joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4225e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x42260e
push 0
push str.ERROR_
push str.Empty_options_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0043649b
add esp, 0xc
test eax, eax
je 0x422643
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 4]
mov eax, 0x8d3dcb09
sub ecx, dword [ebx]
imul ecx
push esi
add edx, ecx
xor ecx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, 0x74
mov dword [ebp + 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00423c85
imul ecx, dword [ebp + 0xc], 0x74
mov esi, eax
mov dword [ebp - 8], esi
push ecx
push 0
push esi
call fcn.00425630
mov edx, dword [ebx]
add esp, 0x10
cmp edx, dword [ebx + 4]
je 0x4226ae
mov eax, esi
push edi
mov esi, edx
mov edi, eax
mov ecx, 0x1d
add edx, 0x74
rep movsd dword es:[edi], dword [esi]
add eax, 0x74
cmp edx, dword [ebx + 4]
jne 0x422694
mov esi, dword [ebp - 8]
pop edi
imul eax, dword [ebp + 0xc], 0x74
push 0xe2f1
push eax
push esi
call fcn.00422bb0
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
push 1
push 4
push eax
call fcn.00436e0a
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x74
push esi
call fcn.00436e0a
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push 1
push 4
push eax
call fcn.00436e0a
push 0x74
push esi
call fcn.00423c77
add esp, 0x44
push dword [ebp - 4]
call fcn.004365a5
add esp, 4
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4229a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 2
push 0
push edi
call fcn.0044890e
push edi
call fcn.00449096
push 0
push 0
push edi
mov ebx, eax
call fcn.0044890e
push ebx
call fcn.00423c85
push ebx
mov esi, eax
call fcn.00423c85
push edi
push 1
push ebx
push esi
mov dword [ebp - 0x10c], eax
call fcn.004369f9
push ebx
push esi
mov esi, dword [ebp - 0x10c]
push esi
call fcn.00422a70
add esp, 0x40
push ebx
push esi
call fcn.004234c0
lea eax, [ebp - 0x108]
push eax
call fcn.00404e40
add esp, 0xc
test eax, eax
jne 0x422a46
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424075
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00422b00
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00424075
mov esp, ebp
pop ebp
ret
Function at 0x422a70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x422a9a
mov eax, dword [ebp + 0x10]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424075
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x14], 0xf65273d1
mov bl, 0x5e
mov dword [ebp - 0x10], 0x27cb9ad2
mov dword [ebp - 0xc], 0x3159af3e
mov dword [ebp - 8], 0xa2e7b337
test edi, edi
jle 0x422ae8
mov ecx, dword [ebp + 0xc]
sub esi, ecx
mov eax, edx
lea ecx, [ecx + 1]
and eax, 0xf
inc edx
mov al, byte [ebp + eax - 0x14]
xor al, byte [ecx - 1]
sub al, bl
mov byte [esi + ecx - 1], al
mov bl, byte [ecx - 1]
add bl, 0x3d
cmp edx, edi
jl 0x422ac8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00424075
mov esp, ebp
pop ebp
ret

Function at 0x422b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push 0x46e280
push dword [ebp + 8]
push eax
call fcn.0043649b
add esp, 0xc
test eax, eax
jne 0x422ba3
push esi
push dword [ebp - 8]
lea eax, [ebp - 4]
mov word [ebp - 4], 0xff00
push 1
push 3
push eax
mov byte [ebp - 2], 0xff
call fcn.00436e0a
mov esi, dword [ebp + 0xc]
add esp, 0x10
cmp dword [ebp + 0x10], 0x20004
mov eax, esi
jne 0x422b6f
push 0x10000
call fcn.00423c85
add esp, 4
xor edx, edx
nop dword [eax]
mov cl, byte [esi + edx*2]
mov byte [edx + eax], cl
inc edx
cmp edx, 0x10000
jl 0x422b60
push dword [ebp - 8]
push 1
push 0x10000
push eax
call fcn.00436e0a
push dword [ebp - 8]
call fcn.004365a5
add esp, 0x14
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4234c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x4234f0
push edi
mov edi, dword [ebp + 8]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov al, byte [edx + 0x485304]
xor byte [ecx + edi], al
inc ecx
cmp ecx, esi
jl 0x4234d1
pop edi
pop esi
pop ebp
ret

Function at 0x451aa4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045169c

Function at 0x459134
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00458af2

