joyce8/EMBER2024-capa huggingface dataset:
Function at 0x24ef2e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xffff
and eax, 0xffff
and eax, 0xff
and eax, 0xff
cmp eax, 6
jne 0x24ef64
mov ecx, dword [ebp + 8]
mov byte [ecx], 1
jmp 0x24ef70
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.0024f8e8
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x90d]
test ecx, ecx
je 0x24ef85
mov edx, dword [ebp + 8]
mov byte [edx], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [eax + 0x90c], dl
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x90c]
test ecx, ecx
jne 0x24efac
mov edx, dword [ebp - 8]
mov byte [edx + 0x810], 3
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x24fa38
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
mov ecx, 0x14
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
mov edi, 0x2d6b04
lea edx, [ebp - 0x50]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x54], 0
jmp 0x24fa83
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp + 0xc]
jge 0x24fad1
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x54]
movsx ecx, byte [eax]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x58]
push edx
call fcn.002a25dc
add esp, 4
test eax, eax
jne 0x24fab2
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x54]
mov byte [eax], 0
jmp 0x24fa7a
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x54]
mov dl, byte [ecx]
mov byte [ebp - 0x50], dl
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x54]
mov byte [ecx], al
jmp 0x24fa7a
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x264ed4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0x2c06d0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0
je 0x264f1c
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 4], al
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 0
mov esp, ebp
pop ebp
ret
Function at 0x27359b
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2bccf3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
push 0
mov ecx, dword [ebp - 0x10]
call fcn.002710de
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00270944
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00270973
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.002710de
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x1c]
imul eax, eax, 0x14
push eax
call fcn.002a4baa
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x30]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
push eax
call fcn.0026fcf6
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x274d80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2bce21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x30]
push ecx
call fcn.002a1bee
add esp, 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.002591a0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.002591a0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.002591a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.002591a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x27955e
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
cmp dword [ebp + 0xc], 0
jne 0x2795d0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x6a09e667
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xbb67ae85
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x3c6ef372
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0xa54ff53a
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x510e527f
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0x9b05688c
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], 0x1f83d9ab
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0x5be0cd19
jmp 0x279620
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0xc1059ed8
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x367cd507
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x3070dd17
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0xf70e5939
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], 0xffc00b31
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x68581511
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], 0x64f98fa7
mov edx, dword [ebp + 8]
mov dword [edx + 0x24], 0xbefa4fa4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0xe8], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x27df7b
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
cmp dword [ebp + 0x10], 0x40
jle 0x27dfb8
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x28]
call fcn.0027de04
mov ecx, dword [ebp + 0x14]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 0x20
mov dword [ebp + 0x10], ecx
lea edx, [ebp - 0x20]
mov dword [ebp + 0xc], edx
push 0x40
push 0x36
mov eax, dword [ebp + 8]
add eax, 0x68
push eax
call fcn.002a4930
add esp, 0xc
push 0x40
push 0x5c
mov ecx, dword [ebp + 8]
add ecx, 0xa8
push ecx
call fcn.002a4930
add esp, 0xc
mov dword [ebp - 0x24], 0
jmp 0x27dff3
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp + 0x10]
jge 0x27e043
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x24]
xor edx, edx
mov dl, byte [ecx + 0x68]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x24]
xor ecx, ecx
mov cl, byte [eax]
xor edx, ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x24]
mov byte [eax + 0x68], dl
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x24]
xor edx, edx
mov dl, byte [ecx + 0xa8]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x24]
xor ecx, ecx
mov cl, byte [eax]
xor edx, ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x24]
mov byte [eax + 0xa8], dl
jmp 0x27dfea
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x28]
call fcn.0027955e
push 0x40
mov eax, dword [ebp + 8]
add eax, 0x68
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.0027dba7
push 0x20
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.002a4930
add esp, 0xc
mov esp, ebp
pop ebp
ret 0x10
Function at 0x27e22d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov al, byte [ebp + 8]
mov byte [ebp - 4], al
mov ecx, dword [ebp - 4]
and ecx, 0xff
sar ecx, 4
mov edx, dword [ebp - 4]
and edx, 0xff
and edx, 0xf
cmp ecx, edx
jne 0x27e260
mov al, byte [ebp - 4]
xor al, 1
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp - 4]
mov byte [ecx], dl
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 4]
mov byte [eax + 1], cl
mov edx, dword [ebp + 0xc]
mov ax, word [edx]
add ax, 0x5053
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov byte [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.0027e1db
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov ecx, dword [ebp - 4]
and ecx, 0xff
test ecx, ecx
jne 0x27e285
mov esp, ebp
pop ebp
ret 8
Function at 0x289edf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x289f26
call fcn.0028e52e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x289f26
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x289f42
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00289a57
mov esi, eax
test edi, edi
je 0x289f40
test ebx, ebx
je 0x289f40
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x28a708
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x2bdc24
call fcn.002a56fd
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x28a72d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x28a773
lea ecx, [ebp - 0x10]
call fcn.00241930
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00289f49
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.002418f0
mov eax, esi
call fcn.002a57d5
ret 8

Function at 0x28f956
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x28f99e
call fcn.0028e52e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x28f99e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x28f9e1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x28f9ca
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x28f9ca
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x28f9de
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x2a105e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2da130]
jne 0x2a1068
repz ret
jmp fcn.002a7c71

Function at 0x2b2f00
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.002a75d5
and dword [ebp - 4], 0
cmp dword [0x2e3a24], 0
mov ebx, eax
jne 0x2b2fb1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x2b3062
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x2b3062
push eax
call fcn.002a7563
mov dword [esp], 0x2c7fe8
push edi
mov dword [0x2e3a24], eax
call esi
push eax
call fcn.002a7563
mov dword [esp], 0x2c7fd4
push edi
mov dword [0x2e3a28], eax
call esi
push eax
call fcn.002a7563
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x2e3a2c], eax
call esi
push eax
call fcn.002a7563
pop ecx
mov dword [0x2e3a34], eax
test eax, eax
je 0x2b2fb1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.002a7563
pop ecx
mov dword [0x2e3a30], eax
mov eax, dword [0x2e3a30]
cmp eax, ebx
je 0x2b3009
cmp dword [0x2e3a34], ebx
je 0x2b3009
push eax
call fcn.002a75de
push dword [0x2e3a34]
mov esi, eax
call fcn.002a75de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x2b3009
test edi, edi
je 0x2b3009
call esi
test eax, eax
je 0x2b3000
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x2b3000
test byte [ebp - 0xc], 1
jne 0x2b3009
or dword [ebp + 0x10], 0x200000
jmp 0x2b3042
mov eax, dword [0x2e3a28]
cmp eax, ebx
je 0x2b3042
push eax
call fcn.002a75de
pop ecx
test eax, eax
je 0x2b3042
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x2b3042
mov eax, dword [0x2e3a2c]
cmp eax, ebx
je 0x2b3042
push eax
call fcn.002a75de
pop ecx
test eax, eax
je 0x2b3042
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x2e3a24]
call fcn.002a75de
pop ecx
test eax, eax
je 0x2b3062
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x2b3064
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4018f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [edx + 0x14]
push esi
push edi
lea edi, [edx + 0x14]
mov dword [ebp - 8], edx
mov esi, ecx
cmp al, 0x22
jne 0x401a1a
mov eax, dword [edi + 1]
mov dword [esi + 0x3c], eax
movzx eax, word [edi + 5]
mov word [esi + 0x44], ax
movzx eax, word [edi + 7]
mov word [esi + 0x48], ax
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x13], eax
movzx eax, word [esi + 0x46]
push ebx
mov ebx, dword [sym.imp.MSVCR110.dll_malloc]
push 0x23
mov byte [ebp - 0x14], 0x1e
mov word [ebp - 0xf], ax
call ebx
mov edx, eax
add esp, 4
test edx, edx
je 0x401986
mov ecx, dword [ebp - 0x14]
mov al, byte [ebp - 0xe]
mov dword [edx + 0x1c], ecx
mov cx, word [ebp - 0x10]
mov word [edx + 0x20], cx
mov byte [edx + 0x22], al
mov ax, word [esi + 0x4a]
mov word [edx + 0x10], ax
inc word [esi + 0x4a]
mov word [edx + 0x12], 8
lea ecx, [esi + 0x18]
mov eax, 7
mov word [edx + 0x1a], ax
mov eax, dword [ecx + 4]
mov dword [eax], edx
mov dword [edx + 4], eax
mov dword [edx], ecx
mov dword [ecx + 4], edx
push 0x21
mov byte [ebp - 0x14], 6
call ebx
mov edx, eax
add esp, 4
test edx, edx
je 0x4019ce
mov ecx, dword [ebp - 0x14]
mov dword [edx + 0x1c], ecx
mov cl, byte [ebp - 0x10]
mov byte [edx + 0x20], cl
mov ax, word [esi + 0x4a]
mov word [edx + 0x10], ax
inc word [esi + 0x4a]
mov word [edx + 0x12], 8
lea ecx, [esi + 0x18]
mov eax, 5
mov word [edx + 0x1a], ax
mov eax, dword [ecx + 4]
mov dword [eax], edx
mov dword [edx + 4], eax
mov dword [edx], ecx
mov dword [ecx + 4], edx
push 0x1d
mov byte [ebp - 1], 0x29
call ebx
add esp, 4
mov edx, eax
pop ebx
test edx, edx
je 0x401a11
mov al, byte [ebp - 1]
mov byte [edx + 0x1c], al
mov cx, word [esi + 0x4a]
mov word [edx + 0x10], cx
inc word [esi + 0x4a]
mov word [edx + 0x12], 8
lea ecx, [esi + 0x18]
mov eax, 1
mov word [edx + 0x1a], ax
mov eax, dword [ecx + 4]
mov dword [eax], edx
mov dword [edx + 4], eax
mov dword [edx], ecx
mov dword [ecx + 4], edx
mov dword [esi + 0x28], 5
jmp 0x401a3e
cmp al, 6
jne 0x401a41
mov eax, dword [edi + 1]
mov dword [ebp - 0x13], eax
mov eax, dword [esi + 0x6c]
sub esp, 8
lea edx, [ebp - 0x14]
push 9
mov byte [ebp - 0x14], 9
mov dword [ebp - 0xf], eax
call fcn.00401e00
add esp, 0xc
mov edx, dword [ebp - 8]
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x401a57
movzx eax, word [edx + 0x12]
push eax
mov eax, dword [ecx + 4]
push edi
push esi
call eax
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, edx
push edi
cmp byte [esi + 0x14], 0x14
mov edi, ecx
jne 0x401ab1
mov eax, dword [edi + 0x78]
test eax, eax
je 0x401aae
cmp dword [eax + 8], 0
je 0x401aae
movzx eax, word [esi + 0x12]
inc eax
push ebx
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x401aad
mov edx, ebx
mov ecx, esi
call fcn.00401660
mov ecx, dword [edi + 0x78]
push eax
mov eax, dword [ecx + 8]
push ebx
push edi
call eax
push ebx
call dword [sym.imp.MSVCR110.dll_free]
add esp, 0x10
pop ebx
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.004018f0
Function at 0x402810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ecx]
push esi
push edi
lea edi, [edx - 1]
push edi
lea eax, [ecx + 1]
push eax
push 0x407908
xor esi, esi
call sub.MSVCR110.dll_memcpy
mov dl, byte [ebp + 8]
add esp, 0xc
xor dl, 0xaa
xor eax, eax
test edi, edi
jle 0x40286a
jmp 0x402840
test esi, esi
jne 0x40284b
mov esi, 1
jmp 0x402852
xor byte [eax + 0x407908], dl
dec esi
movzx ecx, byte [eax + 0x407908]
inc eax
mov cl, byte [ecx + 0x407380]
mov byte [eax + 0x407907], cl
cmp eax, edi
jl 0x402840
xor dl, dl
xor ecx, ecx
test edi, edi
jle 0x402881
mov al, byte [ecx + 0x407908]
and al, 0x55
inc ecx
xor dl, al
cmp ecx, edi
jl 0x402872
pop edi
xor eax, eax
cmp dl, bl
pop esi
setne al
pop ebx
pop ebp
ret

Function at 0x402e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x10
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
mov edi, dword [ebp + 0xc]
mov ecx, dword [sym.imp.MSVCR110.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x402eee
mov eax, 1
cmp edi, eax
jle 0x402ebc
lea esp, [esp]
xor byte [eax + 0x419910], 4
inc eax
cmp eax, edi
jl 0x402eb0
mov al, byte [0x419910]
mov byte [ebx], al
mov eax, dword [0x419911]
lea esi, [edi - 5]
push esi
mov dword [ebx + 1], eax
mov dword [ebx + 8], esi
call ecx
push esi
push 0x419915
push eax
mov dword [ebx + 0xc], eax
call sub.MSVCR110.dll_memcpy
mov ecx, dword [sym.imp.MSVCR110.dll_malloc]
add esp, 0x10
jmp 0x402ef0
xor ebx, ebx
lea eax, [edi - 5]
push eax
call ecx
mov esi, dword [ebp + 0x14]
add esp, 4
mov edi, eax
push esi
push edi
mov ecx, ebx
call fcn.00402c70
push dword [esi]
push edi
push dword [ebp + 0x10]
call sub.MSVCR110.dll_memcpy
mov esi, dword [sym.imp.MSVCR110.dll_free]
push edi
call esi
add esp, 0x10
test ebx, ebx
je 0x402f31
push dword [ebx + 0xc]
call esi
push ebx
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x403860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov ecx, dword [edx]
mov eax, dword [ebx + 4]
push esi
mov esi, dword [ebx]
mov dword [ebp - 0x14], ebx
mov ebx, dword [edx + 8]
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [edx + 4]
mov edx, dword [edx + 0xc]
xor edi, edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
lea ebx, [edi + 0x20]
nop
mov edx, eax
shr edx, 5
add edx, ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [ebp - 4]
lea edi, [edi - 0x61c88647]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
add esi, edx
mov edx, esi
shr edx, 5
add edx, dword [ebp - 8]
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
mov ecx, dword [ebp - 0x10]
add eax, edx
dec ebx
jne 0x403890
mov ebx, dword [ebp - 0x14]
pop edi
mov dword [ebx], esi
pop esi
mov dword [ebx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5077bc
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0050783b
jae 0x5077c8
xor ecx, ecx
call fcn.0050783b
jae 0x5077f2
xor eax, eax
call fcn.0050783b
jae 0x507803
mov al, 0x10
call fcn.0050783b
adc al, al
jae 0x5077e4
jne 0x507830
stosb byte es:[edi], al
jmp 0x5077c9
call fcn.00507847
dec ecx
loop 0x50780f
mov eax, ebp
call fcn.00507845
jmp 0x507831
lodsb al, byte [esi]
shr eax, 1
je 0x507857
adc ecx, 2
mov ebp, eax
jmp 0x507831
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00507845
cmp eax, 0x7d00
jae 0x50782f
cmp eax, 0x500
jae 0x507830
cmp eax, 0x7f
ja 0x507831
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5077c9
pop ebp
ret 8
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40c302
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40c311
pop dword [ebp - 0x30]
mov eax, 0x17404944
add eax, 0xe90079cd
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3530e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x368e
xor esi, esi
add esi, eax
mov edi, 0xd3bf0c92
add edi, 0x2c822f32
add edi, dword [ebp - 0x30]
mov ebx, 0xf51ce112
add ebx, 0x76e7d5d9
sub dword [ebp - 0x10], edi
mov edx, dword [edi]
sub dword [ebp - 4], 0x79787817
xor edx, ebx
xor dword [ebp - 0xc], ecx
mov dword [esi], edx
add dword [ebp - 0x18], 0x26495f9f
add esi, 4
add edi, 0x2315d481
sub edi, 0x2315d47d
loop 0x40c367
add eax, 0x24603079
add eax, 0xdba09c92
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7e07afb9
add ecx, 0x82385047
add ecx, dword [ebp - 0x30]
call ebx
leave
ret