joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000eb30
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x104
push ebx
xor ebx, ebx
sub eax, ebx
je 0x1000ebc0
dec eax
jne 0x1000ec2a
mov eax, dword [esp + 0x10c]
push 0x104
push 0x10022da4
push eax
mov byte [0x10022fc0], bl
mov dword [0x10023300], ebx
mov dword [0x100230d8], eax
mov byte [0x100231e4], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push 0x10021d48
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._bjlog
push 0x10021d48
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1002245c], eax
mov eax, dword [0x100230d8]
mov dword [0x10022470], eax
call fcn.100077e0
mov eax, 1
pop ebx
add esp, 0x104
ret 0xc
mov eax, dword [0x10023300]
cmp eax, ebx
je 0x1000ec2a
push ebx
push eax
call dword [0x10022498]
test eax, eax
jne 0x1000ec1d
cmp byte [0x10022fc0], bl
je 0x1000ec1d
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], bl
push 0x10022fc0
rep stosd dword es:[edi], eax
mov ecx, dword [str.SYSTEMCurrentControlSetServices_s]
lea edx, [esp + 0xc]
stosw word es:[edi], ax
push ecx
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 8]
push eax
push SysStringLen
call dword [0x100224a0]
pop edi
mov ecx, dword [0x10023300]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebx
add esp, 0x104
ret 0xc

Function at 0x1000f370
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
push ebp
push esi
push edi
mov esi, ecx
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x14], esi
call fcn.1000f600
mov ebp, dword [esp + 0x20]
add esp, 8
xor edi, edi
test ebp, ebp
jbe 0x1000f3e1
push ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [edi + ebx]
push eax
push 0
push 0x1f0fff
call dword [0x10022504]
mov esi, eax
test esi, esi
je 0x1000f3bc
push 0
push esi
call dword [0x100225e8]
test eax, eax
jne 0x1000f3ca
mov ecx, dword [edi + ebx]
push 0
push ecx
call fcn.100041d0
add esp, 8
test esi, esi
je 0x1000f3d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 4
cmp edi, ebp
jb 0x1000f398
mov esi, dword [esp + 0x10]
pop ebx
push 0
push str.SeDebugPrivilege
call fcn.1000f600
add esp, 8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.1000f1d0
mov ecx, esi
call fcn.1000f210
pop edi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x1000fec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
mov eax, dword [0x1002339c]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x10], edi
je 0x1000ff0a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100233a0]
cmp eax, 0x493e0
jae 0x1000ff0a
push 0x10023338
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000ff0a
mov eax, dword [0x1002339c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [0x10023334]
mov ebp, 0xa
cmp eax, ebp
jae 0x1000ff65
mov esi, dword [0x10021884]
push ebx
call esi
cmp eax, edi
je 0x1000ff34
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebp
mov ecx, dword [eax]
pop ebx
mov eax, dword [ecx]
add esp, 8
ret
push str.www.baidu.com
call esi
test eax, eax
jne 0x1001002f
push str.www.163.com
call esi
test eax, eax
jne 0x1001002f
mov eax, dword [0x10023334]
inc eax
cmp eax, ebp
mov dword [0x10023334], eax
jb 0x10010023
push str.dnSaPI.dlL
call dword [0x10022778]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.DnsQuery_A
push esi
call edi
push str.DnsRecordListFree
push esi
mov ebp, eax
call edi
push 0x28
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [0x100218b8]
add esp, 4
mov esi, eax
push str.202.102.152.3
mov dword [esi], 5
call edi
push str.202.96.102.3
mov dword [esi + 4], eax
call edi
push str.202.99.160.68
mov dword [esi + 8], eax
call edi
push str.202.101.224.68
mov dword [esi + 0xc], eax
call edi
push str.202.96.75.68
mov dword [esi + 0x10], eax
call edi
lea edx, [esp + 0x1c]
push 0
push edx
push esi
push 8
push 1
push ebx
mov dword [esi + 0x14], eax
call ebp
test eax, eax
jne 0x1001001a
mov eax, dword [esp + 0x1c]
push 1
push eax
mov edi, dword [eax + 0x18]
mov dword [esp + 0x18], edi
call dword [esp + 0x1c]
push ebx
push 0x10023338
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x1002339c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100233a0], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
mov dword [0x10023334], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x401f80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
nop
lea eax, [ebp - 0x18]
push eax
call fcn.00402211
add esp, 4
mov eax, 2
push eax
call sub.msvcrt.dll___set_app_type
add esp, 4
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x402080
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
jne 0x401fe9
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x401fcb
mov eax, dword [ebp - 0x1c]
mov ecx, 0x22
movsx edx, byte [eax]
cmp ecx, edx
jne 0x402036
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
movsx ecx, byte [eax]
test ecx, ecx
je 0x402031
mov eax, dword [ebp - 0x1c]
mov ecx, 0x22
movsx edx, byte [eax]
cmp ecx, edx
jne 0x40202f
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x402031
jmp 0x401ffc
jmp 0x402062
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x402062
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
je 0x402062
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x402036
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
jne 0x402080
