joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436cb0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46ebb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00460aed
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x53d718
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x53c358
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4700a4]
push eax
mov ecx, edi
call fcn.0046625c
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004677b4
test eax, eax
je 0x436dcc
mov ecx, dword [esp + 0x3c]
call fcn.00466289
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x470540]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x436d90
push edi
mov ecx, esi
call fcn.0046384a
mov ecx, esi
call fcn.00436f30
cmp dword [esp + 0x38], 1
jne 0x436dc5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004639b4
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x4397f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x439823
push esi
call fcn.0043c8f0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43981c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4398a9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x439892
mov eax, dword [esi + 8]
test eax, eax
je 0x439847
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43988e
cmp eax, 2
je 0x439892
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43983a
cmp eax, 3
je 0x43986d
cmp eax, 1
jne 0x43983a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43983a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43983a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004398d0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4398b8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004398d0
add esp, 4
pop esi
ret
Function at 0x4012a2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x20]
mov dword [ebp - 0xc], edi
jmp 0x4012b5
mov edi, dword [ebp - 0xc]
mov ecx, dword [esi + 0x60]
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x68]
sub eax, ecx
sub eax, edx
mov dword [ebp - 8], eax
jne 0x4012d4
test ecx, ecx
jne 0x4012e2
test edx, edx
jne 0x4012e2
mov dword [ebp - 8], edi
jmp 0x40134c
cmp eax, 0xffffffff
jne 0x4012e2
mov dword [ebp - 8], 0xfffffffe
jmp 0x40134c
mov eax, dword [esi + 0x20]
lea eax, [edi + eax - 0x106]
cmp ecx, eax
jb 0x40134c
mov eax, dword [esi + 0x2c]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.00405c70
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x38]
sub dword [esi + 0x64], edi
sub dword [esi + 0x60], edi
add esp, 0xc
sub dword [esi + 0x50], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x401313
mov eax, dword [esi + 0x34]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x401332
add dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4013f2
mov ebx, dword [esi + 0x68]
add ebx, dword [esi + 0x60]
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 8]
add ebx, dword [esi + 0x2c]
mov dword [ebp - 4], eax
cmp eax, ecx
jbe 0x401371
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x40137b
xor eax, eax
jmp 0x4013b3
sub eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
cmp dword [eax + 0x14], 0
jne 0x40139d
push dword [ebp - 4]
push dword [edi]
push dword [edi + 0x30]
call section..text
add esp, 0xc
mov dword [edi + 0x30], eax
push dword [ebp - 4]
push dword [edi]
push ebx
call fcn.00405c70
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x68], eax
mov edi, dword [esi + 0x68]
cmp edi, 3
jb 0x4013de
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x2c]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x3c], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x48]
mov dword [esi + 0x3c], eax
cmp edi, 0x106
jae 0x4013f2
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4012b2
pop edi
pop ebx
leave
ret

Function at 0x404d02
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 8], 0
jne 0x404d24
push dword [esi + 0x40]
lea eax, [esi + 0x50]
push 0x1000
push 1
push eax
mov dword [esi + 4], eax
call fcn.00406502
add esp, 0x10
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
ret

