joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8d00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [esp + 0x24]
push ebx
push ebp
push esi
lea eax, [esp + 0x18]
push edi
push eax
push edx
mov dword [esp + 0x18], ecx
call fcn.004b8de0
mov ebp, dword [esp + 0x1e]
mov al, 9
mov byte [esp + 0x15], al
mov byte [esp + 0x19], al
and ebp, 0xff
xor edx, edx
mov cl, 1
mov eax, 5
and ebp, reloc.WS2_32.dll_closesocket
mov byte [esp + 0x14], cl
mov byte [esp + 0x16], 7
mov byte [esp + 0x17], 8
mov byte [esp + 0x18], dl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], al
jns 0x4b8d5e
dec ebp
or ebp, 0xfffffffc
inc ebp
inc ebp
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], eax
movsx edi, byte [esp + edx + 0x14]
mov eax, dword [esi]
mov ecx, 0x20
sub ecx, edi
mov ebx, eax
shl ebx, cl
mov ecx, edi
add esi, 4
shr eax, cl
add ebx, eax
mov dword [esi - 4], ebx
xor bl, 0x69
mov byte [esi - 4], bl
mov cl, byte [esi - 3]
xor cl, 0x4a
mov byte [esi - 3], cl
mov al, byte [esi - 2]
xor al, 0x87
mov byte [esi - 2], al
mov bl, byte [esi - 1]
lea eax, [edx + 1]
xor bl, 0x3c
cdq
idiv ebp
mov eax, dword [esp + 0x34]
mov byte [esi - 1], bl
dec eax
mov dword [esp + 0x34], eax
jne 0x4b8d67
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00421d70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8

Function at 0x4b8e60
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x100
lea eax, [esp]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x4b8e86
xor eax, eax
add esp, 0x100
ret 4
push ebx
push ebp
push esi
lea ecx, [esp + 0xc]
push edi
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x4b8f3c
mov ebp, dword [sym.imp.WS2_32.dll_inet_ntoa]
xor edi, edi
mov bl, 0x32
mov edx, dword [esi + 0xc]
mov eax, dword [edx + edi]
mov ecx, dword [eax]
push ecx
call ebp
mov cl, byte [eax]
cmp cl, 0x31
je 0x4b8ed6
cmp byte [eax + 1], 0x39
je 0x4b8ec6
cmp byte [eax + 2], bl
jne 0x4b8eed
cmp cl, 0x31
je 0x4b8ed6
cmp byte [eax + 1], 0x37
je 0x4b8ed6
cmp byte [eax + 2], bl
jne 0x4b8eed
mov edx, dword [esi + 0xc]
movsx eax, word [esi + 0xa]
mov ecx, dword [edx + edi]
add ecx, eax
mov eax, dword [esi]
cmp ecx, eax
jae 0x4b8f0e
add edi, 4
jmp 0x4b8ea9
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x4b8f37
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call ebp
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x100
ret 4
Function at 0x4bce80
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4f88eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov al, byte [esp + 2]
push esi
push edi
mov edi, ecx
push 0
lea esi, [edi + 4]
mov ecx, esi
mov dword [esp + 0x14], esi
mov byte [esi], al
call fcn.00411770
mov dl, byte [esp + 0xa]
lea ecx, [esi + 0x10]
push 0
mov dword [esp + 0x20], 0
mov byte [ecx], dl
call fcn.00411770
mov al, byte [esp + 0xa]
lea ecx, [esi + 0x20]
push 0
mov byte [esp + 0x20], 1
mov byte [ecx], al
call fcn.00411770
mov dl, byte [esp + 0xa]
lea ecx, [esi + 0x30]
push 0
mov byte [esp + 0x20], 2
mov byte [ecx], dl
call fcn.00411770
mov al, byte [esp + 0xa]
lea ecx, [esi + 0x40]
push 0
mov byte [esp + 0x20], 3
mov byte [ecx], al
call fcn.00411770
mov dl, byte [esp + 0xa]
lea ecx, [esi + 0x50]
push 0
mov byte [esp + 0x20], 4
mov byte [ecx], dl
call fcn.00411770
lea eax, [esp + 0xa]
lea ecx, [esi + 0x60]
push eax
call fcn.004bc7e0
lea ecx, [esp + 0xb]
push ecx
lea ecx, [esi + 0x70]
call fcn.004bc7e0
lea edx, [esp + 0xc]
lea ecx, [esi + 0x80]
push edx
call fcn.004bc7e0
lea eax, [esp + 0xd]
lea ecx, [esi + 0xa0]
push eax
call fcn.004bc7e0
lea ecx, [esp + 0xe]
push ecx
lea ecx, [esi + 0xb0]
call fcn.004bc7e0
lea edx, [esp + 0xf]
lea ecx, [esi + 0xc0]
push edx
call fcn.004bc7e0
lea ecx, [esi + 0xd0]
mov byte [esp + 0x1c], 0xb
call fcn.004bdb80
mov byte [esp + 0x1c], 0xc
lea ecx, [esi + 0xe8]
call fcn.004bdc00
mov ecx, dword [esp + 0x14]
mov dword [edi], 0x4fc2a0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4c21d0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Get file attributes
Persist via run registry key
Resolve dns
Resolve function by parsing pe exports
Set file attributes

