joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422e30
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471483
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x4986f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x422ed5
cmp word [esi], di
je 0x422ed5
test eax, eax
je 0x422e91
cmp word [eax], di
je 0x422e91
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x422ed5
jmp 0x422ed0
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004482e0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x422ed5
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x422f3b
lea esi, [ebx + 0x38]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x422efb
mov eax, dword [esi]
push esi
call dword [eax]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x422f5b
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov byte [ebp - 4], 2
test esi, esi
je 0x422f23
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x422f3b
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427208
mov esp, ebp
pop ebp
ret 0x30
call fcn.00420662
int3
Function at 0x4233d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4986f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x49d880], 0
push esi
jne 0x4234f7
cmp dword [ecx + 0x2c], 8
lea eax, [ecx + 0x18]
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x810], 0
jb 0x42341b
mov eax, dword [eax]
push edi
push 0x20219
push eax
push dword [ecx + 0x30]
lea ecx, [ebp - 0x818]
call fcn.00410ed0
mov edi, dword [ebp - 0x818]
test eax, eax
jne 0x4234eb
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
push 0x47995c
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4234eb
mov eax, dword [ebp - 0x80c]
cmp eax, 1
je 0x42347f
cmp eax, 2
jne 0x4234eb
mov eax, dword [ebp - 0x808]
test eax, eax
je 0x42349c
test al, 1
jne 0x4234eb
shr eax, 1
cmp word [ebp + eax*2 - 0x806], 0
je 0x4234a5
jmp 0x4234eb
xor eax, eax
mov word [ebp - 0x804], ax
mov ecx, 0x49d880
lea esi, [ebp - 0x804]
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x4234de
movzx eax, word [esi + ecx]
test ax, ax
je 0x4234de
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4234c0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edi, edi
je 0x4234f6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push 0x49d880
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x42354b
mov ecx, 0x49d880
mov esi, str.noset
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x42353e
movzx eax, word [esi + ecx]
test ax, ax
je 0x42353e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x423520
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 0x49d880
xor ecx, ebp
pop esi
call fcn.00427208
mov esp, ebp
pop ebp
ret

Function at 0x425fb0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x425fd5
or esi, 1
push 1
call edi
test ax, ax
jns 0x425fe1
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x425fed
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x425ff9
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x426000
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0xe0]
call fcn.00425f60
mov edi, dword [ebp + 8]
test eax, eax
jle 0x42605b
nop
push esi
lea ecx, [ebx + 0xe0]
mov byte [ebp + 0xb], 0
call fcn.00425ef0
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x42618c
lea ecx, [ebx + 0xe0]
inc esi
call fcn.00425f60
cmp esi, eax
jl 0x426020
sub edi, 0x100
je 0x426121
sub edi, 4
je 0x4260c2
sub edi, 2
jne 0x426116
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call fcn.0044ef47
mov ecx, dword [ebx + 0x58]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push VariantTimeToDosDateTime
push edx
push 0x426770
call dword [eax + 0x14c]
mov esi, eax
test esi, esi
je 0x426116
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x13c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x5c], 0
je 0x426116
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x74]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.00425fb0
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x5c]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x158]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x426116
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
je 0x426173
mov eax, dword [ecx]
mov eax, dword [eax + 0x110]
call eax
test al, al
je 0x426173
mov ecx, dword [ebx + 0x5c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x11c]
call eax
test al, al
je 0x426173
mov ecx, dword [ebx + 0x5c]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.00447142
add esp, 8
test eax, eax
je 0x426173
mov ecx, dword [ebx + 0x5c]
call fcn.00426de0
test al, al
jne 0x426116
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, ebx
setns al
movzx eax, al
push eax
call fcn.00426510
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4269e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 0
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [esi + 4]
xorps xmm0, xmm0
push esi
movups xmmword [ebp - 0x20], xmm0
xor ebx, ebx
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426aa9
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x426aa9
cmp dword [ebp - 0x1c], 0x10
jne 0x426a70
cmp dword [ebp - 0x20], esi
jne 0x426a70
mov eax, dword [ebp - 0x18]
push 1
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov ebx, 1
lea eax, [ebp - 0x20]
push eax
call fcn.00426630
add esp, 4
test al, al
jne 0x426a94
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x426aa9
test ebx, ebx
jne 0x426aa9
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x426a36
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x426acb
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x429c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00429860
Function at 0x42af00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471a53
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x4986f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x80], 0
mov dword [edi], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00423560
mov eax, dword [ebp - 0x80]
add esp, 8
test eax, eax
je 0x42b113
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
call esi
test eax, eax
je 0x42b113
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x42b113
push eax
call esi
test eax, eax
je 0x42b113
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
push 0x201
push dword [ebp - 0x80]
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042ae50
mov esi, dword [ebp - 0x90]
test eax, eax
jne 0x42b104
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.004482e0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push dword [ebp - 0x7c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42b104
mov eax, dword [ebp - 0x84]
cmp eax, 1
je 0x42b02b
cmp eax, 2
jne 0x42b104
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x42b04c
test cl, 1
jne 0x42b104
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x42b052
jmp 0x42b104
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x42b104
lea ecx, [ebp - 0x78]
call fcn.004292e0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x78]
call fcn.004293a0
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push eax
lea eax, [ebp - 0x20]
push 0x47b648
push eax
call fcn.0042b510
push 0x2a
push dword [ebp - 0x78]
call fcn.00429860
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x84], eax
jne 0x42b0fc
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x42b0b2
sub edx, ecx
lea eax, [ebp - 0x74]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00429130
push dword [0x49871c]
lea eax, [ebp - 0x74]
push dword [0x498718]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x42b0ed
mov dword [edi], 1
lea ecx, [ebp - 0x78]
call fcn.004046a0
mov edi, 1
jmp 0x42b106
lea ecx, [ebp - 0x78]
call fcn.004046a0
xor edi, edi
test esi, esi
je 0x42b115
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42b115
xor edi, edi
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x80]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427208
mov esp, ebp
pop ebp
ret
Function at 0x42b150
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x42b165
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42b170
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x42e310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e381
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x42e34f
cmp eax, 2
jne 0x42e36b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x42e37b
test ecx, ecx
je 0x42e376
test cl, 1
jne 0x42e36b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x42e37b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x430cbf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x462711
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x4a0860]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x462752
cmp byte [edx], 0xa
jne 0x462752
or byte [eax + edi + 0x28], 4
jmp 0x462757
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x462848
mov al, byte [ebx]
cmp al, 0x1a
je 0x462829
cmp al, 0xd
je 0x462780
mov byte [esi], al
inc esi
inc ebx
jmp 0x46281e
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x4627a0
cmp byte [eax], 0xa
jne 0x462795
push 2
mov byte [esi], 0xa
pop eax
jmp 0x46279b
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x46281e
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x462817
cmp dword [ebp - 0x14], 0
je 0x462817
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4a0860]
test byte [eax + edi + 0x28], 0x48
je 0x4627ee
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x4627de
mov byte [esi], dl
jmp 0x46281a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4a0860]
mov byte [eax + edi + 0x2a], dl
jmp 0x46281a
cmp byte [ebp - 1], 0xa
jne 0x462800
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x462800
mov byte [esi], 0xa
jmp 0x46279d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004500f3
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x46281b
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x462769
jmp 0x462848
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4a0860]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x462843
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x462848
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462853
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x4a0860]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x462897
cmp word [edx], bx
jne 0x462897
or byte [edi + eax + 0x28], 4
jmp 0x46289c
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4629f0
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4629d0
cmp ax, word [ebp - 0x10]
je 0x4628d5
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4629c5
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4628fb
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4628eb
push ecx
pop eax
push 4
jmp 0x4628f0
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4629bf
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4629b6
cmp dword [ebp - 0x18], 0
je 0x4629b6
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x4a0860]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x462982
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x462946
mov word [esi], ax
jmp 0x46297a
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x4a0860]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x4a0860]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x4a0860]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4629c5
cmp word [ebp - 4], ax
jne 0x462997
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x462997
mov word [esi], ax
add esi, 2
jmp 0x4629c5
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004500f3
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4629c2
jmp 0x4629b9
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4628b5
jmp 0x4629f0
mov ecx, dword [ecx*4 + 0x4a0860]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4629e7
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4629f0
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468a62
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468704
Function at 0x997880
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov cl, byte [eax]
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
and dword [ebp - 4], esi
mov byte [ebx], cl
lea ecx, [ebx + 1]
inc eax
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
call fcn.00997837
test eax, eax
je 0x9979c0
call fcn.00997837
test eax, eax
je 0x997936
call fcn.00997837
test eax, eax
je 0x9978f8
push 4
xor esi, esi
pop edi
lea ecx, [ebp - 0x14]
call fcn.00997837
dec edi
lea esi, [eax + esi*2]
jne 0x9978cd
mov eax, dword [ebp - 0x10]
test esi, esi
je 0x9978ed
mov ecx, dword [ebp - 0x10]
sub eax, esi
mov al, byte [eax]
mov byte [ecx], al
jmp 0x9978f0
mov byte [eax], 0
inc dword [ebp - 0x10]
jmp 0x9979d0
mov eax, dword [ebp - 0x14]
movzx esi, byte [eax]
inc dword [ebp - 0x14]
xor ecx, ecx
inc ecx
mov eax, esi
and eax, ecx
inc eax
inc eax
shr esi, 1
je 0x99792e
test eax, eax
je 0x9979b8
mov ecx, dword [ebp - 0x10]
sub ecx, esi
mov edi, dword [ebp - 0x10]
mov dl, byte [ecx]
inc dword [ebp - 0x10]
inc ecx
dec eax
mov byte [edi], dl
jne 0x99791b
jmp 0x9979b8
mov dword [ebp - 4], ecx
jmp 0x9979b8
call fcn.00997867
test esi, esi
jne 0x99796b
cmp eax, 2
jne 0x997966
lea ecx, [ebp - 0x14]
call fcn.00997867
test eax, eax
je 0x9979bb
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
mov dl, byte [ecx]
inc dword [ebp - 0x10]
inc ecx
dec eax
mov byte [esi], dl
jne 0x997956
jmp 0x9979bb
sub eax, 3
jmp 0x99796d
dec eax
dec eax
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx]
shl eax, 8
add eax, ecx
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00997867
cmp esi, 0x7d00
jb 0x99798e
inc eax
cmp esi, 0x500
jb 0x997997
inc eax
cmp esi, 0x80
jae 0x9979a1
inc eax
inc eax
test eax, eax
je 0x9979b8
mov ecx, dword [ebp - 0x10]
sub ecx, esi
mov edi, dword [ebp - 0x10]
mov dl, byte [ecx]
inc dword [ebp - 0x10]
inc ecx
dec eax
mov byte [edi], dl
jne 0x9979aa
mov dword [ebp + 8], esi
xor esi, esi
inc esi
jmp 0x9979d2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov al, byte [eax]
inc dword [ebp - 0x10]
inc dword [ebp - 0x14]
mov byte [ecx], al
xor esi, esi
cmp dword [ebp - 4], 0
je 0x9978a6
mov eax, dword [ebp - 0x10]
pop edi
pop esi
sub eax, ebx
pop ebx
leave
ret

Function at 0x998f43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
jle 0x998fa4
mov eax, dword [ebp + 0x10]
cdq
and edx, 3
add eax, edx
push esi
mov esi, eax
sar esi, 2
test esi, esi
jle 0x998f7f
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
sub ebx, edi
mov dword [ebp - 4], esi
push dword [ebx + edi]
call dword [ebp + 8]
mov dword [edi], eax
add edi, 4
dec dword [ebp - 4]
jne 0x998f6d
pop edi
pop ebx
mov eax, dword [ebp + 0x10]
and eax, 0x80000003
jns 0x998f8e
dec eax
or eax, 0xfffffffc
inc eax
xor ecx, ecx
test eax, eax
jle 0x998fa3
mov edx, dword [ebp + 0xc]
lea esi, [edx + esi*4]
xor byte [esi + ecx], 0x7b
inc ecx
cmp ecx, eax
jl 0x998f9a
pop esi
mov eax, dword [ebp + 0x10]
leave
ret
Function at 0x998fa9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0099d48c
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
jle 0x99901e
push ebx
push esi
lea esi, [eax - 1]
shr esi, 4
push edi
mov edi, dword [ebp + 8]
mov ebx, eax
inc esi
cmp ebx, 0x10
jge 0x998ff0
xor eax, eax
test ebx, ebx
jle 0x999012
mov cl, byte [ebp + eax - 0x41]
xor byte [edi + eax], cl
inc eax
cmp eax, ebx
jl 0x998fe2
jmp 0x999012
push 0x80
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.0099c611
push 0x10
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.0099f060
add esp, 0x1c
sub ebx, 0x10
add edi, 0x10
dec esi
jne 0x998fd7
pop edi
pop esi
pop ebx
leave
ret