dll_Module32FirstW
mov dword [esp + 0x430], eax
mov dword [0x4b4001], 0x400009e
cmp dword [esp + 0x430], 0
je 0x413e7f
mov dword [0x4b4001], 0x400009f
push edx
call fcn.0042d930
pop edx
push eax
push 1
push 1
push dword [esp + 0xc]
push edx
call fcn.0042d930
pop edx
push eax
push edx
call fcn.0042d930
pop edx
push eax
lea ebp, [esp + 0x1c]
lea eax, [ebp + 0x20]
push eax
call fcn.0042c9e0
call fcn.00418292
add dword [esp], edx
call fcn.0042b9f0
call fcn.004182b0
and eax, eax
je 0x413e44
mov dword [0x4b4001], 0x40000a0
lea ebp, [esp + 4]
push dword [ebp + 0x14]
pop eax
mov dword [esp + 0x434], eax
mov dword [0x4b4001], 0x40000a1
jmp 0x413e7f
mov dword [0x4b4001], 0x40000a2
mov dword [0x4b4001], 0x40000a3
lea eax, [esp + 4]
push eax
push dword [esp + 0x430]
call sub.KERNEL32.dll_Module32NextW
mov dword [esp + 0x430], eax
mov dword [0x4b4001], 0x40000a4
jmp 0x413db4
mov dword [0x4b4001], 0x40000a5
push dword [esp + 0x42c]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b4001], 0x40000a6
mov dword [0x4b4001], 0x40000a8
mov eax, dword [esp + 0x434]
jmp 0x413ebe
push dword [esp]
call fcn.0042db30
add esp, 0x438
pop ebx
pop ebp
ret 8