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x402062
lea eax, [ebp - 0x60]
push eax
call sub.kernel32.dll_GetStartupInfoA
movzx eax, word [ebp - 0x30]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x34]
and eax, 1
mov ecx, 0
cmp ecx, eax
jne 0x4020ab
mov eax, 0xa
mov dword [ebp - 0x64], eax
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.00401c2c
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
push eax
call sub.msvcrt.dll_exit
add esp, 4
leave
ret
Function at 0x1d95058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01d951a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1d9507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1d9506a
add dl, dl
jne 0x1d95089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1d950dc
xor eax, eax
add dl, dl
jne 0x1d95096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1d9517d
add dl, dl
jne 0x1d950a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d950b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d950bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d950c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1d950d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1d95075
mov eax, 1
add dl, dl
jne 0x1d950ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d950f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1d950e1
sub eax, ebx
mov ebx, 1
jne 0x1d95128
mov ecx, 1
add dl, dl
jne 0x1d9510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1d95119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1d95105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d95075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1d9513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1d9514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1d95136
cmp eax, 0x7d00
jae 0x1d9516d
cmp eax, 0x500
jb 0x1d95168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d95075
cmp eax, 0x7f
ja 0x1d95170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d95075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1d9519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1d95075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41d1a0
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x41e850
call fcn.0041def8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x41f550
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x41cfc8
cmp eax, esi
jne 0x41cfbb
xor esi, esi
inc esi
mov edi, esi
jmp 0x41cfcb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41cf9f
xor esi, esi
inc esi
cmp dword [0x41f554], esi
jne 0x41cfdd
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x41d017
cmp dword [0x41f554], ebx
jne 0x41d011
mov dword [0x41f554], esi
push 0x402848
push 0x40283c
call fcn.004b0000
pop ecx
pop ecx
test eax, eax
je 0x41d017
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41d0ec
mov dword [0x41f114], esi
cmp dword [0x41f554], esi
jne 0x41d03a
push 0x402838
push 0x4027dc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x41f554], 2
test edi, edi
jne 0x41d047
xor eax, eax
mov ecx, 0x41f550
xchg dword [ecx], eax
cmp dword [0x41f564], 0
je 0x41d073
push 0x41f564
call fcn.0041dd50
pop ecx
test eax, eax
je 0x41d073
push ebx
push 2
push ebx
mov esi, dword [0x41f564]
mov ecx, esi
call dword [0x420210]
call esi
push dword [0x41f120]
push dword [0x41f11c]
push dword [0x41f118]
call fcn.0040c7c4
add esp, 0xc
mov dword [0x41f110], eax
cmp dword [0x41f128], 0
jne 0x41d0d1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x41f114], 0
jne 0x41d0e5
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x41f110]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.0041de45
jmp 0x41cf83

Function at 0x41dc34
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x41e948
call fcn.0041def8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41dc94
cmp eax, 0xffffffff
je 0x41dc94
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41dc8d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41dc8d
cmp edx, 0x10000000
jae 0x41dc8d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41dc8a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41dd00
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41dd3e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x41dd36
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x41dd40
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x41dd26
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10002f02
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x10002f49
cmp ebx, 0x20
je 0x10002f49
cmp ebx, 0xffffffe0
je 0x10002f49
jne 0x10002f52
add eax, 1
cmp esi, eax
je 0x10002f5f
jne 0x10002f2e
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x10002f63
jne 0x10002f2a
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x10002f77
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x10002fbc
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x10002fc2
add eax, 4
pop esi
dec esi
push esi
jne 0x10002fa4
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8

Function at 0x10003010
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x18
push 0x40
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100030db
push dword [ebp + 8]
push 0
push dword [ebp - 4]
call fcn.1000290b
push dword [ebp + 0xc]
push 4
push dword [ebp - 4]
call fcn.1000290b
push dword [ebp + 0x14]