Disassembly:
mov ecx, 0x525740
jmp fcn.00402e40
Function at 0x4c44c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x41c
xor eax, eax
lea edx, [esp + 0xc]
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x104
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x42c]
lea ecx, [esi + 4]
push eax
push ecx
push 0x50de74
push edx
xor ebp, ebp
call fcn.004deb4b
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push 0x20019
push ebp
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c45b7
mov edi, dword [esp + 0x430]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea ecx, [esp + 0x18]
push ebp
push ecx
push ebp
push edi
push edx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call ebx
test eax, eax
jne 0x4c459d
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x4c4555
cmp eax, 2
jne 0x4c459d
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x4c459d
shr eax, 1
shl eax, 1
push eax
call fcn.004de48f
mov ecx, dword [esp + 0x43c]
add esp, 4
mov esi, eax
lea eax, [esp + 0x43c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push ebp
push edi
push eax
call ebx
test eax, eax
jne 0x4c4594
mov ebp, 1
push esi
call fcn.004de3a6
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x41c
ret 0x10
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x41c
ret 0x10

Function at 0x4c45d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x420
push ebx
push esi
mov esi, ecx
push edi
mov ebx, dword [esp + 0x438]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x430]
lea ecx, [esi + 4]
push eax
push ecx
lea edx, [esp + 0x24]
push 0x50de74
push edx
mov dword [esp + 0x1c], ebx
call fcn.004deb4b
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c467b
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x438]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push 0
mov esi, 4
push eax
push ecx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x18], esi
jne 0x4c466c
cmp dword [esp + 0x10], esi
je 0x4c4670
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x420
ret 0xc
Function at 0x4c4690
Capabilities:
Set registry value

Disassembly:
sub esp, 0x414
xor eax, eax
lea edx, [esp + 4]
push esi
mov esi, ecx
push edi
mov ecx, 0x82
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x420]
lea ecx, [esi + 4]
push eax
push ecx
push 0x50de74
push edx
call fcn.004deb4b
add esp, 0x10
mov edx, dword [esi]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x4c471c
mov ecx, dword [esp + 0x424]
mov edx, dword [esp + 8]
lea eax, [esp + 0x428]
push 4
push eax
push 4
push esi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop edi
and eax, 0xff
pop esi
add esp, 0x414
ret 0xc

Function at 0x4c4750
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x414
xor eax, eax
lea edx, [esp + 4]
push esi
mov esi, ecx
push edi
mov ecx, 0x82
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x420]
lea ecx, [esi + 4]
push eax
push ecx
push 0x50de74
push edx
call fcn.004deb4b
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push 0x20006
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4c47c7
mov eax, dword [esp + 0x424]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop edi
and eax, 0xff
pop esi
add esp, 0x414
ret 8

Function at 0x4c47e0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x414
xor eax, eax
lea edx, [esp + 4]
push esi
mov esi, ecx
push edi
mov ecx, 0x82
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x420]
lea ecx, [esi + 4]
push eax
push ecx
push 0x50de74
push edx
call fcn.004deb4b
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push 0x20006
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4c4857
mov eax, dword [esp + 0x424]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop edi
and eax, 0xff
pop esi
add esp, 0x414
ret 8
Function at 0x4c4870
Capabilities:
Set registry value

