joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411b8a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1190
call fcn.00415f30
and byte [ebp - 0x96c], 0
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov edx, 0x208
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x96b]
and byte [ebp - 0x1190], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x118f]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push str.SOFTWARENetscapeNetscape_NavigatorProxy_Information
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x411d58
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push str.Proxy_Type
push dword [ebp - 4]
mov dword [ebp - 0x48], str.http
mov dword [ebp - 0x44], str.HTTP_Proxy
mov dword [ebp - 0x40], str.HTTP_ProxyPort
mov dword [ebp - 0x3c], str.https
mov dword [ebp - 0x38], str.HTTPS_Proxy
mov dword [ebp - 0x34], str.HTTPS_ProxyPort
mov dword [ebp - 0x30], str.ftp
mov dword [ebp - 0x2c], str.FTP_Proxy
mov dword [ebp - 0x28], str.FTP_ProxyPort
mov dword [ebp - 8], 4
call ebx
test eax, eax
jne 0x411d58
cmp dword [ebp - 0x14], 1
jne 0x411d58
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edi, [ebp - 0x48]
mov dword [ebp - 0xc], 3
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x100
push eax
lea eax, [ebp - 0x148]
push eax
push 0
push 0
push dword [edi + 4]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x411d1b
cmp byte [ebp - 0x148], al
je 0x411d1b
push dword [edi]
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push dword [edi + 8]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x411d0d
lea eax, [ebp - 0x96c]
push 0x4265a0
push eax
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x96c]
push 0x425c7c
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x96c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x96c]
push 0x42603c
push eax
call esi
add edi, 0xc
dec dword [ebp - 0xc]
jne 0x411c71
lea eax, [ebp - 0x96c]
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1190]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push 0x26
mov dword [ebp - 0x24], 3
push dword [eax + 4]
call fcn.00411358
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], esi
je 0x411d66
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412cdf
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0xf4]
cmp eax, 0x7530
jbe 0x412d42
mov ecx, dword [esi + 0xe8]
lea eax, [esi + 0xe8]
mov edx, dword [esi + 0xf0]
mov dword [esi + 0xdc], ecx
xor ecx, ecx
mov dword [esi + 0xe4], edx
mov dword [eax], ecx
lea eax, [esi + 0xf0]
mov edx, dword [esi + 0xec]
mov dword [esi + 0xec], ecx
mov dword [eax], ecx
lea eax, [esi + 0xec]
mov dword [esi + 0xe0], edx
call edi
mov dword [esi + 0xf4], eax
mov edi, dword [esi + 0xe4]
test edi, edi
jne 0x412d54
mov eax, dword [esi + 0xdc]
jmp 0x412dac
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x412daa
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0xdc]
cmp ebx, eax
jbe 0x412d82
shr ebx, 1
shr edi, 1
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe4], edi
mov eax, dword [esi + 0xdc]
mov edi, dword [esi + 0xe4]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x412d5d
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x41354f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x4135a1
push eax
call fcn.004158d7
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4135a1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x425d74
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4135a5
xor al, al
jmp 0x413606
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x413604
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.004158d7
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x413604
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x4135f2
mov al, 1
pop ebx
leave
ret 4
Function at 0x41ce19
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x429260
cmp edx, dword [eax]
je 0x41ce3b
add eax, 8
inc ecx
cmp eax, 0x4292f0
jl 0x41ce2c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x429260]
jne 0x41cf69
mov eax, dword [0x42c9e0]
cmp eax, 1
je 0x41cf43
test eax, eax
jne 0x41ce6c
cmp dword [0x4269b4], 1
je 0x41cf43
cmp edx, 0xfc
je 0x41cf69
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41cea3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004157c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004161e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41cee6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004161e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42205c
push edi
call fcn.004160a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004157c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004157d0
lea eax, [ebp - 0xa0]
push 0x42203c
push eax
call fcn.004157d0
push dword [esi + 0x429264]
lea eax, [ebp - 0xa0]
push eax
call fcn.004157d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041e74b
add esp, 0x2c
pop edi
jmp 0x41cf69
lea eax, [ebp + 8]
lea esi, [esi + 0x429264]
push 0
push eax
push dword [esi]
call fcn.004161e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1000b700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8

Function at 0x1000b800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1000b80f
pop dword [ebp - 0x38]
mov eax, 0x43139c79
add eax, 0xcced1b96
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xf127a04f
sub dword [ebp - 0x48], 0xa2d55b04
mov dword [ebp - 0x44], 0xdde98c75
sub dword [ebp - 0x44], 0xabb64030
mov dword [ebp - 0x40], 0xabbc785a
sub dword [ebp - 0x40], 0x5f70342c
mov dword [ebp - 0x3c], 0x61e2c829
add dword [ebp - 0x3c], 0x9e1d37d7
lea eax, [ebp - 0x48]
push eax
mov eax, 0x1598fe10
add eax, 0xfa67f2a0
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x1328ce9b
sub dword [ebp - 0x48], 0x9eb66545
mov dword [ebp - 0x44], 0x186dccfb
add dword [ebp - 0x44], 0x28fe947a
mov dword [ebp - 0x40], 0xe0f7f1d1
sub dword [ebp - 0x40], 0x7d888565
mov dword [ebp - 0x3c], 0xcd24555e
add dword [ebp - 0x3c], 0x32dbaaa2
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36a35
push 0
call eax
mov ecx, 0x3f82
mov ebx, eax
mov edi, 0x63cbe7b
sub edi, 0xf63a867b
add edi, dword [ebp - 0x38]
mov edx, 0x87ce7989
add edx, 0x297891
xor dword [ebp - 4], edx
mov esi, dword [edi]
add dword [ebp - 4], 0xea6f4863
xor esi, edx
sub dword [ebp - 8], 0xfb544835
mov dword [ebx], esi
sub dword [ebp - 8], 0x544f9d1d
add ebx, 0x35d8e13d
add ebx, 0xca271ec7
add edi, 4
loop 0x1000b926
add eax, 0x9b5f7d94
add eax, 0x64a17347
xor ebx, ebx
add ebx, eax
add eax, 0xb8563165
sub eax, 0xb8563160
mov ecx, 0x6d973ba2
add ecx, 0xa268c45e
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040f646
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040f646
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0040f646
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret
Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c

Function at 0x40f646
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40f655
pop dword [ebp - 0x14]
mov eax, 0x3d56a682
sub eax, 0x3d15b02d
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x8d81fab8
add dword [ebp - 0x24], 0xc0d04a93
mov dword [ebp - 0x20], 0x8fd8f2f5
sub dword [ebp - 0x20], 0x5da5a6b0
mov dword [ebp - 0x1c], 0xba362b6c
add dword [ebp - 0x1c], 0x921618c2
mov dword [ebp - 0x18], 0xec50f132
sub dword [ebp - 0x18], 0xec50f132
lea eax, [ebp - 0x24]
push eax
mov eax, 0x40e55515
add eax, 0xbf5c6b3b
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xcf76675b
add dword [ebp - 0x24], 0xa4fc01fb
mov dword [ebp - 0x20], 0xe115d0f3
sub dword [ebp - 0x20], 0x9fa96f7e
mov dword [ebp - 0x1c], 0x4900b23e
add dword [ebp - 0x1c], 0x1a6eba2e
mov dword [ebp - 0x18], 0x215e97d6
sub dword [ebp - 0x18], 0x215e97d6
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xf08f064f
add eax, 0xfb2b9fd
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3b1c7
push 0
call eax
mov ecx, 0x7e682cfa
sub ecx, 0x7e67e6df
xor ebx, ebx
add ebx, eax
mov edi, 0xac651e3
sub edi, 0xa8327e3
add edi, dword [ebp - 0x14]
mov edx, 0x2cde2552
add edx, 0x4d792fa6
sub dword [ebp - 8], 0x36896fa5
mov esi, dword [edi]
add dword [ebp - 0x10], 0xfa93b04f
sub esi, edx
add dword [ebp - 4], ecx
mov dword [ebx], esi
xor dword [ebp - 8], eax
add ebx, 0x7090bb
add ebx, 0xff8f6f49
add edi, 4
loop 0x40f779
add eax, 0x10b3f
xor ebx, ebx
add ebx, eax
add eax, 0xaa1b856b
add eax, 0x55e47a9a
mov ecx, 0x2ddfd2bd
sub ecx, 0x2d9fd2bd
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10006b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10006b3f
pop dword [ebp - 0x18]
mov eax, 0x10006b3f
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x6076a3fa
add dword [ebp - 0x28], 0xeddba151
mov dword [ebp - 0x24], 0x7df3993f
sub dword [ebp - 0x24], 0x4bc04cfa
mov dword [ebp - 0x20], 0x93309d96
sub dword [ebp - 0x20], 0x46e45968
mov dword [ebp - 0x1c], 0x6cde601d
sub dword [ebp - 0x1c], 0x6cde601d
lea eax, [ebp - 0x28]
push eax
mov eax, 0x5f03b9c1
add eax, 0xb103474b
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2e51e3ae
sub dword [ebp - 0x28], 0xb9df7a58
mov dword [ebp - 0x24], 0xbcb44f67
sub dword [ebp - 0x24], 0x7b47edf2
mov dword [ebp - 0x20], 0x27af3ae6
sub dword [ebp - 0x20], 0xc43fce7a
mov dword [ebp - 0x1c], 0x27950b74
add dword [ebp - 0x1c], 0xd86af48c
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x669f6
push 0
call eax
mov ecx, 0x5d00834c
sub ecx, 0x5d003de2
mov edi, eax
mov ebx, 0x43f6fa49
sub ebx, 0x33eeae49
add ebx, dword [ebp - 0x18]
mov esi, 0x6bb1bba0
sub esi, 0x1db68e03
mov edx, dword [ebx]
mov dword [ebp - 4], 0x1ceac186
xor edx, esi
add dword [ebp - 0xc], ecx
mov dword [edi], edx
sub dword [ebp - 4], edi
add edi, 0xa6d0117c
sub edi, 0xa6d01178
add ebx, 0xd8607bb8
sub ebx, 0xd8607bb4
loop 0x10006c57
add eax, 0xa4dd888e
sub eax, 0xa4dc8013
xor ebx, ebx
add ebx, eax
add eax, 0xc9e6885
add eax, 0xf3619780
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0
Function at 0x417d34
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00417db3
jae 0x417d40
xor ecx, ecx
call fcn.00417db3
jae 0x417d6a
xor eax, eax
call fcn.00417db3
jae 0x417d7b
mov al, 0x10
call fcn.00417db3
adc al, al
jae 0x417d5c
jne 0x417da8
stosb byte es:[edi], al
jmp 0x417d41
call fcn.00417dbf
dec ecx
loop 0x417d87
mov eax, ebp
call fcn.00417dbd
jmp 0x417da9
lodsb al, byte [esi]
shr eax, 1
je 0x417dcf
adc ecx, 2
mov ebp, eax
jmp 0x417da9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00417dbd
cmp eax, 0x7d00
jae 0x417da7
cmp eax, 0x500
jae 0x417da8
cmp eax, 0x7f
ja 0x417da9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x417d41
pop ebp
ret 8

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40633c
pop dword [ebp - 8]
mov eax, 0xcdc931c8
sub eax, 0xcd88ce8c
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x1dd6a532
sub dword [ebp - 0x18], 0xcf845fe7
mov dword [ebp - 0x14], 0x694a958
add dword [ebp - 0x14], 0x2b9ea2ed
mov dword [ebp - 0x10], 0x43db17f4
sub dword [ebp - 0x10], 0xf78ed3c6
mov dword [ebp - 0xc], 0x11b1df5d
add dword [ebp - 0xc], 0xee4e20a3
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x5f8b1531
add dword [ebp - 0x18], 0x14e75425
mov dword [ebp - 0x14], 0xf08fc5ff
add dword [ebp - 0x14], 0x50dc9b76
mov dword [ebp - 0x10], 0xe1d09731
add dword [ebp - 0x10], 0x819ed53b
mov dword [ebp - 0xc], 0x59cced2a
sub dword [ebp - 0xc], 0x59cced2a
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x38615
push 0
call eax
mov ecx, 0x4f0c
mov edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 8]
mov esi, 0xf56518d6
xor dword [ebp - 4], ebx
mov edx, dword [ebx]
sub dword [ebp - 4], 0x4b81f7b3
xor edx, esi
sub dword [ebp - 4], edi
mov dword [edi], edx
xor dword [ebp - 4], 0x5b59240b
add edi, 0xcf1eb870
add edi, 0x30e14794
add ebx, 0xcd18299f
sub ebx, 0xcd18299b
loop 0x406442
add eax, 0x12f03
mov ebx, eax
add eax, 0x4fdca068
add eax, 0xb0235f9d
mov ecx, 0xe8546321
add ecx, 0x17eb9cdf
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4004736
Capabilities:
Terminate process

Disassembly:
call fcn.04009910
push 0
push ebp
push ebp
lea ebp, [esp + 4]
mov byte [0x401c794], 0
push 0x401a17c
push 0x100
push 0
call fcn.0400da5a
mov esi, 0x401a16c
call fcn.0400e2f0
push 0x401a008
mov esi, 0x401a16c
mov edi, dword [esi]
call dword [edi + 0x14]
mov dword [0x401c750], 0x401a008
call fcn.04002927
call fcn.04004fa0
mov ebx, dword [0x401c750]
mov byte [ebx + 0x3a], 0
cmp eax, 0
je 0x4004836
push 0
push 0
push 0
push 0x401c754
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40047f2
push 0x401c754
push dword [0x401c740]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x400479b
push 0x401c754
push dword [0x401c748]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x400479b
push 0x401c754
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x401c754
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x400479b
mov ebx, dword [0x401c750]
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x401c744]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [0x401c74c]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov esi, dword [0x401c750]
push dword [esi + 0xc]
call fcn.04008750
mov esi, 0x401a16c
mov edi, dword [esi]
call dword [edi + 0x1c]
mov eax, dword [0x401c75c]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x4009d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push eax
push ecx
push ebx
pushfd
cld
mov ebx, dword [ebp + 8]
mov eax, dword [ebx - 8]
mov dword [ebp - 4], eax
inc eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
cmp eax, dword [ebp - 4]
je 0x4009dbf
mov dword [ebx - 4], eax
popfd
pop ebx
pop ecx
pop eax
leave
ret 4
lea ecx, [0x4009ddc]
mov edi, 0xdf
mov eax, 1
call fcn.040099a0
sldt word [eax]

Function at 0x400a040
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push eax
push esi
push edi
push ecx
pushfd
cld
xor eax, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x400a076
test edi, edi
je 0x400a076
mov ecx, dword [edi - 4]
lea ecx, [0x400a094]
mov edi, 0x5c
mov eax, 0xa
call fcn.040099a0
nop
sldt word [eax]
add byte [edi], cl
add byte [eax], al