Function at 0x404d28
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov edi, 0x1000
sub edi, dword [esi + 0x14]
je 0x404d5f
push dword [esi + 0x44]
lea ebx, [esi + 0x1050]
push edi
push 1
push ebx
call fcn.00406681
add esp, 0x10
cmp eax, edi
je 0x404d55
or dword [esi + 0x4c], 0xffffffff
xor eax, eax
jmp 0x404d61
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0x1000
mov eax, edi
pop edi
pop ebx
ret
Function at 0x404ed1
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x20
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404f3d
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push edi
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push edi
push edi
push 0x10
lea eax, [ebp - 0x14]
push eax
neg esi
sbb esi, esi
push edi
push dword [ebp - 4]
and esi, 2
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov edi, eax
neg edi
sbb edi, edi
inc edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x404f43
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x41b2e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.adservice
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push 0xf003f
movsd dword es:[edi], dword [esi]
xor ebx, ebx
push ebx
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, ebx
jne 0x404f82
or eax, 0xffffffff
jmp 0x40501c
push 0xf01ff
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, ebx
jne 0x404fa1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x404f7a
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea eax, [ebp - 0x18]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push ebx
push edi
call esi
test eax, eax
jne 0x404fc9
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x14]
call esi
jmp 0x404f7a
cmp dword [ebp - 0x38], 1
jne 0x404fd3
xor eax, eax
jmp 0x40501c
lea eax, [ebp - 0x58]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x404fb9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x18]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push ebx
push edi
call esi
test eax, eax
je 0x405009
cmp dword [ebp - 0x38], 1
jne 0x404fe4
jmp 0x40500c
or ebx, 0xffffffff
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x14]
call esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405c56
leave
ret
Function at 0x4050e1
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x41b2e4]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
mov esi, dword [ebp + 0x90]
push 0x103
lea eax, [ebp - 0x7f]
push 0
push eax
mov byte [ebp - 0x80], 0
call fcn.00405fe0
push esi
lea eax, [ebp - 0x80]
push 0x104
push eax
call fcn.004071ae
lea eax, [ebp - 0x80]
push 0x5c
push eax
call fcn.00407220
add esp, 0x20
pop esi
test eax, eax
je 0x40515b
mov byte [eax], 0
mov eax, dword [ebp + 0x94]
inc eax
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004050e1
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.00405c56
add ebp, 0x88
leave
ret

Function at 0x405170
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push dword [ebp + 0xc]
call fcn.004050e1
pop ecx
pop ecx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
test esi, esi
jne 0x4051b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4051b4
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
neg eax
jmp 0x4051c4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
test esi, esi
setne al
dec eax
pop esi
pop ebp
ret

Function at 0x4051c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
push 0x80
push 2
push esi
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405261
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x1c]
cmp edi, esi
jbe 0x405268
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 0x10]
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], edi
je 0x405244
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Writing_data_error:__x08_n
mov ecx, fcn.00405a81
call fcn.0040509a
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x405263
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x14]
push ecx
lea ecx, [eax + 0xc]
push ecx
add eax, 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp + 8]
push str.File:__s_size_error_n
jmp 0x40522c
Function at 0x405272
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405311
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp eax, esi
jbe 0x405308
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 4]
mov dword [edi], eax
push esi
push eax
call fcn.00405fe0
add esp, 0xc
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x405308
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Read_pack_file_failed_with_error:__08x_n
mov ecx, fcn.00405a81
call fcn.0040509a
pop ecx
pop ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405329
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Open_pack_file_failed_with_error:__08x_n
mov ecx, fcn.00405a81
call fcn.0040509a
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 8], esi
pop esi
setne al
pop ebx
dec eax
leave
ret

Function at 0x405336
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x418edc
mov edi, eax
push 0x7d0
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x4053d4
cmp dword [ebp - 4], esi
je 0x4053d4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x80
push 2
push esi
push 2
push 0x40000000
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4053c6
push esi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4053ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Create_temp_resource_of_file_failed_with_error:__08x_n
jmp 0x4053e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Load_resource_failed_with_error:__08x_n
mov ecx, fcn.00405a81
call fcn.0040509a
pop ecx
or eax, 0xffffffff
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4053f4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push eax
push dword [ebp + 8]
mov ebx, str._s_08X
push ebx
mov edi, 0x104
push edi
push dword [ebp + 0xc]
call fcn.00407348
add esp, 0x14
call esi
imul eax, eax, 0x3039
xor edx, edx
mov ecx, 0x2215
div ecx
push eax
push dword [ebp + 8]
push ebx
push edi
push dword [ebp + 0x10]
call fcn.00407348
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x14
push dword [ebp + 0xc]
call esi
push dword [ebp + 0x10]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x405aef
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x41b2e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, str._s_adclient
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test eax, eax
jne 0x405b1b
or eax, 0xffffffff
jmp 0x405b7b
mov dword [0x41ed28], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.00407348
add esp, 0x10
push 0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405b6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405b16
lea eax, [ebp - 0x114]
push eax
call fcn.00405456
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00405c56
leave
ret