push 8
push dword [ebp - 4]
call fcn.1000290b
push dword [ebp + 0x1c]
push 0xc
push dword [ebp - 4]
call fcn.1000290b
push dword [ebp + 0x24]
push 0x10
push dword [ebp - 4]
call fcn.1000290b
push dword [ebp + 0x2c]
push 0x14
push dword [ebp - 4]
call fcn.1000290b
push dword [ebp + 0x34]
call fcn.100030e9
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 4]
push 0x1000328a
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x100030e3
mov esp, ebp
pop ebp
ret 0x34
Function at 0x10004a87
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x18
call fcn.1000c083
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
add ebx, 0x14
push ebx
push 0x208
call fcn.1000c083
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x100183b3
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x94
mov eax, dword [ebp - 4]
push eax
push 0x214
call fcn.1000c083
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x80
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop ebx
add ebx, 4
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
nop
nop
push eax
mov ebx, dword [ebp - 8]
push ebx
mov edi, dword [ebp - 0xc]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.1000c08f
add esp, 4
pop eax
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
cmp dword [ebx], 6
jl 0x10004bb8
mov eax, 1
jmp 0x10004bc2
mov eax, 0
jmp 0x10004bc2
push eax
mov ebx, dword [ebp - 4]
push ebx
add ebx, 0x14
push ebx
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x10004be8
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x10004be4
imul eax, dword [ebx]
jmp 0x10004bd9
mov ecx, eax
test ecx, ecx
je 0x10004c07
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x10004c00
push ebx
push eax
call fcn.1000c08f
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x10004bee
call fcn.1000c08f
add esp, 4
pop ebx
call fcn.1000c08f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1000d730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x1000d751
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x1000d7ab
inc edi
cmp edi, esi
jl 0x1000d745
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x1000d7e0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x1000d79a
cmp byte [eax], bl
je 0x1000d7b5
cmp byte [eax + 1], bl
je 0x1000d7be
cmp byte [eax + 2], bl
je 0x1000d7c8
cmp byte [eax + 3], bl
je 0x1000d7d4
add eax, 4
cmp eax, edi
jb 0x1000d771
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x92a0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x92a200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x92a0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92a0c2
add dl, dl
jne 0x92a0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92a134
xor eax, eax
add dl, dl
jne 0x92a0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92a1d5
add dl, dl
jne 0x92a0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92a108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92a113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92a11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x92a12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x92a0cd
mov eax, 1
add dl, dl
jne 0x92a142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92a14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x92a139
sub eax, ebx
mov ebx, 1
jne 0x92a180
mov ecx, 1
add dl, dl
jne 0x92a166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92a171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x92a15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x92a0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x92a197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92a1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x92a18e
cmp eax, 0x7d00
jae 0x92a1c5
cmp eax, 0x500
jb 0x92a1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x92a0cd
cmp eax, 0x7f
ja 0x92a1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x92a0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x92a1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x92a0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401b75
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp + 0xc], ebx
jmp 0x401b80
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x401b98
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x401bb6
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x401c14
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401bfb
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x401c04
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401c0e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x401bf0
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x401b7a
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x401d21
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004014d1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401486
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
add al, 0
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
invalid
movsd dword es:[edi], dword [esi]

Function at 0x401d8d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004014d1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401486
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
add al, 0
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
invalid
movsd dword es:[edi], dword [esi]