joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a3cf
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004047e0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40a3f2
mov eax, edi
add eax, eax
call fcn.00402dd8
mov esi, eax
jmp 0x40a3f4
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40a42d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40a417
mov eax, esp
cmp esi, eax
je 0x40a43a
mov eax, esi
call fcn.00402df4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40a474
cmp bl, 0
je 0x40a470
cmp bl, 0x41
jl 0x40a46b
cmp bl, 0x5a
jg 0x40a46b
or bl, 0x20
xor al, bl
inc esi
jmp 0x40a44f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a3b4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x10001016
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push edi
push 0x10003010
push 0x65
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10001061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x10001065
xor eax, eax
jmp 0x100010a7
push ebx
mov ebx, dword [esi]
push 0
push 4
push 2
push 0
push 2
push 0x40000000
push 0x10003038
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100010a3
lea eax, [esp + 0xc]
push 0
push eax
add esi, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x100010ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], edx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push 0x8000000
push edx
push edx
push edx
push 0x10003038
push edx
mov word [ebp - 0x24], dx
mov dword [ebp - 0x28], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x10001110
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
call esi
pop esi
xor eax, eax
leave
ret

Function at 0x313e8954
Capabilities:
Encode data using xor

Disassembly:
jmp 0x313e895e
pushal
call 0x313e8964
pop ebp
sub ebp, 0x10
sub ebp, 0x3e8954
mov al, byte [esp + 0x28]
cmp al, 1
je 0x313e8988
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x313e8991
mov eax, 0x3e8954
add eax, ebp
add eax, 0x63
mov ecx, 0x609
mov edx, 0xa9eb8c75
xor byte [eax], dl
inc eax
dec ecx
jne 0x313e89a8
jmp 0x313e89bb
invalid
Function at 0x40ef40
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 8
Function at 0x40108a
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x44
xor edi, edi
pop esi
lea eax, [ebp - 0x54]
push esi
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff6
mov dword [ebp - 0x18], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x1c], eax
call esi
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ax, word [0x404568]
mov dword [ebp - 0x28], 0x101
push str.exec
mov word [ebp - 0x24], ax
call fcn.00401025
pop ecx
lea eax, [ebp - 0x10]
pop ecx
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push 8
push 1
push edi
push edi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp - 0x10]
push esi
push str.hProcess
call fcn.00401061
pop ecx
mov eax, esi
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40115e
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x348]
push str._s
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40128a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x218]
push 0x404100
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40126c
lea eax, [ebp - 0x218]
push 0x4040fc
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40126c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x104]
test byte [ebp - 0x244], 0x10
push dword [ebp + 0xc]
push eax
je 0x401214
call fcn.0040115e
jmp 0x40126a
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x40126c
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
jne 0x40126c
cmp dword [0x404584], 0x1388
jge 0x401255
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x404584], 0x64
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
je 0x40122d
test eax, eax
jne 0x40126c
lea eax, [ebp - 0x104]
push eax
push str.delerr
call fcn.00401025
pop ecx
pop ecx
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4011a9
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop ebx
leave
ret
Function at 0x401297
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push 0
or dword [ebp - 4], 0xffffffff
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401314
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x40130c
lea eax, [esi + 1]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
pop ecx
mov dword [ebp - 8], eax
pop ecx
lea ecx, [ebp + 8]
push 0
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40130c
cmp dword [ebp + 8], esi
jne 0x40130c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], esi
test eax, eax
je 0x40130c
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x4013bd
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [eax + ecx + 0x18]
lea esi, [eax + ecx]
push 1
lea eax, [edi + 4]
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
pop ecx
xor edx, edx
test edi, edi
pop ecx
mov dword [eax], edi
jle 0x401401
lea ecx, [eax + 4]
push ebx
sub esi, ecx
add esi, 0x1c
lea ecx, [eax + edx + 4]
mov bl, byte [esi + ecx]
xor bl, dl
sub bl, 0x64
inc edx
cmp edx, edi
mov byte [ecx], bl
jl 0x4013ed
pop ebx
pop edi
pop esi
ret

Function at 0x4015cb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_calloc]
push edi
push 1