Function at 0x405b89
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 1
jle 0x405c46
and dword [ebp + 8], 0
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [esi + 4]
push edi
call fcn.00404d7f
mov edi, str.10:36:53
push edi
push dword [esi]
push str._____Start_install__s.___s_______n
call fcn.00404e0f
lea eax, [ebp + 8]
push eax
push str.pid_d
push ebx
call fcn.00406e6c
add esp, 0x18
cmp eax, 1
jne 0x405bf0
push dword [ebp + 8]
call fcn.0040502b
pop ecx
test eax, eax
je 0x405c1e
call fcn.00404e36
push eax
call fcn.00405aef
jmp 0x405c1d
lea eax, [ebp - 4]
push eax
push str.uid_u
push ebx
call fcn.00406e6c
add esp, 0xc
cmp eax, 1
jne 0x405c0c
push dword [ebp - 4]
jmp 0x405be9
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x405c1e
push ebx
call fcn.00405456
pop ecx
push edi
push str._____End_install___s_______n
call fcn.00404e0f
mov eax, dword [0x41eba4]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
test eax, eax
je 0x405c52
push eax
call fcn.004067cb
and dword [0x41eba4], 0
jmp 0x405c51
call fcn.00404e36
push eax
call fcn.00405aef
pop ecx
xor eax, eax
leave
ret

Function at 0x405c56
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b2e4]
jne 0x405c60
repz ret
jmp fcn.00407801
Function at 0x410af5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040b060
and dword [ebp - 4], 0
cmp dword [0x41d2b8], 0
mov ebx, eax
jne 0x410ba6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410c57
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x410c57
push eax
call fcn.0040afee
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41d2b8], eax
call esi
push eax
call fcn.0040afee
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d2bc], eax
call esi
push eax
call fcn.0040afee
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41d2c0], eax
call esi
push eax
call fcn.0040afee
pop ecx
mov dword [0x41d2c8], eax
test eax, eax
je 0x410ba6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040afee
pop ecx
mov dword [0x41d2c4], eax
mov eax, dword [0x41d2c4]
cmp eax, ebx
je 0x410bfe
cmp dword [0x41d2c8], ebx
je 0x410bfe
push eax
call fcn.0040b069
push dword [0x41d2c8]
mov esi, eax
call fcn.0040b069
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410bfe
test edi, edi
je 0x410bfe
call esi
test eax, eax
je 0x410bf5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410bf5
test byte [ebp - 0xc], 1
jne 0x410bfe
or dword [ebp + 0x10], 0x200000
jmp 0x410c37
mov eax, dword [0x41d2bc]
cmp eax, ebx
je 0x410c37
push eax
call fcn.0040b069
pop ecx
test eax, eax
je 0x410c37
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410c37
mov eax, dword [0x41d2c0]
cmp eax, ebx
je 0x410c37
push eax
call fcn.0040b069
pop ecx
test eax, eax
je 0x410c37
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d2b8]
call fcn.0040b069
pop ecx
test eax, eax
je 0x410c57
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410c59
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406228
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x40624d
mov eax, dword [0x4098b8]
cmp eax, 0xffffffff
je 0x406244
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x4098b8], 0xffffffff
jmp 0x4062c0
cmp dword [0x43a980], ebx
je 0x4062c0
cmp byte [0x43a580], bl
je 0x40628c
cmp dword [0x4098b8], 0xffffffff
jne 0x406295
push 4
push 0x40000000
push 0x43a580
call fcn.00405bf0
cmp eax, 0xffffffff
mov dword [0x4098b8], eax
je 0x4062c0
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x4098b8], 0xffffffff
je 0x4062c0
push esi
mov esi, 0x43e9c0
push 0x409a8c
push esi
call fcn.00405f3d
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f30
push eax
push esi
push dword [0x4098b8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x406386
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x43a174], esi
push edi
jne 0x4063c0
mov ecx, 0x43a170
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40639c
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x43a570
jl 0x406397
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x4063f5
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43a170]
xor eax, esi
inc ecx
dec edx
jne 0x4063d8
pop edi
pop esi
not eax
ret 0xc

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x4be88b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80