joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dbb0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x74014c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x45dbc3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x45dc04
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x7401f4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x45dc36
mov bl, byte [esp + ecx + 0x4c]
jmp 0x45dc3a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x45dc2b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x45dc58
mov bl, byte [esp + ecx + 0x4c]
jmp 0x45dc5c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x45dc4d
xor ecx, ecx
mov eax, 0x74015c
xor ebx, ebx
mov bl, byte [ecx + 0x740204]
cmp byte [esp + ebx + 0x14], 0
je 0x45dc87
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x74021c]
cmp byte [esp + ebx + 0x14], 0
je 0x45dc9e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x45dc6e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x45dbf7
lea edx, [esp + 0x84]
push edx
call fcn.0045dce0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x460660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00460240
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.004602b0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.00460590
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.00460260
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10

Function at 0x460678
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00460240
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.004602b0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.00460590
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.00460260
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x460960
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4912b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.00460240
xor ebx, ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], ebx
call fcn.00460240
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 0xc]
push esi
mov byte [esp + 0x38], 1
call fcn.004602b0
cmp dword [esp + 0x40], ebx
jne 0x4609e8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0x1c]
mov esi, eax
mov byte [esp + 0x34], bl
call fcn.00460260
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xffffffff
call fcn.00460260
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
lea eax, [esp + 0xc]
push eax
call fcn.004608a0
add esp, 4
lea ecx, [esp + 0xc]
mov esi, 1
call fcn.00430ca0
cmp eax, esi
jb 0x460a6b
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 1
push 1
push esi
push 0x7429b8
lea ecx, [esp + 0x1c]
call fcn.00460660
cmp eax, 1
jne 0x460a5d
push esi
lea ecx, [esp + 0x20]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00460400
push ebx
lea ecx, [esp + 0x20]
call fcn.0043e690
push eax
call fcn.00470ee2
add esp, 8
test eax, eax
jge 0x460a5d
push ebx
lea ecx, [esp + 0x20]
call fcn.004327f0
push eax
call edi
test eax, eax
je 0x460aa0
lea ecx, [esp + 0xc]
inc esi
call fcn.00430ca0
cmp esi, eax
jbe 0x460a0d
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], bl
call fcn.00460260
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xffffffff
call fcn.00460260
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], bl
call fcn.00460260
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xffffffff
call fcn.00460260
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x462550
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x100
mov ecx, dword [esp + 0x104]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x114]
push edi
xor edi, edi
mov edx, esi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], edi
mov eax, dword [ecx]
add ecx, 4
mov ebp, dword [esp + eax*4 + 0x54]
lea eax, [esp + eax*4 + 0x54]
inc ebp
dec edx
mov dword [eax], ebp
jne 0x4625bb
cmp dword [esp + 0x54], esi
jne 0x4625f3
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x12c]
mov dword [ecx], edi
mov dword [edx], edi
mov ebx, dword [esp + 0x12c]
mov ecx, 1
lea eax, [esp + 0x58]
mov ebp, dword [ebx]
mov dword [esp + 0x10], ebp
cmp dword [eax], edi
jne 0x462616
inc ecx
add eax, 4
cmp ecx, 0xf
jbe 0x462609
mov eax, ecx
cmp ebp, ecx
mov dword [esp + 0x14], eax
jae 0x462626
mov dword [esp + 0x10], ecx
mov ebp, ecx
mov edx, 0xf
lea esi, [esp + 0x90]
cmp dword [esi], edi
jne 0x46263e
dec edx
sub esi, 4
cmp edx, edi
jne 0x462632
cmp ebp, edx
mov dword [esp + 0x2c], edx
jbe 0x46264c
mov dword [esp + 0x10], edx
mov ebp, edx
mov esi, 1
mov dword [ebx], ebp
shl esi, cl
cmp ecx, edx
jae 0x46266b
lea ebx, [esp + ecx*4 + 0x54]
sub esi, dword [ebx]
js 0x462686
inc ecx
add ebx, 4
shl esi, 1
cmp ecx, edx
jb 0x46265d
lea ecx, [edx*4]
mov dword [esp + 0x20], ecx
mov ebx, dword [esp + ecx + 0x54]
lea ecx, [esp + ecx + 0x54]
sub esi, ebx
mov dword [esp + 0x44], esi
jns 0x462696
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x100
ret
add ebx, esi
mov dword [esp + 0x98], edi
mov dword [ecx], ebx
xor ecx, ecx
dec edx
je 0x4626b9
xor ebx, ebx
add ecx, dword [esp + ebx + 0x58]
add ebx, 4
dec edx
mov dword [esp + ebx + 0x98], ecx
jne 0x4626a8
mov edx, dword [esp + 0x114]
xor ebx, ebx
Function at 0x463020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x46302b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x46312e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x72409c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x72409c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x72409c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x72409c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x72409c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x72409c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x72409c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x72409c]
xor eax, edx
inc ecx
dec edi
jne 0x463046
pop edi
test esi, esi
je 0x463150
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x72409c]
xor eax, edx
inc ecx
dec esi
jne 0x463132
pop esi
pop ebx
not eax
ret

