joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429d00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ff18
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x477d80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.00434d1a
add esp, 4
cmp eax, ebx
je 0x429dc5
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ebx
mov byte [esi + 0x50], bl
call fcn.0043523a
mov edx, dword [esi + 0x18]
push edx
push ebx
push eax
mov dword [esi + 0x24], eax
call fcn.004351c0
mov eax, dword [esi + 0x24]
mov edi, dword [0x45111c]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
add esp, 0x10
lea eax, [esi + 0x34]
push eax
call edi
lea ecx, [esi + 0x30]
push ecx
call edi
lea edx, [esi + 0x38]
push edx
call dword [0x4510a8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call fcn.00435ccb
push 0x471328
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.00436241
int3

Function at 0x42a960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [0x451070]
test eax, eax
jne 0x42a9d2
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x42a9a1
cmp eax, 2
jne 0x42a9bc
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x42a9cc
test eax, eax
je 0x42a9c7
test al, 1
jne 0x42a9bc
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x42a9cc
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x42bc60
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x477d80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push ecx
push 0xff
lea edx, [ebp - 0x204]
push pe_nt_image_headers32
push edx
call fcn.00437667
xor eax, eax
add esp, 0x14
lea ecx, [ebp - 0x204]
mov word [ebp - 6], ax
mov dword [ebp - 0x208], ecx
cmp dword [esi + 0x260], eax
jne 0x42bcbd
mov edx, ecx
push edx
call fcn.0043732d
add esp, 4
add esi, 0x40
push esi
push 0
call dword [0x451020]
mov esi, eax
test esi, esi
je 0x42bcf2
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [0x451024]
push esi
call dword [0x451028]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00434af6
mov esp, ebp
pop ebp
ret

Function at 0x42c290
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x477d80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
xor esi, esi
push eax
push edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.0042a8b0
mov ebx, eax
cmp ebx, esi
je 0x42c30a
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x42c2f5
push eax
call dword [0x45105c]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434af6
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x210]
push esi
push esi
push esi
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x204]
push edx
push esi
push eax
mov dword [ebp - 0x214], pe_nt_image_headers32
call dword [0x451018]
test eax, eax
jne 0x42c38c
mov edi, edi
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x210]
call fcn.0042c290
mov ebx, eax
cmp ebx, esi
jne 0x42c2e4
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x210]
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
push edx
mov dword [ebp - 0x214], pe_nt_image_headers32
call dword [0x451018]
test eax, eax
je 0x42c340
mov eax, dword [ebp - 0x210]
mov ebx, dword [0x45105c]
cmp eax, esi
je 0x42c3a5
push eax
call ebx
mov dword [ebp - 0x210], esi
mov eax, dword [ebp - 0x218]
push eax
mov ecx, edi
mov dword [ebp - 0x20c], esi
call fcn.0042a760
mov edi, eax
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x42c3c8
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434af6
mov esp, ebp
pop ebp
ret 4
Function at 0x42cdf0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [0x477d80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor edi, edi
push edi
push edi
mov ebx, ecx
call dword [0x45102c]
mov esi, eax
test esi, esi
je 0x42ce49
push 1
lea eax, [ebx + 0x40]
push eax
push esi
call dword [0x451030]
test eax, eax
je 0x42ce3a
push eax
mov edi, 1
call dword [0x451034]
push esi
call dword [0x451034]
test edi, edi
jne 0x42cf84
push 0x104
lea ecx, [ebp - 0x20e]
push ecx
push 0
call dword [0x4510a0]
test eax, eax
je 0x42ceea
cmp eax, 0x104
je 0x42ceea
mov edx, 0x22
mov word [ebp - 0x210], dx
mov ecx, edx
xor edx, edx
push 0xf003f
push edx
push edx
mov word [ebp + eax*2 - 0x20e], cx
mov word [ebp + eax*2 - 0x20c], dx
call dword [0x45102c]
mov esi, eax
test esi, esi
jne 0x42cefd
