joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406680
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1050
call fcn.0044d630
lea eax, [0x472180]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0x1c
mov dword [esp + 8], eax
call fcn.00407d40
mov eax, dword [esp + 0x1c]
add eax, 0x1c
lea ecx, [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x14
call fcn.0044e5ae
cmp eax, 0
je 0x4066ed
jmp 0x4066de
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4066ef
mov eax, dword [esp + 0x1c]
cmp dword [eax], 1
sete al
test al, 1
jne 0x4066ff
jmp 0x406714
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 1
jmp 0x4068bc
lea eax, [esp + 0x50]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x800
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
lea eax, [esp + 0x50]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 3
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov dword [esp + 0x20], eax
mov eax, 0xffffffff
cmp dword [esp + 0x20], eax
sete al
test al, 1
jne 0x40678e
jmp 0x4067a3
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 1
jmp 0x4068bc
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
call eax
sub esp, 8
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 4]
add ecx, 0x30
cmp eax, ecx
jae 0x4067f5
jmp 0x4067d0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 1
jmp 0x4068bc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.004556d4
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
lea esi, [esp + 0x38]
xor edi, edi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x1c]
add eax, 8
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
add ecx, dword [edx + 4]
add ecx, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x14
call fcn.0044e5ae
cmp eax, 0
jne 0x4068a0
call fcn.004068d0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00455635
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 1
jmp 0x4068bc
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00455635
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 1
mov eax, dword [esp + 0x24]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x42eb10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
jmp 0x42eb1b
push eax
mov edi, esp
push eax
mov edx, esp
push eax
mov esi, esp
push eax
mov ecx, esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov dword [esi], 0
mov dword [ecx], 0
mov eax, dword [edx]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [ebp - 0x10], ecx
mov dword [esp + 8], ecx
call fcn.0042e6e0
add esp, 0xc
mov eax, dword [edi]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x40000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
mov eax, 0xffffffff
mov edx, ebx
cmp dword [ebx], eax
setne al
test al, 1
jne 0x42ebb3
jmp 0x42ec0a
cmp dword [esi], 0
je 0x42ec0a
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jle 0x42ec0a
mov ecx, dword [ebp - 0x18]
mov dword [ecx], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ebx, edx
mov edx, dword [ebx]
xor edi, edi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42ec0c
cmp dword [esi], 0
setne al
test al, 1
jne 0x42ec18
jmp 0x42ec28
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
jmp 0x42ec2a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42fca0
Capabilities:
Reference http user-agent string
Set http header

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
push str.winhttp.dll
push 0xf9f57cf0
call fcn.0044cd40
add esp, 8
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_119.0.0.0_Safari_537.36
call eax
mov esi, eax
push str.winhttp.dll
push 0x406457c2
call fcn.0044cd40
add esp, 8
push 0
push 0x50
push edi
push esi
call eax
mov edi, eax
push str.winhttp.dll
push 0x507048c2
call fcn.0044cd40