Function at 0x45b133
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045b007
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x414dd7
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], ebx
or eax, eax
add eax, 0x76015a2a
add edi, 4
add edx, 0xce07c8f
cmp edi, ecx
jne fcn.00414dd7
ret
Function at 0x401bc2
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4289bf
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x43c060]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 0x10]
lea ecx, [esp + 0x10]
call fcn.00402c98
and dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.00401b61
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.004032ac
mov dword [esi], vtable.std::system_error.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402ad7
Capabilities:
Create directory
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x428b35
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x43c060]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c060]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00402a46
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0xc4], ebx
call fcn.00407199
mov byte [esp + 0xc4], 1
lea ecx, [esp + 0x80]
mov edx, eax
mov dword [esp], 0x430df8
call fcn.004070ab
pop ecx
push ebx
push 1
lea ecx, [esp + 0x54]
call fcn.004032ac
push ebx
push 1
lea ecx, [esp + 0x24]
mov byte [esp + 0xc8], 4
call fcn.004032ac
cmp dword [esp + 0x90], 0x10
lea eax, [esp + 0x7c]
push ebx
cmovae eax, dword [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 7
pop ecx
mov esi, str.XQNwiRxOk8CloCQzZemLYk3sDTIT3y
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x94]
mov ebx, eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.004022c6
lea eax, [esp + 0x94]
push eax
push 0x430f8c
call fcn.00408acc
pop ecx
pop ecx
lea eax, [esp + 0x94]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test ebx, ebx
je 0x402bea
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x68]
call fcn.00402c73
xor ebx, ebx
inc ebx
jmp 0x402bfb
push 0x430b49
lea ecx, [esp + 0x38]
call fcn.00402c98
push 2
pop ebx
push eax
mov ecx, ebp
call fcn.00402cc7
or ebx, 4
test bl, 2
je 0x402c1b
push 0
push 1
lea ecx, [esp + 0x3c]
and ebx, 0xfffffffd
call fcn.004032ac
test bl, 1
je 0x402c2d
push 0
push 1
lea ecx, [esp + 0x6c]
call fcn.004032ac
push 0
push 1
lea ecx, [esp + 0x84]
call fcn.004032ac
mov eax, ebp
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00407db1
add esp, 0xb0
ret
Function at 0x407c60
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43c060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x10]
lea eax, [edi + 2]
push eax
call fcn.00408724
add esp, 4
mov ebx, eax
cmp dword [esi + 0x14], 0x10
jb 0x407c8e
mov esi, dword [esi]
push esi
lea eax, [edi + 1]
push eax
push ebx
call fcn.00408f0d
mov word [ebx + edi], 0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x20], xmm0
add esp, 0xc
mov eax, 0x614
movq qword [ebp - 0x10], xmm0
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
mov word [ebp - 8], 0
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x12], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push ebx
mov esi, eax
call fcn.00408b7b
mov ecx, dword [ebp - 4]
add esp, 4
xor eax, eax
test esi, esi
sete al
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00407db1
mov esp, ebp
pop ebp
ret

Function at 0x407d10
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43c060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x43102c
push 0x5780
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
xor ecx, ecx
test esi, esi
je 0x407d72
lea esp, [esp]
movzx edx, byte [ecx + edi]
mov dl, byte [edx + 0x43d5e0]
mov byte [ecx + edi], dl
inc ecx
cmp ecx, esi
jb 0x407d60
cmp dword [ebx + 0x14], 0x10
jb 0x407d7a
mov ebx, dword [ebx]
push 0x431030
lea eax, [ebp - 8]
push ebx
push eax
call fcn.00409026
push dword [ebp - 8]
push 1
push esi
push edi
call fcn.004091c4
push dword [ebp - 8]
call fcn.004092b2
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00407db1
mov esp, ebp
pop ebp
ret
Function at 0x41775c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43c060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040eaa0
mov dword [ebp - 0x14], eax
cmp dword [0x43eb30], esi
jne 0x41784f
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4177dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41792f
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41792f
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41792f
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43eb30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43eb34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43eb38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43eb40], eax
test eax, eax
je 0x41784c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43eb3c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x417874
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x417867
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x417889
push 4
pop eax
jmp 0x417931
cmp dword [ebp - 0x14], esi
je 0x417889
push dword [0x43eb30]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41786e
mov eax, dword [0x43eb3c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4178e7
cmp dword [0x43eb40], edi
je 0x4178e7
push eax
call ebx
push dword [0x43eb40]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4178e7
test eax, eax
je 0x4178e7
call ecx
test eax, eax
je 0x4178dc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4178dc
test byte [ebp - 8], 1
jne 0x4178e7
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x417917
mov eax, dword [0x43eb34]
cmp eax, edi
je 0x417914
push eax
call ebx
test eax, eax
je 0x417914
call eax
mov esi, eax
test esi, esi
je 0x417914
mov eax, dword [0x43eb38]
cmp eax, edi
je 0x417914
push eax
call ebx
test eax, eax
je 0x417914
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43eb30]
call ebx
test eax, eax
je 0x41792f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x417931
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407db1
mov esp, ebp
pop ebp
ret
Function at 0x41e8ee
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x429169
call fcn.00423701
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x41e9e6
cmp byte [esi + 0x46], bl
je 0x41e9e6
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x41e92a
xor al, al
jmp 0x41e9e8
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00406092
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x41e957
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41e97e
dec eax
je 0x41e982
dec eax
dec eax
je 0x41e9d4
xor bl, bl
jmp 0x41e9d6
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x41e992
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x41e9ba
cmp eax, 0x10
jae 0x41e9a1
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call fcn.004091c4
add esp, 0x10
cmp ebx, eax
jne 0x41e97a
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x41e9d4
test ebx, ebx
jne 0x41e94b
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.00406031
jmp 0x41e945
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004032ac
mov al, bl
jmp 0x41e9e8
mov al, 1
call fcn.004236b0
ret
Function at 0x10002250
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x14]
cmp edi, 0x3fffffff
jae 0x10002367
lea ecx, [edi + 2]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax*4 + 1]
cmp dword [ebp + 0xc], eax
jl 0x10002367
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
cmp edi, 3
jle 0x10002308
lea ecx, [edi - 4]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 4], eax
lea eax, [eax + eax*2]
sub edi, eax
mov dword [ebp + 0x14], edi
mov edi, dword [ebp - 4]
nop
push dword [ebx]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, eax
add ebx, 3
shr eax, 0x1a
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
mov eax, ecx
shr eax, 0x14
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
mov eax, ecx
shr eax, 0xe
and eax, 0x3f
shr ecx, 8
and ecx, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], al
add esi, 4
sub edi, 1
jne 0x100022b0
mov edi, dword [ebp + 0x14]
xor edx, edx
test edi, edi
je 0x10002347
lea ecx, [edi*8]
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
shl edx, 8
add edx, eax
sub edi, 1
jne 0x10002315
test ecx, ecx
jle 0x10002347
shl edx, 6
nop dword [eax]
mov eax, edx
shr eax, cl
sub ecx, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
test ecx, ecx
jg 0x10002330
mov eax, dword [ebp + 8]
mov ecx, esi
sub ecx, eax
test cl, 3
je 0x1000235d
mov byte [esi], 0x3d
inc ecx
inc esi
test cl, 3
jne 0x10002353
mov byte [esi], 0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10002c50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
movups xmmword [eax + 0x58], xmm0
movups xmmword [eax + 0x68], xmm0
movups xmmword [eax + 0x78], xmm0
movups xmmword [eax + 0x88], xmm0
mov byte [eax + 0x58], 0x80
pop ebp
ret

Function at 0x10024474
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10023c4e

Function at 0x1002447f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10023e89

Function at 0x10034892
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10034619
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x416900
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0041698f
jae 0x41690e
xor ecx, ecx
call fcn.0041698f
jae 0x41693d
xor eax, eax
call fcn.0041698f
jae 0x41694d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0041698f
adc al, al
jae 0x41692f
jne 0x416979
stosb byte es:[edi], al
jmp 0x416911
call fcn.0041699b
sub ecx, ebx
jne 0x416956
call fcn.00416999
jmp 0x416975
lodsb al, byte [esi]
shr eax, 1
je 0x416983
adc ecx, ecx
jmp 0x416972
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00416999
cmp eax, 0x7d00
jae 0x416972
cmp ah, 5
jae 0x416973
cmp eax, 0x7f
ja 0x416974
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416911
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x55a870de
nop
nop
nop
nop
nop
xor dword [eax - 0x6f07fe70], edx
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x484374d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219