Disassembly:
sub esp, 0x414
xor eax, eax
lea edx, [esp + 4]
push esi
mov esi, ecx
push edi
mov ecx, 0x82
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x420]
lea ecx, [esi + 4]
push eax
push ecx
push 0x50de74
push edx
call fcn.004deb4b
add esp, 0x10
mov edx, dword [esi]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x4c4909
mov esi, dword [esp + 0x428]
push esi
call fcn.004debba
mov ecx, dword [esp + 0x428]
mov edx, dword [esp + 0xc]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop edi
and eax, 0xff
pop esi
add esp, 0x414
ret 0xc
Function at 0x4c6250
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x4c6260
mov eax, 1
ret
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
ret
Function at 0x4d4ed0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [ecx + 0xac]
sub esp, 0x208
test edx, edx
jne 0x4d4eeb
xor eax, eax
add esp, 0x208
ret 4
push ebx
push ebp
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push 0x104
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esp + 0xc]
test ecx, ecx
jne 0x4d4f18
xor ebx, ebx
jmp 0x4d4f25
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov ebp, dword [esp + 0x218]
mov eax, dword [ebp]
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
cmp edx, 1
jg 0x4d4f3f
cmp ebx, dword [eax - 4]
jle 0x4d4fa8
mov edx, dword [0x50d0e4]
add eax, 0xfffffff4
cmp eax, edx
je 0x4d4f6f
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4d4f66
mov eax, dword [ebp]
sub eax, 0xc
push eax
call fcn.004de3a6
add esp, 4
mov ecx, dword [0x50d0e0]
mov dword [ebp], ecx
test ebx, ebx
jne 0x4d4f7e
mov edx, dword [0x50d0e0]
mov dword [ebp], edx
jmp 0x4d4fa8
lea eax, [ebx + ebx + 0xe]
push eax
call fcn.004de48f
add esp, 4
test eax, eax
je 0x4d4fdb
mov dword [eax], 1
mov word [eax + ebx*2 + 0xc], 0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
add eax, 0xc
mov dword [ebp], eax
lea eax, [ebx + ebx]
lea ecx, [ebx + ebx + 2]
cmp ecx, eax
jb 0x4d4fcc
mov edi, dword [ebp]
mov ecx, eax
mov edx, ecx
push esi
lea esi, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, dword [ebp]
mov dword [ecx - 8], ebx
mov edx, dword [ebp]
mov word [edx + eax], 0
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret 4

Function at 0x4d5070
Capabilities:
Create tcp socket

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 6
mov cx, word [esp + 0x10]
push 1
mov dword [esi + 4], eax
xor eax, eax
push 2
mov word [esi + 8], cx
mov dword [esi + 0xc], eax
mov word [esi + 0x10], ax
mov byte [esi + 0x12], al
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
mov eax, esi
pop esi
ret 8
Function at 0x4d50c0
Capabilities:
Connect socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x810
push ebx
push ebp
mov ebp, ecx
mov al, byte [ebp + 0x12]
test al, al
je 0x4d50de
pop ebp
xor eax, eax
pop ebx
add esp, 0x810
ret 0x10
mov eax, dword [ebp + 4]
mov cx, word [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp]
lea edx, [esp + 8]
push 0x10
push edx
push eax
mov byte [ebp + 0x12], 1
mov word [esp + 0x14], 2
mov word [esp + 0x16], cx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x4d525c
mov edx, dword [ebp]
push eax
lea ecx, [esp + 0x1c]
push 4
mov bl, 5
push ecx
push edx
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], 2
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], 2
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x4d525c
mov ecx, dword [ebp]
push 0
lea eax, [esp + 0x41c]
push 0x400
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 2
jne 0x4d525c
cmp byte [esp + 0x418], bl
jne 0x4d525c
mov al, byte [esp + 0x419]
cmp al, 2
jne 0x4d526a
mov edx, dword [esp + 0x824]
push esi
push edi
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
mov byte [esp + 0x21], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x22]
mov eax, ecx
mov esi, edi
mov edi, ebx
mov byte [esp + 0x20], 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov ebx, dword [esp + 0x830]
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
lea edx, [esp + ecx + 0x22]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
mov byte [edx], cl
or ecx, 0xffffffff
inc edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, dword [ebp]
add edx, ecx
lea ecx, [esp + 0x24]
sub edx, ecx
push edx
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
test eax, eax
jle 0x4d525c
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x41c]
push 0x400
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 2
jne 0x4d525c
cmp byte [esp + 0x418], 1
jne 0x4d525c
mov al, byte [esp + 0x419]
test al, al
je 0x4d526e
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x810
ret 0x10
test al, al
jne 0x4d525c
pop ebp
xor eax, eax
pop ebx
add esp, 0x810
ret 0x10
Function at 0x4ddf50
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x80]
test eax, eax
jne 0x4ddfa0
mov eax, dword [esi + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x4ddfb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x80], eax
jne 0x4ddfa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4ddfa2
and eax, 0xffff
pop esi
or eax, 0x80070000
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4e0280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4e02a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004e5c5c
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4e02c3
test byte [esp + 8], 2
je 0x4e02c3
call fcn.004e5ccf
mov dword [eax], 0xd
call fcn.004e5cd8
mov dword [eax], 5
jmp 0x4e029c
xor eax, eax
ret

