joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502014
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5021d3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040abdc
mov eax, dword [ebp - 4]
call fcn.00501960
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x502066
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b610
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00502c68
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x502147
xor eax, eax
push ebp
push 0x502140
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00501c00
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00502208
test al, al
je 0x50211c
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040a93c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x50211c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040b208
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00501b60
test al, al
je 0x502116
mov eax, dword [ebp - 8]
call fcn.0040b208
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040b26c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00502014
dec ebx
cmp ebx, 0xffffffff
jne 0x5020c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x502147
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00501c00
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x51791c], 0
je 0x502187
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040b208
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00501bec
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00501b60
mov ebx, eax
jmp 0x5021ae
mov eax, dword [ebp - 4]
call fcn.0040b208
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00501bec
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00501b60
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5021da
lea eax, [ebp - 0x3c]
call fcn.0040a7b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a814
pop eax
jmp eax
Function at 0x5024ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5025a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00502208
test al, al
je 0x502586
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a93c
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x502586
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b208
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov eax, dword [ebp - 4]
call fcn.0040b208
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040b26c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x50253f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5025ad
lea eax, [ebp - 0x2c]
call fcn.0040a7b4
lea eax, [ebp - 4]
call fcn.0040a7b4
pop eax
jmp eax

Function at 0x502b44
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00501978
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040b208
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.00501b60
test al, al
jne 0x502bac
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x510bc8]
mov dl, 1
mov eax, dword [0x500744]
call fcn.00428710
call fcn.00409eac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x502bb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040b208
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.00501b60
test al, al
jne 0x502c19
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x510dd4]
mov dl, 1
mov eax, dword [0x500744]
call fcn.00428710
call fcn.00409eac
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.005019a8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x503230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x50335c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00501c00
xor eax, eax
push ebp
push 0x503335
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00502208
test al, al
je 0x503317
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00503108
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a93c
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x503317
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b208
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00501b60
test al, al
je 0x503313
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b208
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040b26c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00503108
pop ecx
inc edi
dec ebx
jne 0x5032bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50333c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00501c00
pop eax
jmp eax
Function at 0x50336c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5035c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00501c00
xor eax, eax
push ebp
push 0x503598
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00502208
test al, al
je 0x50357a
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a93c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x50357a
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b208
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00501b60
test al, al
je 0x50356e
mov eax, dword [ebp - 4]
call fcn.0040b208
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040b26c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00502c68
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50356e
xor eax, eax
push ebp
push 0x503567
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.00501c00
xor eax, eax
push ebp
push 0x503547
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b208
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040b26c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00501c04
mov eax, dword [ebp - 4]
call fcn.0040b208
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040b26c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00502c68
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x503522
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00503230
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0050336c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503529
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x5033f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50359f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00501c00
pop eax
jmp eax
Function at 0x50381c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5038b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040a7b4
mov dword [ebp - 8], 0xfd
mov edx, dword [ebp - 8]
inc edx
mov eax, ebx
call fcn.0040b380
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0040b208
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
jne 0x50387e
mov ecx, 0x5038cc
mov dl, 1
mov eax, dword [0x41a740]
call fcn.00428500
call fcn.00409eac
jmp 0x503899
mov eax, dword [ebx]
call fcn.0040b208
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040b26c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040ab94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5038b8
lea eax, [ebp - 4]
call fcn.0040a7b4
pop eax
jmp eax
Function at 0x5040a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040d2e8
mov eax, dword [ebp - 0xc]
call fcn.0040a898
xor eax, eax
push ebp
push 0x50420d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040a7b4
mov byte [ebp - 0xd], 1
cmp dword [ebp - 0xc], 0
je 0x504118
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004ff5a8
lea ecx, [ebp - 0x30]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0042165c
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.ole32.dll_IsEqualGUID
test al, al
jne 0x504118
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x48]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x44]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push edx
push eax
mov eax, ecx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 0
je 0x50416f
xor ebx, ebx
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 4]
mov ecx, ebx
add cl, 3
xor byte [edx + eax], cl
inc ebx
cmp ebx, 0x18
jne 0x50415b
lea ecx, [ebp - 8]
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00503740
mov eax, dword [ebp - 8]
test eax, eax
je 0x50418b
sub eax, 4
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x5041ad
inc eax
xor ebx, ebx
lea edx, [ebx + 0x40]
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
mov ecx, dword [ebp - 8]
cmp dl, byte [ecx + ebx]
je 0x5041a9
mov byte [ebp - 0xd], 0
inc ebx
dec eax
jne 0x504193
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 0
je 0x5041da
xor ebx, ebx
lea eax, [ebp - 0x34]
lea edx, [ebx + 0x10]
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
call fcn.0040b22c
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b400
inc ebx
cmp ebx, 0x17
jne 0x5041b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504214
lea eax, [ebp - 0x34]
call fcn.0040a7b4
lea eax, [ebp - 0xc]
call fcn.0040a7b4
lea eax, [ebp - 8]
mov edx, dword [0x404b04]
mov ecx, 2
call fcn.0040bd54
pop eax
jmp eax
Function at 0x50486c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x504875
xchg dword [ebp - 4], ecx
push ebx
mov byte [ebp - 0xe], cl
mov byte [ebp - 0xd], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a898
xor eax, eax
push ebp
push 0x504a6f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0xd], 0
je 0x5048bf
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x504a88
call fcn.0040b458
mov eax, dword [ebp - 0x18]
mov dl, 1
call fcn.005036c8
push 0x50
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x404b04]
call fcn.0040d144
add esp, 4
push 0
push 2
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040b208
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x50490c
mov dl, 1
mov eax, 0x504aa4
call fcn.005036c8
jmp 0x504a37
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x504918
sub eax, 4
mov eax, dword [eax]
push 0
lea edx, [ebp - 0x14]
push edx
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x504935
sub ecx, 4
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
cmp edx, dword [esp + 4]
jne 0x504948
cmp eax, dword [esp]
pop edx
pop eax
jne 0x5049b7
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.005040a4
test al, al
je 0x5049b7
cmp dword [ebp - 8], 0
je 0x5049b7
cmp byte [ebp - 0xd], 0
je 0x504985
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x504ad8
call fcn.0040b458
mov eax, dword [ebp - 0x1c]
mov dl, 1
call fcn.005036c8
jmp 0x5049b7
push 0x504ad8
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004233d4
push dword [ebp - 0x24]
push 0x504aec
push dword [ebp - 8]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040b4e0
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.005036c8
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x5049c3
sub ecx, 4
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
cmp edx, dword [esp + 4]
jne 0x5049d6
cmp eax, dword [esp]
pop edx
pop eax
je 0x50490c
push ebx
call sub.KERNEL32.DLL_CloseHandle
cmp byte [ebp - 0xe], 0
jne 0x504a37
mov eax, dword [ebp - 4]
call fcn.0050482c
test al, al
jne 0x504a2b
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00422ecc
and ax, 0xfffe
movzx edx, ax
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.00422f84
mov eax, dword [ebp - 4]
call fcn.00423198
test al, al
jne 0x504a37
mov dl, 1
mov eax, 0x504b00
call fcn.005036c8
jmp 0x504a37
mov dl, 1
mov eax, 0x504b48
call fcn.005036c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504a76
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040a814
lea eax, [ebp - 0xc]
mov edx, dword [0x404b04]
call fcn.0040d268
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a814
pop eax
jmp eax
Function at 0x50516c
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
add esp, 0xfffffe08
mov ebx, eax
mov edi, esp
xor eax, eax
mov ecx, 0x7d
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0x1a
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, ebx
mov eax, esp
call fcn.00423790
add esp, 0x1f8
pop edi
pop ebx
ret

Function at 0x5051a8
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
add esp, 0xfffffe08
mov ebx, eax
mov edi, esp
xor eax, eax
mov ecx, 0x7d
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0x24
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, ebx
mov eax, esp
call fcn.00423790
add esp, 0x1f8
pop edi
pop ebx
ret

Function at 0x5051e4
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
add esp, 0xfffffe08
mov ebx, eax
mov edi, esp
xor eax, eax
mov ecx, 0x7d
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0x23
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, ebx
mov eax, esp
call fcn.00423790
add esp, 0x1f8
pop edi
pop ebx
ret

Function at 0x505560
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x50561c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040abdc
mov edx, dword [ebp - 4]
mov eax, 0x505638
call fcn.00423238
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040b208
push eax
push 0
call sub.KERNEL32.DLL_MoveFileW
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
je 0x5055ff
lea eax, [ebp - 8]
push eax
lea edx, [esi + 1]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 4]
call fcn.0040b5c8
mov eax, dword [ebp - 8]
call fcn.0040b208
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x5055e1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x7b
je 0x5055ff
test esi, esi
jle 0x5055f9
lea eax, [ebp - 4]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040b5c8
test esi, esi
jne 0x505585
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505623
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a814
pop eax
jmp eax
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40c75f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40c76e
pop dword [ebp - 0x50]
mov eax, 0x40c76e
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3b062
push 0
mov eax, 0x97231a51
sub eax, 0x96e23931
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x471001ac
sub ecx, 0x470fb2fb
xor edi, edi
add edi, eax
mov ebx, 0x898fce02
sub ebx, 0x894e5602
add ebx, dword [ebp - 0x50]
mov edx, 0x95366673
add edx, 0xea5878d4
sub dword [ebp - 0x30], edi
mov esi, dword [ebx]
add dword [ebp - 0x24], esi
add esi, edx
sub dword [ebp - 0x20], 0xe56ca9ee
mov dword [edi], esi
xor dword [ebp - 4], 0x6b21009
add edi, 0x5323bdbe
add edi, 0xacdc4246
add ebx, 0x8a30f995
sub ebx, 0x8a30f991
loop 0x40c7ca
add eax, 0x12d97
mov ebx, eax
add eax, 5
mov ecx, 0x39cbc969
add ecx, 0xc6743697
add ecx, dword [ebp - 0x50]
call ebx
leave
ret