push 0x400
lea eax, [ebp - 0xa10]
push eax
push 0xd80a
call fcn.0042a3d0
add esp, 0xc
test eax, eax
jne 0x42ced5
push str.Could_not_open_Service_Manager
lea ecx, [ebp - 0xa10]
push 0x400
push ecx
call fcn.0042a180
add esp, 0xc
push 0
add ebx, 0x40
push ebx
lea edx, [ebp - 0xa10]
push edx
push 0
call dword [0x45129c]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434af6
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.RPCSS
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 1
push 3
push 0x10
push 0xf01ff
lea edi, [ebx + 0x40]
push edi
push edi
push esi
call dword [0x45100c]
test eax, eax
jne 0x42cf78
push esi
call dword [0x451034]
push 0x400
lea ecx, [ebp - 0xa10]
push ecx
push 0xd80b
call fcn.0042a3d0
add esp, 0xc
test eax, eax
jne 0x42cf69
push 0x46a6b8
lea edx, [ebp - 0xa10]
push 0x400
push edx
call fcn.0042a180
add esp, 0xc
push 0
push edi
lea eax, [ebp - 0xa10]
push eax
jmp 0x42cee2
mov edi, dword [0x451034]
push eax
call edi
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00434af6
mov esp, ebp
pop ebp
ret
Function at 0x42cfa0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.00435740
mov eax, dword [0x477d80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov edi, ecx
mov dword [ebp - 0x1024], 0
call dword [0x45102c]
mov esi, eax
test esi, esi
je 0x42d00b
push 1
lea ebx, [edi + 0x40]
push ebx
push esi
call dword [0x451030]
test eax, eax
je 0x42cffa
push eax
mov edi, 1
call dword [0x451034]
jmp 0x42d000
mov edi, dword [ebp - 0x1024]
push esi
call dword [0x451034]
test edi, edi
jne 0x42d021
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434af6
mov esp, ebp
pop ebp
ret
push 0xf003f
push 0
push 0
call dword [0x45102c]
mov edi, eax
test edi, edi
jne 0x42d07b
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0xd80a
call fcn.0042a3d0
add esp, 0xc
test eax, eax
jne 0x42d06c
push str.Could_not_open_Service_Manager
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.0042a180
add esp, 0xc
push 0
push ebx
lea edx, [ebp - 0x804]
push edx
jmp 0x42d1b8
push 0x10020
push ebx
push edi
call dword [0x451030]
mov esi, eax
test esi, esi
jne 0x42d0d9
push edi
call dword [0x451034]
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0xd80c
call fcn.0042a3d0
add esp, 0xc
test eax, eax
jne 0x42d06c
push str.Could_not_open_service
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.0042a180
add esp, 0xc
push esi
push ebx
lea edx, [ebp - 0x804]
push edx
jmp 0x42d1b8
lea eax, [ebp - 0x1020]
push eax
push 1
push esi
call dword [0x451004]
test eax, eax
jne 0x42d152
call dword [0x4510d0]
cmp eax, 0x426
je 0x42d152
cmp eax, 0x425
jne 0x42d10a
cmp dword [ebp - 0x101c], 3
je 0x42d152
push 0x400
lea ecx, [ebp - 0x804]
push ecx
push 0xd80e
call fcn.0042a3d0
add esp, 0xc
test eax, eax
jne 0x42d140
push str.Could_not_stop_service
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.0042a180
add esp, 0xc
push 0
push ebx
lea eax, [ebp - 0x804]
push eax
push 0
call dword [0x45129c]
push esi
call dword [0x451008]
push esi
mov esi, dword [0x451034]
mov dword [ebp - 0x1024], eax
call esi
push edi
call esi
cmp dword [ebp - 0x1024], 0
jne 0x42d00b
push 0x400
lea ecx, [ebp - 0x1004]
push ecx
push 0xd80d
call fcn.0042a3d0
add esp, 0xc
test eax, eax
jne 0x42d1ae
push str.Could_not_delete_service
lea edx, [ebp - 0x1004]
push 0x400
push edx
call fcn.0042a180
add esp, 0xc
push 0
push ebx
lea eax, [ebp - 0x1004]
push eax
push 0
call dword [0x45129c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00434af6
mov esp, ebp
pop ebp
ret
Function at 0x431690
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
call fcn.0042cfa0
test eax, eax
jne 0x4316ae
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x4794d0]
push ebx
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x65
xor ebx, ebx
push ecx
mov dword [ebp - 0x1c], str.APPID
mov dword [ebp - 0x18], str.E87BAFA3_AFF2_4698_ABDA_1CD28568295F
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00431240
cmp eax, ebx
jl 0x4317e0
push esi
push 0x20006
push str.AppID
push closesocket
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.0042a8b0
cmp eax, ebx
je 0x43172a
push eax
call fcn.0042a440
mov esi, eax
mov eax, dword [ebp - 0x18]
add esp, 4
cmp eax, ebx
je 0x43171f
