joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd62058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd621a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd6207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6206a
add dl, dl
jne 0xd62089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd620dc
xor eax, eax
add dl, dl
jne 0xd62096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6217d
add dl, dl
jne 0xd620a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd620b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd620bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd620c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd620d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd62075
mov eax, 1
add dl, dl
jne 0xd620ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd620f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd620e1
sub eax, ebx
mov ebx, 1
jne 0xd62128
mov ecx, 1
add dl, dl
jne 0xd6210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd62119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd62105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd62075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd6213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd6214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd62136
cmp eax, 0x7d00
jae 0xd6216d
cmp eax, 0x500
jb 0xd62168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd62075
cmp eax, 0x7f
ja 0xd62170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd62075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd6219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd62075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x49f16ca2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x398144d0
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401130
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10c
mov eax, dword [0x407004]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
xor eax, eax
push 0x103
push eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], al
lea eax, [esp + 0x11]
push eax
mov esi, ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0x10
jb 0x40116f
mov esi, dword [esi + 4]
jmp 0x401172
add esi, 4
push esi
push 0x104
lea ecx, [esp + 0x10]
push ecx
push str.http:__www.recover_iphone_contacts.com_ad_ad_photo.jpg
push str.AdPhotoURL
push 0x4052a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 8]
push edx
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
mov eax, edi
call fcn.004035cb
add esp, 0x10c
ret

Function at 0x4011c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10c
mov eax, dword [0x407004]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
xor eax, eax
push 0x103
push eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], al
lea eax, [esp + 0x11]
push eax
mov esi, ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0x10
jb 0x4011ff
mov esi, dword [esi + 4]
jmp 0x401202
add esi, 4
push esi
push 0x104
lea ecx, [esp + 0x10]
push ecx
push str.http:__www.recover_iphone_contacts.com_ad_ad_addr.txt
push str.AdAddrUrl
push 0x4052a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 8]
push edx
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
mov eax, edi
call fcn.004035cb
add esp, 0x10c
ret
Function at 0x402b30
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x214
mov eax, dword [0x407004]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
mov dword [esp + 8], 0
push ecx
mov dword [esp + 0xc], 0
mov word [esp + 0x14], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea edx, [esp + 4]
push edx
push eax
mov dword [esp + 0xc], 0
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x402bd0
mov eax, dword [esp + 4]
test eax, eax
je 0x402bd0
lea ecx, [esp]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0xc], 0x104
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
push str.AppDataRoaming
lea eax, [esp + 0xc]
push 0x104
push eax
call dword [sym.imp.MSVCR90.dll_wcscat_s]
mov ecx, dword [esp + 0x10]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402be5
push 0x104
lea edx, [esp + 0xc]
push edx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 8]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov ecx, dword [esp + 0x210]
xor ecx, esp
mov eax, edi
call fcn.004035cb
add esp, 0x214
ret
Function at 0x402cd0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x403ffa
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x407004]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov edi, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
call fcn.00402b30
mov dword [esp + 0x24], ebp
push str.Tenorshare
mov ecx, edi
mov dword [esp + 0x18], 1
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x402d32
mov eax, dword [esi]
jmp 0x402d34
mov eax, esi
mov ebx, dword [sym.imp.MSVCR90.dll__waccess]
push ebp
push eax
call ebx
add esp, 8
cmp eax, 0xffffffff
jne 0x402d95
cmp dword [edi + 0x18], 8
jb 0x402d50
mov eax, dword [esi]
jmp 0x402d52
mov eax, esi
mov ebp, dword [sym.imp.MSVCR90.dll__wmkdir]
push eax
call ebp
add esp, 4
test eax, eax
jne 0x402dcc
push str.Service
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
cmp dword [edi + 0x18], 8
jb 0x402d79
mov eax, dword [esi]
jmp 0x402d7b
mov eax, esi
push 0
push eax
call ebx
add esp, 8
cmp eax, 0xffffffff
jne 0x402dcc
cmp dword [edi + 0x18], 8
jb 0x402d90
mov esi, dword [esi]
push esi
call ebp
jmp 0x402dc9
push str.Service
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
cmp dword [edi + 0x18], 8