push 0x1f4
call esi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [0x404028]
push str._s_e_sn_dx_s_s
push eax
call edi
add esp, 0x24
cmp dword [0x404570], 0
jne 0x401684
cmp dword [ebp + 0x18], 0
jne 0x40161c
mov dword [ebp + 0x18], 0x404588
push ebx
push 1
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
push dword [ebp + 0x18]
mov ebx, eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebx + eax + 0xc8]
pop ecx
push eax
call esi
push dword [ebp + 0x18]
mov esi, eax
push dword [ebp + 8]
push str._s_n_s_nWould_you_like_detailed_help_
push esi
call edi
mov eax, dword [0x404574]
add esp, 0x18
xor edi, edi
cmp eax, edi
pop ebx
jne 0x401661
mov eax, dword [str.jexepack]
push 0x14
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x401684
push 1
push edi
push edi
push dword [ebp - 4]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x40168b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
push esi
push esi
push 2
push esi
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4016d6
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 8]
push esi
push edx
mov ecx, dword [eax]
add eax, 4
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4016cd
mov esi, 0x2711
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4016db
mov esi, 0x2711
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x4016e1
Capabilities:
Check if file exists
Create a process with modified i/o handles and window
Create process on windows
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
push ebx
push edi
xor edi, edi
cmp dword [0x404570], edi
jne 0x401817
cmp dword [ebp + 0xc], edi
je 0x401817
push dword [ebp + 8]
lea eax, [ebp - 0x1bc]
push str._s_getjava.exe
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
push dword [ebp + 0xc]
lea eax, [ebp - 0x1bc]
push eax
call fcn.0040168b
lea eax, [ebp - 0x1bc]
mov ebx, str.getjava
push eax
push ebx
call fcn.00401025
add esp, 0x1c
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401817
mov eax, dword [0x404574]
cmp eax, edi
jne 0x401760
mov eax, dword [str.jexepack]
push esi
push 0x40
push eax
push str.The_Java_Runtime_Environment_for_this_program_will_be_installed_first...
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x44
lea eax, [ebp - 0x54]
pop esi
push esi
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff6
mov dword [ebp - 0x18], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x1c], eax
call esi
mov dword [ebp - 0x14], eax
mov ax, word [0x404568]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push 1
push edi
lea eax, [ebp - 0x1bc]
push edi
push eax
push edi
mov dword [ebp - 0x28], 0x101
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp - 0x10]
push esi
push str.hGetJavaProcess
call fcn.00401061
pop ecx
cmp esi, edi
pop ecx
je 0x4017f7
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.DONE
push ebx
call fcn.00401025
pop ecx
lea eax, [ebp - 0x1bc]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop eax
pop esi
jmp 0x401819
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x40181d
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9fc
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push edi
lea eax, [ebp - 0x1fc]
push dword [ebp + 8]
xor edi, edi
push str.SOFTWAREJavaSoftJava_Runtime_Environment_s_
push eax
call esi
add esp, 0xc
lea eax, [ebp + 8]
push eax
push 0x20019
lea eax, [ebp - 0x1fc]
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018ea
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x39c
push eax
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.JavaHome
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4018e1
cmp dword [ebp - 8], 1
jne 0x4018e1
lea eax, [ebp - 0x5fc]
push str._bin_
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x9fc]
push str._sjava.exe
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x9fc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4018e1
lea eax, [ebp - 0x5fc]
push eax
call fcn.0040148a
pop ecx
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4019df
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a4
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push edi
je 0x401b02
push dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x1bc]
push str._s_failhook.exe
push eax
call edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x1bc]
push eax
call fcn.0040168b
lea eax, [ebp - 0x1bc]
push eax
push str.failhook
call fcn.00401025
add esp, 0x1c
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401b02
push esi
push 0x44
pop esi
lea eax, [ebp - 0x54]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff6
mov dword [ebp - 0x18], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x1c], eax
call esi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x28], 0x100
push eax
lea eax, [ebp - 0x5a4]
push str._s___s_
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
lea eax, [ebp - 0x5a4]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp - 0x10]
push esi
push str.hFailHookProcess
call fcn.00401061
pop ecx
cmp esi, ebx
pop ecx
je 0x401ade
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.DONE
push str.failhook
call fcn.00401025
pop ecx