Function at 0x463ae0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x463b21
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x463b16
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x463b34
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x464a70
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x464b25
cmp dword [ebp + 4], 0xffffffff
jne 0x464b25
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x742c40
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x464aed
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x464aed
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.00463870
add esp, 0x10
test eax, eax
jne 0x464b10
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.00463db0
add esp, 4
mov dword [ebp], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x464f80
Capabilities:
Create directory

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x208
test ecx, ecx
je 0x465048
mov al, byte [ecx]
test al, al
je 0x465048
push ebx
push esi
push edi
mov ebx, ecx
mov esi, ecx
cmp al, 0x2f
je 0x464fab
cmp al, 0x5c
jne 0x464fad
mov ebx, esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x464fa3
mov edi, dword [esp + 0x218]
cmp ebx, ecx
je 0x464fe4
mov esi, ebx
lea eax, [esp + 0xc]
sub esi, ecx
push esi
push ecx
push eax
call fcn.00470f28
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.00464f80
add esp, 0x14
inc ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x470ee2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x470f02
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004723b9
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x470f25
test byte [esp + 8], 2
je 0x470f25
call fcn.0047242c
mov dword [eax], 0xd
call fcn.00472435
mov dword [eax], 5
jmp 0x470efe
xor eax, eax
ret

Function at 0x476a9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x727e80
push 0x4700e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [fcn.00476a3c]
test eax, eax
je 0x476ae5
mov dword [ebp - 4], 1
call eax
jmp 0x476ae1
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x476aee
jmp fcn.00476a3c

Function at 0x481fba
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x481ff2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048006e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00480046
jmp 0x481ffe
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4836ad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4836ef
call fcn.00489692
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4836ef
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4836e6
xor eax, eax
jmp 0x4836f7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004836fd
pop edi
pop esi
pop ebx
ret 4

Function at 0x489bc2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x489bf0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x489c0e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00489b28
jmp 0x489c0e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x489c0e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00489b28
test edi, edi
mov eax, edi
jne 0x489bf8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x33f55615
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6d6359fc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40288e
pop dword [ebp - 0x34]
mov eax, 0xe1cec867
add eax, 0x1e716027
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x91514d6d
sub dword [ebp - 0x44], 0x42ff0822
mov dword [ebp - 0x40], 0xf1f2da04
sub dword [ebp - 0x40], 0xbfbf8dbf
mov dword [ebp - 0x3c], 0x254ad13
sub dword [ebp - 0x3c], 0xb60868e5
mov dword [ebp - 0x38], 0xdafcb0de
sub dword [ebp - 0x38], 0xdafcb0de
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9595d492
sub dword [ebp - 0x44], 0x21236b3c
mov dword [ebp - 0x40], 0xb0a469b1
sub dword [ebp - 0x40], 0x6f38083c
mov dword [ebp - 0x3c], 0xac3be9f4
add dword [ebp - 0x3c], 0xb7338278
mov dword [ebp - 0x38], 0x25bb09fe
sub dword [ebp - 0x38], 0x25bb09fe
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b68e
push 0
call eax
mov ecx, 0x78fde035
sub ecx, 0x78fd84f4
xor ebx, ebx
add ebx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x34]
mov edi, 0x8cbaf8ce
add edi, 0x39fc5080
xor dword [ebp - 0xc], 0xe36f15cb
mov edx, dword [esi]
add edx, edi
xor dword [ebp - 0x10], 0xb6c69c5e
mov dword [ebx], edx
add dword [ebp - 0x14], ecx
add ebx, 4
add esi, 4
loop 0x4029a2
add eax, 0x88c9c897
add eax, 0x77379740
xor ebx, ebx
add ebx, eax
add eax, 0x7f3f6d6d
sub eax, 0x7f3f6d68
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10013a33
pop dword [ebp - 0x48]
mov eax, 0xf2bff7d4
sub eax, 0xe2bebda1
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xb541e6d9
sub dword [ebp - 0x58], 0x66efa18e
mov dword [ebp - 0x54], 0x45fd4ab0
sub dword [ebp - 0x54], 0x13c9fe6b
mov dword [ebp - 0x50], 0xf531f22d
sub dword [ebp - 0x50], 0xa8e5adff
mov dword [ebp - 0x4c], 0x121580b7
add dword [ebp - 0x4c], 0xedea7f49
lea eax, [ebp - 0x58]
push eax
mov eax, 0x4867ae3c
sub eax, 0x3865edbc
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xed4ecb6d
sub dword [ebp - 0x58], 0x78dc6217
mov dword [ebp - 0x54], 0x6de9ea62
add dword [ebp - 0x54], 0xd3827713
mov dword [ebp - 0x50], 0xc7a80ae
add dword [ebp - 0x50], 0x56f4ebbe
mov dword [ebp - 0x4c], 0x53f4eed9
add dword [ebp - 0x4c], 0xac0b1127
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x1407de46
sub eax, 0x4061e46
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x35df5
push 0
call eax
mov ecx, 0x702d5ff4
sub ecx, 0x702d1e1c
xor edx, edx
add edx, eax
mov ebx, 0x32b0c735
sub ebx, 0x22ae5f35
add ebx, dword [ebp - 0x48]
mov edi, 0x1496799a
add edi, 0xf669646f
add dword [ebp - 0x30], 0x6632e608
mov esi, dword [ebx]
add dword [ebp - 0x3c], edx
add esi, edi
xor dword [ebp - 0x44], 0x4a556ea5
mov dword [edx], esi
mov dword [ebp - 0x28], 0xcac9ae32
add edx, 4
add ebx, 4
loop 0x10013b57
add eax, 0x6314cf47
sub eax, 0x6313d514
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa3e65ce3
sub ecx, 0x93e65ce3
add ecx, dword [ebp - 0x48]
Function at 0x888058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008881a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88806a
add dl, dl
jne 0x888089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8880dc
xor eax, eax
add dl, dl
jne 0x888096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88817d
add dl, dl
jne 0x8880a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8880b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8880bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8880c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8880d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x888075
mov eax, 1
add dl, dl
jne 0x8880ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8880f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8880e1
sub eax, ebx
mov ebx, 1
jne 0x888128
mov ecx, 1
add dl, dl
jne 0x88810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x888119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x888105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x888075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x888136
cmp eax, 0x7d00
jae 0x88816d
cmp eax, 0x500
jb 0x888168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x888075
cmp eax, 0x7f
ja 0x888170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x888075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x888075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x418ce0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4b3068]
xor edx, edx
cmp eax, edx
jne 0x418d06
xor eax, eax
mov byte [eax + 0x4b2f68], al
inc eax
cmp eax, 0x100
jl 0x418cee
mov dword [0x4b3068], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4b2f68
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x418d97
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x418d6a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x418d38
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x418e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x418e63
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x418e4a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret