joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e94d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.004bb160
mov eax, dword [0x541af0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x101c], ecx
xor eax, eax
mov word [ebp - 0x1010], ax
push 0xffe
push 0
lea ecx, [ebp - 0x100e]
push ecx
call fcn.004b5d10
add esp, 0xc
push 0x513ad4
mov edx, dword [ebp - 0x101c]
add edx, 0xa8
push edx
lea eax, [ebp - 0x1018]
push eax
call fcn.00404490
add esp, 0xc
mov dword [ebp - 0x1020], eax
mov ecx, dword [ebp - 0x1020]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
push 0x800
lea ecx, [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [ebp - 0x1018]
call fcn.004030e0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
lea eax, [ebp + edx*2 - 0x1010]
push eax
call fcn.004b5c1a
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4e95ae
mov ecx, dword [ebp - 0x1014]
add ecx, 1
mov dword [ebp - 0x1014], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx + 1]
mov dword [ebp - 4], ecx
jmp 0x4e9574
mov eax, dword [ebp - 0x1014]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004b5c0b
mov esp, ebp
pop ebp
ret
Function at 0x4e9800
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8203
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x541af0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x30]
call fcn.00407ae0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4e9892
cmp dword [ebp - 0x3c], 0x6f
je 0x4e9892
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402bf0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402e10
mov eax, dword [ebp + 8]
jmp 0x4e99c7
mov eax, dword [ebp - 0x38]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4e98d3
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402bf0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402e10
mov eax, dword [ebp + 8]
jmp 0x4e99c7
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x4e991a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402bf0
mov ecx, dword [ebp - 0x40]
or ecx, 1
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402e10
mov eax, dword [ebp + 8]
jmp 0x4e99c7
lea ecx, [ebp - 0x34]
call fcn.00407160
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x199]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x198]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x197]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x196]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x195]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x194]
push ecx
push str._02X_02X_02X_02X_02X_02X
lea edx, [ebp - 0x34]
push edx
call fcn.00407580
add esp, 0x20
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [ebp - 0x34]
call fcn.00407180
push eax
lea ecx, [ebp - 0x30]
call fcn.00407ac0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402bf0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.004030e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402e10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b5c0b
mov esp, ebp
pop ebp
ret
Function at 0x4e9ae0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f83b2
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x541af0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0x29c
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x4e9bf7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x14]
call fcn.00407160
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 0x16]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1a]
push edx
movzx eax, word [ebp - 0x1c]
push eax
movzx ecx, word [ebp - 0x1e]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x24]
push eax
push str._r_n_d__02d__02d__02d:_02d:_02d._03d_:__s
lea ecx, [ebp - 0x14]
push ecx
call fcn.00406050
add esp, 0x28
lea ecx, [ebp - 0x14]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x290], 0xffffffff
je 0x4e9bc5
lea ecx, [ebp - 0x14]
call fcn.00403500
shl eax, 1
push eax
lea ecx, [ebp - 0x14]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x28c
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x28c]
mov eax, dword [edx + 0x38]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004030e0
jmp 0x4e9be0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0x29c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004030e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ea280
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8a23
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x541af0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x24c]
call fcn.00407160
mov dword [ebp - 4], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.004b5d10
add esp, 0xc
mov dword [ebp - 0x244], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x250], eax
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4ea39d
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4ea39d
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x250]
jne 0x4ea379
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x258], ecx
jmp 0x4ea390
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4ea35d
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x258], 0
jbe 0x4ea41e
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4ea41e
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4ea41e
mov ecx, dword [ebp - 0x23c]
cmp ecx, dword [ebp - 0x258]
jne 0x4ea3fa
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x24c]
call fcn.00403a70
jmp 0x4ea411
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4ea3d8
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402350
mov ecx, dword [ebp - 0x25c]
or ecx, 1
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.004030e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5c0b
mov esp, ebp
pop ebp
ret 4
Function at 0x4eae70
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x29c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x290], 0xffffffff
je 0x4eaed2
mov ecx, dword [ebp - 0x1c]
add ecx, 0x28c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x28c]
mov edx, dword [eax + 0x48]
call edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x28c
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x28c]
mov eax, dword [edx + 0x4c]
call eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.00407130
jmp 0x4eaef4
push 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
call fcn.00408b80
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.00414f40
push eax
lea ecx, [ebp - 8]
call fcn.004019a0
movzx ecx, al
test ecx, ecx
je 0x4eaf45
push 0x3e8
lea ecx, [ebp - 8]
call fcn.00487e20
mov edx, dword [eax]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4eaf43
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00487e20
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4eaee6
mov ecx, dword [ebp - 0x1c]
call fcn.004ea470
mov ecx, dword [ebp - 0x1c]
call fcn.004e92e0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1c]
call fcn.00497b09
mov esp, ebp
pop ebp
ret
Function at 0x4ed210
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CPoster.0
mov ecx, dword [ebp - 4]
mov dword [ecx + method.DuiLib::CContainerUI.virtual_0], vtable.CPoster.1.0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3fc], 0
je 0x4ed261
push 0x64
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4ed261
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3fc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
add ecx, 0x3f8
call fcn.004030e0
mov ecx, dword [ebp - 4]
add ecx, 0x3f4
call fcn.004030e0
mov ecx, dword [ebp - 4]
add ecx, 0x3f0
call fcn.004030e0
mov ecx, dword [ebp - 4]
call sym.QiyiInstaller.exe_public_virtual:_void___thiscall_DuiLib::CContainerUI::destructor_void_
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x843058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008431a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x84307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84306a
add dl, dl
jne 0x843089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8430dc
xor eax, eax
add dl, dl
jne 0x843096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84317d
add dl, dl
jne 0x8430a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8430b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8430bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8430c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8430d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x843075
mov eax, 1
add dl, dl
jne 0x8430ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8430f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8430e1
sub eax, ebx
mov ebx, 1
jne 0x843128
mov ecx, 1
add dl, dl
jne 0x84310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x843119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x843105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x843075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x84313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x84314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x843136
cmp eax, 0x7d00
jae 0x84316d
cmp eax, 0x500
jb 0x843168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x843075
cmp eax, 0x7f
ja 0x843170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x843075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x84319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x843075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4fb010
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa0000]
push edi
jmp 0x4fb02a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fb031
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fb020
mov eax, 1
add ebx, ebx
jne 0x4fb043
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fb054
jne 0x4fb073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fb073
dec eax
add ebx, ebx
jne 0x4fb060
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fb038
add ebx, ebx
jne 0x4fb06f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fb0c5
xor ecx, ecx
sub eax, 3
jb 0x4fb08b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fb0fa
sar eax, 1
mov ebp, eax
jmp 0x4fb096
add ebx, ebx
jne 0x4fb096
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fb064
inc ecx
add ebx, ebx
jne 0x4fb0a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fb064
add ebx, ebx
jne 0x4fb0b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fb0a6
jne 0x4fb0c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fb0a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fb0e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fb0d6
jmp 0x4fb026
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fb0e4
add edi, ecx
jmp 0x4fb026
pop esi
mov edi, esi
mov ecx, 0x3b6d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fb102
cmp byte [edi], 0x11
jne 0x4fb102
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fb107
lea edi, [esi + 0xf5000]
mov eax, dword [edi]
or eax, eax
je 0x4fb176