lea eax, [ebp - 0x1bc]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop eax
pop esi
jmp 0x401b04
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x407b43
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x407be0
push ebx
push esi
call fcn.00407b0c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407aa0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x407b8d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407bdf
push edi
push eax
call fcn.00408760
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x407bad
call fcn.00406601
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407bde
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407aa0
add esp, 0x20
test eax, eax
jne 0x407bcc
push edi
call fcn.00406601
jmp 0x407bd4
push ebx
call fcn.00406601
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x408edd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410fd8
push 0x410fd0
push str.FlsAlloc
push 0x1f
call fcn.00408d9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408f11
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f110]
call esi
jmp 0x408f17
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408f5b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410fe8
push 0x410fe0
push str.FlsGetValue
push 0x21
call fcn.00408d9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408f92
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f110]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408f9a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410ff0
push 0x410fe8
push str.FlsSetValue
push 0x22
call fcn.00408d9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408fd4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f110]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40e430
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e45d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e45d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x10457058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104571a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1045707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045706a
add dl, dl
jne 0x10457089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104570dc
xor eax, eax
add dl, dl
jne 0x10457096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045717d
add dl, dl
jne 0x104570a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104570b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104570bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104570c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104570d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10457075
mov eax, 1
add dl, dl
jne 0x104570ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104570f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104570e1
sub eax, ebx
mov ebx, 1
jne 0x10457128
mov ecx, 1
add dl, dl
jne 0x1045710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10457119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10457105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10457075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1045713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1045714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10457136
cmp eax, 0x7d00
jae 0x1045716d
cmp eax, 0x500
jb 0x10457168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10457075
cmp eax, 0x7f
ja 0x10457170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10457075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1045719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10457075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4203c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4203d6
pop dword [ebp - 0x40]
mov eax, 0x4203d6
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xd2083c33
sub dword [ebp - 0x50], 0x83b5f6e8
mov dword [ebp - 0x4c], 0x632db4c0
add dword [ebp - 0x4c], 0xcf059785
mov dword [ebp - 0x48], 0x9dffa937
sub dword [ebp - 0x48], 0x51b36509
mov dword [ebp - 0x44], 0x4d759fbe
sub dword [ebp - 0x44], 0x4d759fbe
lea eax, [ebp - 0x50]
push eax
mov eax, 0x860dc21b
add eax, 0x7a346e59
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xfca3f785
sub dword [ebp - 0x50], 0x88318e2f
mov dword [ebp - 0x4c], 0xf2c4d99d
sub dword [ebp - 0x4c], 0xb1587828
mov dword [ebp - 0x48], 0x52ed749
sub dword [ebp - 0x48], 0xa1bf6add
mov dword [ebp - 0x44], 0x60a6e127
add dword [ebp - 0x44], 0x9f591ed9
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xc69ec40
sub eax, 0xc27bb1c
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3fca2
push 0
call eax
mov ecx, 0x4f5f
xor edx, edx
add edx, eax
mov ebx, 0x2a37ad2e
add ebx, 0xd60b96d2
add ebx, dword [ebp - 0x40]
mov edi, 0x9d86ebac
sub edi, 0x1dc4490b
xor dword [ebp - 0x18], eax
mov esi, dword [ebx]
sub esi, edi
add dword [ebp - 0x14], 0x59b5381d
mov dword [edx], esi
add dword [ebp - 0x2c], edx
add edx, 0x8185411
add edx, 0xf7e7abf3
add ebx, 0x7eab9b5e
add ebx, 0x815464a6
loop 0x4204ef
add eax, 0x7079f373
add eax, 0x8f873cdc
xor ebx, ebx
add ebx, eax
add eax, 0xbb0f1eba
add eax, 0x44f0e14b
mov ecx, 0x72920ef9
sub ecx, 0x72520ef9
add ecx, dword [ebp - 0x40]
call ebx
leave
ret