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push str.POST
push edi
call eax
mov ebx, eax
push str.winhttp.dll
push 0xe268a0c1
call fcn.0044cd40
add esp, 8
push 0x493e0
push 0x493e0
push 0x493e0
push 0x493e0
push ebx
call eax
push 1
push 0x96
call fcn.004551e7
add esp, 8
mov ebp, eax
push str.be85de5ipdocierre1
push str.Content_Type:_multipart_form_data__boundary_s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.winhttp.dll
push 0xab3372e8
call fcn.0044cd40
add esp, 8
push 0x20000000
push 0xffffffffffffffff
push ebp
push ebx
call eax
cmp dword [0x4765f4], 0
je 0x42fdc3
push 1
push 0x100
call fcn.004551e7
add esp, 8
mov ebp, eax
push dword [0x4765f0]
push str.Cookie:___cf_mw_byp_hs
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x20000000
push 0xffffffffffffffff
push ebp
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push ebp
call fcn.00455635
add esp, 4
push str.winhttp.dll
push 0xb72f0de
call fcn.0044cd40
add esp, 8
push 0
mov ebp, dword [esp + 0x28]
push ebp
push 0
push 0
push 0
push 0
push ebx
call eax
mov dword [esp], 0
push str.winhttp.dll
push 0x59886bc0
call fcn.0044cd40
add esp, 8
mov ecx, esp
push ecx
push ebp
push dword [esp + 0x28]
push ebx
call eax
test eax, eax
je 0x42fe75
push str.winhttp.dll
push 0x76b029a
call fcn.0044cd40
add esp, 8
push 0
push ebx
call eax
test eax, eax
je 0x42fe75
test esi, esi
je 0x42fe43
push str.winhttp.dll
push 0x7aa0edcc
call fcn.0044cd40
add esp, 8
push esi
call eax
test edi, edi
je 0x42fe5c
push str.winhttp.dll
push 0x7aa0edcc
call fcn.0044cd40
add esp, 8
push edi
call eax
test ebx, ebx
je 0x42fe75
push str.winhttp.dll
push 0x7aa0edcc
call fcn.0044cd40
add esp, 8
push ebx
call eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444200
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x44420e
push eax
mov ecx, esp
sub esp, 0x820
mov edi, esp
sub esp, 8
mov esi, esp
push eax
mov ebx, esp
sub esp, 0x10
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], eax
xor eax, eax
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x820
call fcn.00450730
add esp, 0xc
cmp edi, 0
setne al
test al, 1
jne 0x44425f
jmp 0x4443f1
sub esp, 8
mov dword [esp], edi
mov dword [esp + 4], 0x104
mov eax, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call eax
test eax, eax
sete al
setne cl
mov dl, cl
inc dl
and al, dl
or al, 0
xor al, 0xff
xor cl, 0xff
mov dl, cl
and dl, 0xff
or dl, 0
xor dl, 0
or cl, 0
xor cl, 0xff
and cl, 0xff
or dl, cl
mov cl, dl
xor cl, 0xff
xor dl, 0xff
and cl, dl
xor cl, 0xff
and cl, 0xff
xor cl, 0xff
and cl, 0xff
or al, cl
xor al, 0xff
and al, 1
movzx eax, al
cmp eax, 0
setg al
test al, 1
jne 0x4442ca
jmp 0x4442d4
mov word [esi], 0x43
mov edi, dword [ebp - 0x10]
jmp 0x4442e0
jmp 0x4442d6
mov eax, dword [edi]
mov word [esi], ax
mov edi, dword [ebp - 0x10]
jmp 0x4442e0
mov word [esi + 2], 0x3a
mov word [esi + 4], 0x5c
mov word [esi + 6], 0
mov dword [ebx], 0
xor eax, eax
sub esp, 0x20
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, 0
je 0x4443ed
sub esp, 4
mov dword [esp], ebx
call fcn.004441e0
add esp, 4
mov esi, dword [ebp - 0x14]
mov dword [esi], eax
sub esp, 4
mov dword [esp], ebx
call fcn.004441e0
add esp, 4
mov word [esi + 4], ax
sub esp, 4
mov dword [esp], ebx
call fcn.004441e0
add esp, 4
mov word [esi + 6], ax
mov dword [edi], 1
jmp 0x444382
jmp 0x444384
cmp dword [edi], 9
setl al
test al, 1
jne 0x444392
jmp 0x444390
jmp 0x4443b2
sub esp, 4
mov dword [esp], ebx
call fcn.004441e0
add esp, 4
mov ecx, dword [edi]
sub ecx, 1
mov byte [esi + ecx + 8], al
mov eax, dword [edi]
add eax, 1
mov dword [edi], eax
jmp 0x444382
mov eax, dword [esi + 8]
movzx ecx, word [esi + 4]
movzx edx, word [esi + 6]
mov esi, dword [esi]
mov edi, dword [ebp - 0x18]
mov edi, dword [edi]
lea ebx, str.l2_08x_08x_04x_xu
sub esp, 0x18
mov dword [esp], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
jmp 0x4443ef
jmp 0x4443f1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444400
Capabilities:
Decode data using base64 via winapi

Disassembly:
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00455be0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
xor edx, edx
lea edx, [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
sub esp, 0x1c
cmp eax, 0
jne 0x444479
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 1
jmp 0x444521
mov eax, dword [esp + 0x20]
sub eax, 0x92a04831
add eax, 1
add eax, 0x92a04831
mov dword [esp], eax
call fcn.004556d4
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov byte [eax + ecx], 0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
lea esi, [esp + 0x20]
xor edi, edi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
sub esp, 0x1c
cmp eax, 0
jne 0x444507
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00455635
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 1
jmp 0x444521
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 1
mov eax, dword [esp + 0x24]
add esp, 0x30
pop esi
pop edi
ret
Function at 0x44ce00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 0x3c]
add eax, 0x18731ad0
add eax, ecx
sub eax, 0x18731ad0
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x34]
add eax, dword [ecx + 0x78]
mov dword [esp + 0x10], eax
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 0x20]
mov eax, edi
and eax, esi
mov ecx, edi
xor ecx, 0xffffffff
mov ebx, esi
xor ebx, 0xffffffff
mov edx, ecx
and edx, 0x998e3409
and edi, 0x6671cbf6
mov ebp, ebx
and ebp, 0x998e3409
and esi, 0x6671cbf6
or edx, edi
or ebp, esi
xor edx, ebp
or ecx, ebx
xor ecx, 0xffffffff
and ecx, 0xffffffff
or edx, ecx
add eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
add eax, dword [ecx + 0x24]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx + 0x18]
jb 0x44ceca
mov dword [esp + 8], 2
jmp 0x44cf48
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + edx*4]
xor edx, edx
sub edx, ecx
sub eax, edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0044cfc0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x54]
cmp eax, dword [esp + 0x24]
jne 0x44cf17
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
movzx eax, word [eax + ecx*2]
mov dword [esp + 0x14], eax
mov dword [esp + 8], 2
jmp 0x44cf23
jmp 0x44cf19
mov dword [esp + 8], 0
jmp 0x44cf23
cmp dword [esp + 8], 0
jne 0x44cf46
jmp 0x44cf2c
mov eax, dword [esp + 0xc]
mov ecx, eax
and ecx, 1
shl ecx, 1
xor eax, 1
add eax, ecx
mov dword [esp + 0xc], eax
jmp 0x44ceb3
jmp 0x44cf48
jmp 0x44cf4a
jmp 0x44cf4c
jmp 0x44cf4e
cmp dword [esp + 0x14], 0
sete al
test al, 1
jne 0x44cf5c
jmp 0x44cf6e
mov dword [esp + 0x18], 0
mov dword [esp + 8], 1
jmp 0x44cfae
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 0x1c]
xor ecx, 0xffffffff
sub ecx, 0xffffffff
sub eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ecx, dword [ecx + edx*4]
xor edx, edx
sub edx, ecx
sub eax, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 8], 1
mov eax, dword [esp + 0x18]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44d340
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub esp, 0x24
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x20], 0x10
mov eax, dword fs:[0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
xor edx, edx
sub edx, ecx
sub eax, edx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
xor edx, edx
sub edx, ecx
sub eax, edx
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 8], eax
jmp 0x44d397
mov eax, dword [esp + 8]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0
setne al
test al, 1
jne 0x44d3b2
jmp 0x44d3d6
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x30]
lea ecx, str.kernel32.dll
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
sub esp, 8
cmp eax, 0
jne 0x44d3d6
jmp 0x44d3e6
jmp 0x44d3d8
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
cmp eax, ecx
jne 0x44d395
jmp 0x44d3e6
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x18]
add esp, 0x24
ret

Function at 0x44dc4f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44dc8e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44dc8e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44dc8e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44dc8e
cmp dword [ecx + 0x74], 0xe
jbe 0x44dc8e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x459ab0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x459add
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x459add
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x45f688
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f693
Function at 0x99c69c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x99e168
sub eax, eax
test esi, esi
je 0x99c774
sub eax, 1
test ecx, ecx
je 0x99c772
test esi, 3
je 0x99c6da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x99c6bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x99c759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x99c6e4
mov ecx, edx
test ecx, ecx
je 0x99c772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x99c75f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x99c77c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0099c7ff
jae 0x99c78a
xor ecx, ecx
call fcn.0099c7ff
jae 0x99c7b9
xor eax, eax
call fcn.0099c7ff
jae 0x99c7c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0099c7ff
adc al, al
jae 0x99c7ab
jne 0x99c7f5
stosb byte es:[edi], al
jmp 0x99c78d
call fcn.0099c80b
sub ecx, ebx
jne 0x99c7d2
call fcn.0099c809
jmp 0x99c7f1
lodsb al, byte [esi]
shr eax, 1
je 0x99c81b
adc ecx, ecx
jmp 0x99c7ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0099c809
cmp eax, 0x7d00
jae 0x99c7ee
cmp ah, 5
jae 0x99c7ef
cmp eax, 0x7f
ja 0x99c7f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99c78d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x401000
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0x5ab
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
add dl, 0x3d
test esi, esi
jbe 0x40102d
mov eax, dword [esp + 8]
mov cl, byte [eax]
sub cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x401021
pop esi
ret

Function at 0x401030
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0x5ab
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
add dl, 0x3d
test esi, esi
jbe 0x40105d
mov eax, dword [esp + 8]
mov cl, byte [eax]
xor cl, dl
add cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x401051
pop esi
ret

Function at 0x4017a2
Capabilities:
Authenticate hmac

Disassembly:
mov al, 0x45
movzx edx, bl
push ecx
test eax, 0xa068b7c0
lea ebx, [0x4cd9da6b]
mov eax, esi
movzx edi, al
test dh, bl
movzx ebx, cx
mov esi, 0x8f65
imul ecx, ebx
xor esi, 0x342a
imul edi, esi, 0xd9726a71
push 0xa4dd08
ja 0x4017df
dec ebx
imul esi, ebp
mov edi, 0x79f4488a
dec ebx
and al, 0xcc
call 0x40180d
cmp edx, 0x7a97
jbe 0x4017f6
dec al
jne 0x401805
mov edi, 0x36057729
mov eax, 0x820a4dc5
dec ebx
dec cl
adc bl, bl
mov cl, ah
cmp edx, ebp
movsx ecx, si
xchg edx, ebx
inc ebp
movsx edx, bp
xchg bh, bh
or dh, 0x25
test ebx, ecx
js 0x401828
inc esi
mov dl, cl
imul ebp, esi, 0x8a3e844e
lea edi, [ebp]
sbb esi, 0xb8976a07
imul ebx, ebp
imul edx, ebp
inc edx
mov ebx, eax
mov ecx, edi
imul ebp, edi
cmp dl, 0x36
mov bh, al
xor eax, ecx
mov bl, ah
mov esi, 0xe299056c
pop ecx
mov bh, 0xc1
xor ah, 0x5c
mov al, 0x3a
mov al, 0x6a
and eax, 0xf76d991a
inc eax
imul ebp, ebx, 0x4b8465c8
dec esi
test edx, 0x934c0786
add bl, 0xcf
movzx ebx, ah
bnd jbe 0x40187c
movzx esi, dx
adc edi, eax
cmp ebp, ecx
jno 0x401888
push es
test dh, 0xbd
mov ah, 0x4e
mov bl, cl
add ecx, 0xb63d
test dh, 0xdf
sub eax, 0x77e46563
mov bh, 0xfc
sub ecx, 0xdce
sbb dh, ah
mov eax, eax
cmp ebp, ebx
add esi, 0x7ed92213
sbb eax, eax
imul edx, edi, 0xac7a6efe
imul esi, ecx, 0x50e78c2
cmp ebp, ebp
imul edx, edi, 0x59399d75
mov dl, dl
mov edi, ebp
lea ebp, [0x48440aa8]
or al, byte [eax + ecx*2 + 0x2b]
invalid
sbb bh, 0x3a
movsx ebx, si
dec bl
mov dl, 0xda
adc ebp, 0xa7e43b1f
dec esi
add eax, 0x8f2
test ch, 0xfe
lea ebp, [0xb4f0f6ec]
mov dh, 0xd6
sub eax, 0x8f1
mov esi, 0x435edaf3
xchg bl, bl
test al, cl
jae 0x401907
cmp edx, eax
or bl, 0x5b
imul edi, edx
add ebx, esi
cmp eax, 0xb5a
jb 0x4018cf
xchg edx, ebp
mov ebx, edx
dec bh
adc ebp, ecx
sub edi, 0xb9a39cc7
mov esi, esi
push ecx
cmp edx, 0xb8ca3c1f
test bh, 0xd9
or ah, bl
test ebp, 0xf151a72d
mov al, al
cmp ebp, ecx
jo 0x401947
lea edx, [0x858ff799]
mov dl, dl
sub ebx, 0x3968
xor ebp, 0xf526b6ee
add dl, bl
sub ebx, 0x695
jb 0x40196c
lea ebp, [0x6d9e0fcf]
sub dl, 0xb8
mov edi, 0x2764adc5
ret
Function at 0x40180d
Capabilities:
Authenticate hmac

Disassembly:
mov al, 0x45
movzx edx, bl
push ecx
test eax, 0xa068b7c0
lea ebx, [0x4cd9da6b]
mov eax, esi
movzx edi, al
test dh, bl
movzx ebx, cx
mov esi, 0x8f65
imul ecx, ebx
xor esi, 0x342a
imul edi, esi, 0xd9726a71
push 0xa4dd08
ja 0x4017df
dec ebx
imul esi, ebp
mov edi, 0x79f4488a
dec ebx
and al, 0xcc
call 0x40180d
cmp edx, 0x7a97
jbe 0x4017f6
dec al
jne 0x401805
mov edi, 0x36057729
mov eax, 0x820a4dc5
dec ebx
dec cl
adc bl, bl
mov cl, ah
cmp edx, ebp
movsx ecx, si
xchg edx, ebx
inc ebp
movsx edx, bp
xchg bh, bh
or dh, 0x25
test ebx, ecx
js 0x401828
inc esi
mov dl, cl
imul ebp, esi, 0x8a3e844e
lea edi, [ebp]
sbb esi, 0xb8976a07
imul ebx, ebp
imul edx, ebp
inc edx
mov ebx, eax
mov ecx, edi
imul ebp, edi
cmp dl, 0x36
mov bh, al
xor eax, ecx
mov bl, ah
mov esi, 0xe299056c
pop ecx
mov bh, 0xc1
xor ah, 0x5c
mov al, 0x3a
mov al, 0x6a
and eax, 0xf76d991a
inc eax
imul ebp, ebx, 0x4b8465c8
dec esi
test edx, 0x934c0786
add bl, 0xcf
movzx ebx, ah
bnd jbe 0x40187c
movzx esi, dx
adc edi, eax
cmp ebp, ecx
jno 0x401888
push es
test dh, 0xbd
mov ah, 0x4e
mov bl, cl
add ecx, 0xb63d
test dh, 0xdf
sub eax, 0x77e46563
mov bh, 0xfc
sub ecx, 0xdce
sbb dh, ah
mov eax, eax
cmp ebp, ebx
add esi, 0x7ed92213
sbb eax, eax
imul edx, edi, 0xac7a6efe
imul esi, ecx, 0x50e78c2
cmp ebp, ebp
imul edx, edi, 0x59399d75
mov dl, dl
mov edi, ebp
lea ebp, [0x48440aa8]
or al, byte [eax + ecx*2 + 0x2b]
invalid
sbb bh, 0x3a
movsx ebx, si
dec bl
mov dl, 0xda
adc ebp, 0xa7e43b1f
dec esi
add eax, 0x8f2
test ch, 0xfe
lea ebp, [0xb4f0f6ec]
mov dh, 0xd6
sub eax, 0x8f1
mov esi, 0x435edaf3
xchg bl, bl
test al, cl
jae 0x401907
cmp edx, eax
or bl, 0x5b
imul edi, edx
add ebx, esi
cmp eax, 0xb5a
jb 0x4018cf
xchg edx, ebp
mov ebx, edx
dec bh
adc ebp, ecx
sub edi, 0xb9a39cc7
mov esi, esi
push ecx
cmp edx, 0xb8ca3c1f
test bh, 0xd9
or ah, bl
test ebp, 0xf151a72d
mov al, al
cmp ebp, ecx
jo 0x401947
lea edx, [0x858ff799]
mov dl, dl
sub ebx, 0x3968
xor ebp, 0xf526b6ee
add dl, bl
sub ebx, 0x695
jb 0x40196c
lea ebp, [0x6d9e0fcf]
sub dl, 0xb8
mov edi, 0x2764adc5
ret
Function at 0xdea370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xdea38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xe13074
push ecx
mov edi, eax
call fcn.00dfe198
mov esi, eax
add esp, 8
test esi, esi
jne 0xdea3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00dfe02e
push esi
call fcn.00dfdfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret