joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1450
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x20
mov eax, dword [0x573080]
xor eax, esp
mov dword [esp + 0x1c], eax
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4d1487
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004d5b75
add esp, 0x20
ret
push esi
push 0x14
push 0x541248
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
je 0x4d14e4
lea eax, [esp + 8]
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x10], xmm0
movq qword [esp + 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4d14e1
cmp dword [esp + 0xc], 4
je 0x4d14fb
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4d14fb
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004d5b75
add esp, 0x20
ret
push esi
call edi
mov ecx, dword [esp + 0x24]
xor eax, eax
pop esi
pop edi
xor ecx, esp
call fcn.004d5b75
add esp, 0x20
ret

Function at 0x4d1720
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4d456c
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x51ccdc
call fcn.004d67b7
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x4d46a1
cmp byte [edi + 0x3e], bl
je 0x4d46a1
mov eax, dword [edi]
mov ecx, 0xffff
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x51e29c]
mov ecx, edi
call esi
mov ecx, 0xffff
cmp cx, ax
jne 0x4d45b9
xor al, al
jmp 0x4d46a3
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00453828
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x4d45ee
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d45f8
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call dword [0x51e29c]
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x4d4628
sub eax, 1
jne 0x4d4686
mov edi, dword [ebp - 0x30]
jmp 0x4d462e
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3e], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d463e
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x4d4668
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d464f
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.004e48c7
add esp, 0x10
cmp esi, eax
jne 0x4d4691
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3e], 0
je 0x4d468f
test esi, esi
jne 0x4d45e0
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.00453739
jmp 0x4d45da
dec eax
sub eax, 1
jne 0x4d4695
inc eax
jmp 0x4d4693
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00405ade
mov al, bl
jmp 0x4d46a3
mov al, 1
call fcn.004d6761
ret
Function at 0x4d4b7d
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x51cd31
call fcn.004d67b7
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x4d4ba2
xor eax, eax
jmp 0x4d4d29
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4d4bce
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4d4bce
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x4d4d29
cmp dword [esi + 0x4c], 0
je 0x4d4d26
mov ecx, esi
call fcn.004d47a3
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4d4c02
push dword [esi + 0x4c]
push edi
call fcn.004e3dc2
pop ecx
pop ecx
cmp ax, bx
je 0x4d4d26
movzx ebx, di
jmp 0x4d4d26
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.00453828
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x34], edi
cmp ecx, 0x10
jb 0x4d4c3c
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d4c46
mov edx, eax
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x34]
mov esi, dword [edi]
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x38]
call dword [0x51e29c]
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x4d4d1e
cmp eax, 1
jg 0x4d4cf8
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d4c91
mov edx, eax
mov edi, dword [ebp - 0x3c]
sub edi, edx
je 0x4d4cc0
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d4ca2
mov edx, eax
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push edx
call fcn.004e48c7
add esp, 0x10
cmp edi, eax
jne 0x4d4cf3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
jmp 0x4d4cc3
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x40], edx
jne 0x4d4ced
test edi, edi
jne 0x4d4c2e
cmp dword [ebp - 0x18], 0x20
jae 0x4d4d18
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.00453739
jmp 0x4d4c28
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x4d4d18
cmp eax, 3
jne 0x4d4d1e
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.004e3dc2
pop ecx
pop ecx
cmp ax, bx
je 0x4d4d18
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
lea ecx, [ebp - 0x28]
call fcn.00405ade
mov ax, bx
call fcn.004d6761
ret 4

Function at 0x4ee26b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004edf2e

Function at 0x4ee276
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ee0af
Function at 0x4f714f
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x3c
mov eax, dword [0x573080]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
push ebx
push ebp
movsx ebp, ax
mov ebx, ecx
shr eax, 0x10
and dword [edx], 0
push esi
cwde
push edi
mov edi, dword [ebx + 0x30]
mov dword [esp + 0x14], eax
jmp 0x4f71c7
mov esi, dword [edi]
lea ecx, [esp + 0x34]
xorps xmm0, xmm0
movups xmmword [esp + 0x34], xmm0
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x40]
push dword [esp + 0x14]
lea eax, [esp + 0x38]
push ebp
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4f71c4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
test al, al
je 0x4f71c4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x88]
test al, al
jne 0x4f71f1
mov edi, dword [edi + 8]
test edi, edi
jne 0x4f717e
mov ecx, dword [ebx + 0x34]
test ecx, ecx
je 0x4f71da
mov eax, dword [ecx]
call dword [eax + 0x5c]
and dword [ebx + 0x34], edi
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d5b75
add esp, 0x3c
ret 0x10
mov ecx, dword [ebx + 0x34]
cmp esi, ecx
je 0x4f7204
test ecx, ecx
je 0x4f7201
mov eax, dword [ecx]
call dword [eax + 0x5c]
mov dword [ebx + 0x34], esi
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
mov dword [esp + 0x18], ebp
and ax, cx
lea edx, [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
xor cx, cx
cmp cx, ax
mov ecx, dword [ebx + 0x34]
push edx
sbb eax, eax
neg eax
mov dword [esp + 0x24], eax
mov eax, dword [ecx]
call dword [eax + 0x58]
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x2c], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
jmp 0x4f71da

Function at 0x43b642
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x43b3c1
pop edx
dec edi
call fcn.0043b677
mov eax, 0x6725e757
sub eax, 0x8d83a29e
xor dword [ebx], edx
inc edi
inc ebx
or eax, edi
add eax, 0x54561812
or edi, edi
cmp ebx, ecx
jne fcn.0043b642
or eax, eax
or edi, edi
ret
Function at 0x77e430
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4c8000
lea edi, [esi - 0x327000]
push edi
jmp 0x77e44a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x77e451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77e440
mov eax, 1
add ebx, ebx
jne 0x77e463
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x77e474
jne 0x77e493
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77e493
dec eax
add ebx, ebx
jne 0x77e480
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x77e458
add ebx, ebx
jne 0x77e48f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x77e4e5
xor ecx, ecx
sub eax, 3
jb 0x77e4ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x77e51a
sar eax, 1
mov ebp, eax
jmp 0x77e4b6
add ebx, ebx
jne 0x77e4b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77e484
inc ecx
add ebx, ebx
jne 0x77e4c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77e484
add ebx, ebx
jne 0x77e4d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x77e4c6
jne 0x77e4e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x77e4c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x77e504
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x77e4f6
jmp 0x77e446
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x77e504
add edi, ecx
jmp 0x77e446
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x77e522
cmp byte [edi], 0x11
jne 0x77e522
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x77e527
lea edi, [esi + 0x377000]
mov eax, dword [edi]
or eax, eax
je 0x77e59f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x623724]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6238a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x77e554
mov ecx, edi
jns 0x77e583
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6238a4]
or eax, eax
je 0x77e599
mov dword [ebx], eax
add ebx, 4
jmp 0x77e571
call dword [esi + 0x6238b4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x77e5d0
cmp al, 0xef
ja 0x77e5c3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x77e5a5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x77e5b2
mov ebp, dword [esi + 0x6238a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x77e604
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x1001e27
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 4
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x1e
pop ecx
mov esi, 0x1001990
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
push 0x7a
movsw word es:[edi], word [esi]
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x6b8], 0x80000002
mov dword [ebp - 0x6b4], 0x80000001
pop edi
jb 0x1001f93
xor eax, eax
and dword [ebp - 0x69c], eax
mov word [ebx], ax
xor eax, eax
cmp ax, word [ebx]
jne 0x1001f93
lea eax, [ebp - 0x6a0]
push eax
push 1
xor esi, esi
push esi
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x69c]
push dword [ebp + eax*4 - 0x6b8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1001f80
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0x698]
push eax
lea eax, [ebp - 0x6a8]
push eax
push 0
lea eax, [ebp - 0x6ac]
push eax
lea eax, [ebp - 0x288]
push eax
push esi
push dword [ebp - 0x6a0]
mov dword [ebp - 0x6ac], 0x104
mov dword [ebp - 0x6a4], 0x410
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
inc esi
test edi, edi
jne 0x1001f74
cmp dword [ebp - 0x6a4], 2
jbe 0x1001ebe
lea eax, [ebp - 0x288]
push eax
push dword [ebp - 0x6b0]
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x1001ebe
cmp dword [ebp - 0x6a8], 1
je 0x1001f3d
cmp dword [ebp - 0x6a8], 2
jne 0x1001f71
mov esi, dword [ebp + 0x10]
add esi, 0xfffffffe
push esi
lea eax, [ebx + 2]
push eax
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1001f71
cmp eax, esi
ja 0x1001f71
push 0x22
pop ecx
mov word [ebx], cx
lea eax, [ebx + eax*2]
mov word [eax], cx
xor ecx, ecx
mov word [eax + 2], cx
jmp 0x1001f74
push 0xd
pop edi
push dword [ebp - 0x6a0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x69c]
cmp dword [ebp - 0x69c], 2
jb 0x1001e86
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002bbb
leave
ret 0xc
Function at 0x1002803
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
movzx eax, word [esi]
cmp ax, 0x22
jne 0x1002837
inc esi
inc esi
movzx eax, word [esi]
test ax, ax
je 0x100282d
cmp ax, 0x22
jne 0x100281d
cmp word [esi], 0x22
jne 0x1002845
inc esi
inc esi
jmp 0x1002845
cmp ax, 0x20
jbe 0x1002845
inc esi
inc esi
cmp word [esi], 0x20
ja 0x100283d
push 0x1001b58
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
push 0x44
lea eax, [ebp - 0x44]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
je 0x1002877
movzx eax, word [ebp - 0x14]
jmp 0x100287a
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.010024de
pop esi
leave
ret 0x10
Function at 0x1002ba0
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1003028
call fcn.01002d54
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1004370
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1002957
cmp eax, esi
jne 0x100294a
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100295a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002931
xor esi, esi
inc esi
mov eax, dword [0x100436c]
cmp eax, esi
jne 0x100296d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100299c
mov eax, dword [0x100436c]
test eax, eax
jne 0x1002996
mov dword [0x100436c], esi
push 0x1001104
push 0x10010f8
call fcn.01002896
pop ecx
pop ecx
test eax, eax
je 0x100299c
jmp 0x1002ac4
mov dword [0x1004034], esi
mov eax, dword [0x100436c]
cmp eax, esi
jne 0x10029c0
push 0x10010f4
push 0x10010ec
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100436c], 2
test ebx, ebx
jne 0x10029cc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1004374], 0
je 0x10029f0
push 0x1004374
call fcn.01002cc9
pop ecx
test eax, eax
je 0x10029f0
push 0
push 2
push 0
call dword [0x1004374]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1002a4c
test al, al
je 0x1002a0a
cmp dword [ebp - 0x1c], 0
jne 0x1002a4c
mov al, byte [esi]
test al, al
je 0x1002a1a
cmp al, 0x20
ja 0x1002a1a
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1002a0a
test byte [ebp - 0x3c], 1
je 0x1002a26
movzx eax, word [ebp - 0x38]
jmp 0x1002a29
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1004030], eax
cmp dword [0x1004024], 0
jne 0x1002aa0
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1002a5b
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1002a6e
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x10029f7
cmp dword [0x1004034], 0
jne 0x1002aaf
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004030]
jmp 0x1002ad0
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01002d99
ret
call fcn.01002ea1
jmp 0x10028f7
Function at 0x40e4d0
Capabilities:
Encode data using xor

Disassembly:
clc
sbb dh, byte [esi - 0x2071daa6]
ret
out 0xce, eax
sbb eax, 0x9f1a460d
sbb dword [esi + 0x3baa86fb], ebx
pop ss
loop 0x40e47d
loope 0x40e450
int3
mov al, 0xe7
xor esp, ebp
push ebx
jno 0x40e403
ret
xchg ecx, eax
arpl si, bx
lahf
xor edx, ecx
push ebx
or cl, byte [edi]
js 0x40e4e5
pop ss
inc ecx
fisub dword [edi + 0x605635fc]
imul edi, esp, 0xffffffdc
mov dword ds:[0xa008b9e3], eax
sahf
jae 0x40e4c9
int1
fisttp qword [edi + 0x7b80f066]
jo 0x40e436
stosb byte es:[edi], al
aaa
out dx, eax
outsb dx, byte [esi]
hlt
mov al, 0x55
sub byte [ebp - 0x16], dh
lds esi, [edx]
adc al, 0xb0
or ch, bl
dec eax
imul byte [ecx + 0x6f2ee9da]
cmp al, byte [eax + 0x7cfe9524]
xlatb
jnp 0x40e490
imul ecx, ecx, 0x6ba7d3f1
push es
popfd
popal
leave
int1
shl dword [edi + 0x619d066b], cl
test esp, esp
mul byte [esi + 0x52]
mov byte [edi - 0x67], cl
adc esi, dword [ebx + 0x20c240ec]
inc ebx
push ds
mov esi, 0x815c32e5
pop esp
invalid
sti
jg 0x40e54f
rcr dword [eax + ecx*2], cl
loop 0x40e4cb
sub dword [ecx + 0x3d], edx
cmc
dec ebp
mov word [edx], gs
dec edi
das
fisttp dword [ebp - 0x1d]
aam 0xf1
adc byte [esi + edi], ah
invalid
stc
mov dl, 0x4d
std
push cs
mov eax, 0x7f52c60
sal byte [edi], 0xd1
adc al, 0xcc
Function at 0x7b317b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x7b3198
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7b3189
add dl, dl
jne 0x7b31a3
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7b31ef
xor eax, eax
add dl, dl
jne 0x7b31b0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7b328c
add dl, dl
jne 0x7b31bf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7b31ca
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7b31d5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7b31e0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7b31ea
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x7b318f
mov eax, 1
add dl, dl
jne 0x7b31fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7b3208
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7b31f4
sub eax, 2
jne 0x7b3237
mov ecx, 1
add dl, dl
jne 0x7b321d
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7b3228
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7b3214
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7b318f
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7b324e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7b3259
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7b3245
cmp eax, 0x7d00
jae 0x7b327c
cmp eax, 0x500
jb 0x7b3277
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7b318f
cmp eax, 0x7f
ja 0x7b327f
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7b318f
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7b32a8
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7b318f
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret
Function at 0x4022d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
lea eax, [ebp - 4]
push eax
push 0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4022fd
xor eax, eax
jmp 0x40238e
push esi
push 0
push dword [ebp + 8]
mov esi, 0x20a
mov edx, esi
lea ecx, [ebp - 0x31c]
call fcn.00402000
push str.ShellOpenCommand
mov edx, esi
lea ecx, [ebp - 0x31c]
call fcn.004022aa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40235c
xor eax, eax
jmp 0x40238d
cmp byte [ebp - 0x110], 0
lea esi, [ebp - 0x110]
je 0x402380
movzx eax, byte [esi]
push eax
call dword [sym.imp.MSVCR71.dll_isspace]
test eax, eax
pop ecx
je 0x402380
inc esi
cmp byte [esi], 0
jne 0x40236b
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x402392
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
imul eax, eax, 0x106
push ebx
lea ebx, [eax + 0x404260]
cmp byte [ebx], 0
jne 0x40244d
push esi
push edi
push 0x5c
mov esi, 0x404140
push esi
call dword [sym.imp.MSVCR71.dll__mbsrchr]
test eax, eax
pop ecx
pop ecx
mov edi, 0x118
jne 0x4023e0
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x4023f9
sub eax, esi
inc eax
cmp eax, edi
jbe 0x4023e9
mov eax, edi
push 0
push esi
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.00402000
push 0x4030e8
mov edx, edi
lea ecx, [ebp - 0x118]
call fcn.004022aa
push dword [ebp + 8]
call fcn.00402037
push eax
mov edx, edi
lea ecx, [ebp - 0x118]
call fcn.004022aa
lea eax, [ebp - 0x118]
push 0
push eax
call dword [sym.imp.MSVCR71.dll__access]
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
jne 0x40244d
push 1
lea eax, [ebp - 0x118]
push eax
mov edx, 0x106
mov ecx, ebx
call fcn.00402000
pop ebx
leave
ret 4