push eax
call dword [0x45105c]
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x18]
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push str.E87BAFA3_AFF2_4698_ABDA_1CD28568295F
push esi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0042a810
cmp eax, ebx
je 0x431780
push eax
call fcn.0042a440
mov edi, eax
mov eax, dword [ebp - 0xc]
add esp, 4
cmp eax, ebx
je 0x43176a
push eax
call dword [0x45105c]
cmp esi, ebx
je 0x431775
push esi
call dword [0x45105c]
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0xc]
push str.LocalService
push edx
call dword [0x451060]
lea ecx, [ebp - 0xc]
cmp byte [ebp + 8], bl
je 0x4317d0
push 1
lea eax, [edi + 0x40]
push eax
push str.LocalService
call fcn.0042aa00
mov ecx, edi
call fcn.0042cdf0
lea ecx, [ebp - 0xc]
test eax, eax
jne 0x4317d0
call fcn.0042c270
lea ecx, [ebp - 0x18]
call fcn.0042c270
pop esi
pop ebx
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret 4
call fcn.0042c270
lea ecx, [ebp - 0x18]
call fcn.0042c270
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x431870
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call fcn.0042cfa0
test eax, eax
jne 0x431888
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x20006
xor esi, esi
push str.AppID
push closesocket
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.0042a8b0
cmp eax, esi
je 0x4318d1
push eax
call fcn.0042a440
mov edi, eax
mov eax, dword [ebp - 0x10]
add esp, 4
cmp eax, esi
je 0x4318c9
push eax
call dword [0x45105c]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x10]
push 0x20006
push str.E87BAFA3_AFF2_4698_ABDA_1CD28568295F
push ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.0042a8b0
cmp eax, esi
je 0x431922
push eax
call fcn.0042a440
mov edi, eax
mov eax, dword [ebp - 0x1c]
add esp, 4
cmp eax, esi
je 0x43190e
push eax
call dword [0x45105c]
cmp ebx, esi
je 0x431919
push ebx
call dword [0x45105c]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x1c]
push str.LocalService
push edi
call dword [0x451060]
mov ecx, dword [0x4794d0]
lea eax, [ebp - 0x20]
push eax
push esi
push 0x65
push ecx
mov dword [ebp - 0x20], str.APPID
mov dword [ebp - 0x1c], str.E87BAFA3_AFF2_4698_ABDA_1CD28568295F
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.00431240
mov dword [ebp - 4], eax
cmp edi, esi
je 0x431966
push edi
call dword [0x45105c]
cmp ebx, esi
je 0x431971
push ebx
call dword [0x45105c]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6edf10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1ac000]
push edi
jmp 0x6edf2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6edf31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6edf20
mov eax, 1
add ebx, ebx
jne 0x6edf43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6edf54
jne 0x6edf73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6edf73
dec eax
add ebx, ebx
jne 0x6edf60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6edf38
add ebx, ebx
jne 0x6edf6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6edfc5
xor ecx, ecx
sub eax, 3
jb 0x6edf8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6edffa
sar eax, 1
mov ebp, eax
jmp 0x6edf96
add ebx, ebx
jne 0x6edf96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6edf64
inc ecx
add ebx, ebx
jne 0x6edfa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6edf64
add ebx, ebx
jne 0x6edfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6edfa6
jne 0x6edfc2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6edfa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6edfe4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6edfd6
jmp 0x6edf26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6edfe4
add edi, ecx
jmp 0x6edf26
pop esi
mov edi, esi
mov ecx, 0x50af
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6ee002
cmp byte [edi], 0x2c
jne 0x6ee002
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6ee007
lea edi, [esi + 0x2ea000]
mov eax, dword [edi]
or eax, eax
je 0x6ee07f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2efb24]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2efc78]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6ee034
mov ecx, edi
jns 0x6ee063
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2efc7c]
or eax, eax