Function at 0x4e03cb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e03eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004e5c5c
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4e040e
test byte [esp + 8], 2
je 0x4e040e
call fcn.004e5ccf
mov dword [eax], 0xd
call fcn.004e5cd8
mov dword [eax], 5
jmp 0x4e03e7
xor eax, eax
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1d83700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.01d8378f
jae 0x1d8370e
xor ecx, ecx
call fcn.01d8378f
jae 0x1d8373d
xor eax, eax
call fcn.01d8378f
jae 0x1d8374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.01d8378f
adc al, al
jae 0x1d8372f
jne 0x1d83779
stosb byte es:[edi], al
jmp 0x1d83711
call fcn.01d8379b
sub ecx, ebx
jne 0x1d83756
call fcn.01d83799
jmp 0x1d83775
lodsb al, byte [esi]
shr eax, 1
je 0x1d83783
adc ecx, ecx
jmp 0x1d83772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01d83799
cmp eax, 0x7d00
jae 0x1d83772
cmp ah, 5
jae 0x1d83773
cmp eax, 0x7f
ja 0x1d83774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d83711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x1ddee11
Capabilities:
Encode data using xor

Disassembly:
mov eax, eax
add ecx, 1
lodsd eax, dword [esi]
cld
cmp dword [edx + 0x10], ecx
lea edi, [eax + ebx + 4]
lea edx, [edx]
je 0x1ddedf1
xor eax, eax
imul eax, eax, 0xf
push eax
xor ecx, 0
nop
movzx eax, byte [edi - 4]
neg eax
cmp esp, ecx
cld
stc
sub edi, 0xfffffff1
lea eax, [eax]
add dword [esp], eax
lea edi, [edi - 0xe]
pop eax
cmp byte [edi - 4], 0xa
ja 0x1ddeccf
and al, 0xff
nop
nop
mov eax, 0x6b060a11
xor dword [esp - 4], eax
mov eax, dword [esp + 4]
sub dword [esp - 4], eax
nop
lea edx, [edx]
cld
nop
jne 0x1ddecb9
nop
nop
lea ebx, [ebx]
cld
mov ebx, ebx
add edx, 0x1b
inc eax
push dword [edx - 7]
dec eax
not al
not eax
adc eax, ebp
and al, 0x6b
pop edi
add edi, ebx
add ecx, ecx
add ecx, ebx
or eax, ecx
xchg al, ah
mov esi, dword [edx + 1]
mov ax, word [ecx + esi]
cwde
not edx
push dword [edi + eax*4]
jmp 0x1ddefcb
ret
push 0xffffffffffffffff
lea edx, [ebx + 8]
xchg ecx, eax
dec edi
push dword [edx + 0x34]
not ch
lea esi, [edx - 8]
xchg edi, edi
add dword [esp], ebx
pop ecx
add edx, dword [ecx + 0x78]
mov al, 0x78
add esi, dword [edx + 0x18]
mov edi, edi
pop ecx
jmp 0x1ddecb7
and ecx, 0x34
add dword [esp], ebx
pop esi
mov eax, dword [esp]
add esp, 8
jmp eax
Function at 0x412c36
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00405d70
mov eax, dword [0x491340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00411097
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x412c78
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x412dd4
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041c420
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x492e58]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041305c
mov ecx, dword [esi*4 + 0x492e58]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x412dcd
cmp eax, dword [edi + ecx + 0x24]
jne 0x412dcd
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x412dcd
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041305c
add esp, 0x14
test edx, edx
jl 0x412dcd
jg 0x412d43
test eax, eax
jb 0x412dcd
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x412dcd
jl 0x412d5d
cmp dword [ebp - 0x1008], eax
ja 0x412dcd
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x412d7b
test ebx, ebx
je 0x412db4
cmp ecx, edi
jae 0x412db4
mov al, byte [ecx]
cmp al, 0xd
jne 0x412d95
lea eax, [edi - 1]
cmp ecx, eax
jae 0x412da1
cmp byte [ecx + 1], 0xa
jne 0x412da1
inc ecx
jmp 0x412da1
movzx eax, al
movsx eax, byte [eax + 0x491cc0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x412d7b
cmp edx, ebx
jne 0x412d7b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x412dd2
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405003
leave
ret