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x114cc8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x114d5c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fb134
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x114d64]
or eax, eax
je 0x4fb170
mov dword [ebx], eax
add ebx, 4
jmp 0x4fb151
call dword [esi + 0x114d60]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4fb1a7
cmp al, 0xef
ja 0x4fb19a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4fb17c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4fb189
mov ebp, dword [esi + 0x114d68]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fb1db
sub esp, 0xffffff80
jmp 0x435143
Function at 0xdd2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00dd21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xdd207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd206a
add dl, dl
jne 0xdd2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd20dc
xor eax, eax
add dl, dl
jne 0xdd2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd217d
add dl, dl
jne 0xdd20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdd20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdd2075
mov eax, 1
add dl, dl
jne 0xdd20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd20e1
sub eax, ebx
mov ebx, 1
jne 0xdd2128
mov ecx, 1
add dl, dl
jne 0xdd210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdd2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdd213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdd214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd2136
cmp eax, 0x7d00
jae 0xdd216d
cmp eax, 0x500
jb 0xdd2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd2075
cmp eax, 0x7f
ja 0xdd2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdd219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdd2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4021de
Capabilities:
Terminate process

Disassembly:
push 0
push 0x4010f9
call fcn.00402000
push 0
push 0x4010f9
call fcn.00402000
push 0x401100
push 0x401108
push str.Enter_first_operand:
call fcn.00402024
push 0x401100
push 0x40110c
push str.Enter_second_operand:
call fcn.00402024
push 0
push str.Enter_operator__supported:_______:
call fcn.00402000
call dword [sym.imp.msvcrt.dll__getch]
cmp eax, 0x2b
je 0x4020ac
cmp eax, 0x2d
je 0x4020c3
cmp eax, 0x2a
je 0x4020da
cmp eax, 0x2f
je 0x4020f2
jmp 0x40219b
mov ecx, dword [0x401108]
add ecx, dword [0x40110c]
mov dword [0x401114], ecx
jmp 0x4021ef
mov ecx, dword [0x401108]
sub ecx, dword [0x40110c]
mov dword [0x401114], ecx
jmp 0x4021ef
mov ecx, dword [0x401108]
imul ecx, dword [0x40110c]
mov dword [0x401114], ecx
jmp 0x4021ef
mov eax, dword [0x40110c]
cmp eax, 0
je 0x402181
mov edx, 0
mov eax, dword [0x401108]
div dword [0x40110c]
mov dword [0x401114], eax
mov dword [0x401110], edx
push 0
push 0x4010f9
call fcn.00402000
push dword [0x401114]
push str.Result:__d
call dword [sym.imp.msvcrt.dll_printf]
mov edx, dword [0x401110]
cmp edx, 0
je 0x4021b5
push 0
push 0x4010ec
call fcn.00402000
mov ebx, 0
mov edx, 0
mov eax, dword [0x401110]
imul eax, eax, 0xa
div dword [0x40110c]
push eax
push 0x4010e9
call dword [sym.imp.msvcrt.dll_printf]
mov dword [0x401110], edx
inc ebx
cmp ebx, 3
jne 0x402154
jmp 0x4021b5
push 0
push 0x4010f9
call fcn.00402000
push 1
push str.Cant_divide_by_zero__
call fcn.00402000
jmp 0x4021b5
push 0
push 0x4010f9
call fcn.00402000
push 1
push str.This_action_does_not_supported_yet__
call fcn.00402000
jmp 0x4021b5
push 0
push 0x4010f9
call fcn.00402000
push 0
push str.Do_you_want_to_continue__Y_N__
call fcn.00402000
call dword [sym.imp.msvcrt.dll__getch]
cmp eax, 0x59
je 0x402041
jmp 0x40220e
push 1
push str.Calculator_V0.1_by__crazyproger1
call fcn.00402000
jmp 0x402041
push 0
push 0x4010f9
call fcn.00402000
push dword [0x401114]
push str.Result:__d
call dword [sym.imp.msvcrt.dll_printf]
jmp 0x4021b5
push 0
push 0x4010f9
call fcn.00402000
push 0
push str.To_exit_press_any_key...
call fcn.00402000
call dword [sym.imp.msvcrt.dll__getch]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x10003120
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10032720
push 0x100186dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.10018f60
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100032d0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x10003311
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x1000337e
cmp dword [esp + 0x1c], 2
jne 0x1000337e
cmp dword [esp + 0x10], 5
jne 0x1000337e
cmp dword [esp + 0x14], 1
jne 0x1000337e
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10003368
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10003359
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x10003361
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x1000337e
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret

Function at 0x10003670
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x6c
lea eax, [esp]
push esi
push eax
push str.SystemCurrentControlSetControlProductOptions
push closesocket
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100036ea
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.ProductType
push eax
mov dword [esp + 0x20], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100036df
push edi
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x78]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
pop edi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x6c
ret 4