je 0x6ee079
mov dword [ebx], eax
add ebx, 4
jmp 0x6ee051
call dword [esi + 0x2efc8c]
mov ebp, dword [esi + 0x2efc80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6ee0b3
sub esp, 0xffffff80
jmp 0x4b0524

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x17e3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.017e378f
jae 0x17e370e
xor ecx, ecx
call fcn.017e378f
jae 0x17e373d
xor eax, eax
call fcn.017e378f
jae 0x17e374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.017e378f
adc al, al
jae 0x17e372f
jne 0x17e3779
stosb byte es:[edi], al
jmp 0x17e3711
call fcn.017e379b
sub ecx, ebx
jne 0x17e3756
call fcn.017e3799
jmp 0x17e3775
lodsb al, byte [esi]
shr eax, 1
je 0x17e3783
adc ecx, ecx
jmp 0x17e3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.017e3799
cmp eax, 0x7d00
jae 0x17e3772
cmp ah, 5
jae 0x17e3773
cmp eax, 0x7f
ja 0x17e3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17e3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x1803700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0180378f
jae 0x180370e
xor ecx, ecx
call fcn.0180378f
jae 0x180373d
xor eax, eax
call fcn.0180378f
jae 0x180374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0180378f
adc al, al
jae 0x180372f
jne 0x1803779
stosb byte es:[edi], al
jmp 0x1803711
call fcn.0180379b
sub ecx, ebx
jne 0x1803756
call fcn.01803799
jmp 0x1803775
lodsb al, byte [esi]
shr eax, 1
je 0x1803783
adc ecx, ecx
jmp 0x1803772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01803799
cmp eax, 0x7d00
jae 0x1803772
cmp ah, 5
jae 0x1803773
cmp eax, 0x7f
ja 0x1803774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1803711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x410290
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4816eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00473f87
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x410312
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047186d
mov eax, dword [eax]
push 0x5fd1d0
push eax
call fcn.00464524
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00474212
test bl, bl
je 0x410312
push 0x5fd1d0
lea ecx, [esp + 0xc]
call fcn.004745ee
push 0x600d60
lea ecx, [esp + 0xc]
call fcn.004745ee
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41034e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00474212
jmp 0x410419
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4103d2
lea edx, [esp + 0x7c]
push 0x600d5c
push edx
call fcn.00464524
add esp, 8
test eax, eax
je 0x4103d2
lea eax, [esp + 0x7c]
push 0x600d58
push eax
call fcn.00464524
add esp, 8
test eax, eax
je 0x4103d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410362
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00474212
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x410c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x410c72
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x410c80
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48176b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x608090]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x410db8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x410ce6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00474212
xor eax, eax
jmp 0x410e2f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047439b
push esi
lea ecx, [esp + 0xc]
call fcn.0047462a
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x410e0d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.00410c10
test eax, eax
jne 0x410e0d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.00410c10
test eax, eax
jne 0x410e0d
lea eax, [esp + 0x14]
push 0x600d74
push eax
call fcn.00465600
mov esi, eax
add esp, 8
test esi, esi
jne 0x410dec
lea ecx, [esp + 0x14]
push 0x600d70
push ecx
call fcn.00465580
mov esi, eax
add esp, 8
test esi, esi
jne 0x410dec
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x410def
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047434b
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x410cfe
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00474212
xor eax, eax
jmp 0x410e2f
mov byte [esi], 0
push 0x600d6c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00474212
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4