jb 0x402dac
mov eax, dword [esi]
jmp 0x402dae
mov eax, esi
push ebp
push eax
call ebx
add esp, 8
cmp eax, 0xffffffff
jne 0x402dcc
cmp dword [edi + 0x18], 8
jb 0x402dc2
mov esi, dword [esi]
push esi
call dword [sym.imp.MSVCR90.dll__wmkdir]
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x403450
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x403e32
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x407004]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 0
push 0x4000
call dword [sym.imp.MSVCR90.dll_malloc]
mov ebp, 8
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x3c], ebp
jae 0x40349f
lea eax, [esp + 0x28]
mov ebx, dword [sym.imp.MSVCR90.dll__wfopen]
push 0x405658
push eax
call ebx
add esp, 8
mov edi, eax
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x58], ebp
jae 0x4034c0
lea eax, [esp + 0x44]
push 0x4054a0
push eax
call ebx
add esp, 8
mov ebp, eax
test esi, esi
je 0x403582
test edi, edi
je 0x40356a
push edi
test ebp, ebp
je 0x40356f
mov ebx, dword [sym.imp.MSVCR90.dll_fread]
push 0x4000
push 1
push esi
call ebx
add esp, 0x10
test eax, eax
jle 0x40351d
lea ecx, [ecx]
push ebp
push eax
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fwrite]
push edi
push 0x4000
push 1
push esi
call ebx
add esp, 0x20
test eax, eax
jg 0x403500
mov ebx, dword [sym.imp.MSVCR90.dll_fclose]
push ebp
call ebx
push edi
call ebx
push esi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0xc
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x40]
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
test ebp, ebp
je 0x403578
push ebp
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
push esi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x40]
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4035cb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407004]
jne 0x4035d5
repz ret
jmp fcn.00403898
Function at 0x405b23
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405dee
test bl, 8
mov dword [ebp - 8], eax
je 0x405b62
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434fa8], eax
jmp 0x405cdf
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405b7c
test eax, eax
je 0x405c8d
test bl, 2
je 0x405c8d
mov esi, 0x42f270
push edi
push esi
call fcn.00406411
cmp dword [ebp + 8], 0
je 0x405b9b
push 0x40a56c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405ba1
push edi
call fcn.00405d32
cmp word [edi], 0
jne 0x405bb1
cmp word [0x42f270], 0x5c
jne 0x405bbc
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405c82
cmp word [ebp - 0x22c], 0x2e
jne 0x405c06
cmp word [ebp - 0x22a], 0
je 0x405c65
cmp word [ebp - 0x22a], 0x2e
jne 0x405c06
cmp word [ebp - 0x228], 0
je 0x405c65
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406411
test byte [ebp - 0x258], 0x10
je 0x405c31
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405c65
push dword [ebp + 0xc]
push edi
call fcn.00405b23
jmp 0x405c65
push dword [ebp - 4]
push edi
call fcn.00405adb
test eax, eax
jne 0x405c5d
cmp dword [ebp - 4], eax
je 0x405c55
push edi
push 0xfffffffffffffff1
call fcn.00405479
push 0
push edi
call fcn.004061d7
jmp 0x405c65
inc dword [0x434fa8]
jmp 0x405c65
push edi
push 0xfffffffffffffff2
call fcn.00405479
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405bde
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405c8d
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405cdf
cmp dword [ebp - 8], esi
jne 0x405ca1
inc dword [0x434fa8]
jmp 0x405cdf
push edi
call fcn.0040676f
test eax, eax
je 0x405cdf
push edi
call fcn.00405ce6
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405adb
test eax, eax
jne 0x405cd7
cmp dword [ebp - 4], esi
je 0x405c99
push edi
push 0xfffffffffffffff1
call fcn.00405479
push esi
push edi
call fcn.004061d7
jmp 0x405cdf
push edi
push 0xffffffffffffffe5
call fcn.00405479
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1000b720
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1001a020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
push 0
lea ecx, [ebp - 0x21c]
call fcn.10007500
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.1000b1f0
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x1000b79f
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x21c]
call fcn.10007bc0
mov eax, dword [ebp - 0x224]
jmp 0x1000b854
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1000b823
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.1000b720
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x1000b817
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x220], edx
lea ecx, [ebp - 0x21c]
call fcn.10007bc0
mov eax, dword [ebp - 0x220]
jmp 0x1000b854
mov dword [ebp - 0x210], 0x100
jmp 0x1000b7a9
lea ecx, [ebp - 0x21c]
call fcn.10009b60
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20c]
call fcn.1000a4c0
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x21c]
call fcn.10007bc0
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100128d6
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b930
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1000b98f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000b95c
mov eax, 1
jmp 0x1000b9ad
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000b98d
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x1000b9ad
jmp 0x1000b9a8
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1000b9a8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1000b9ad
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x1000cb60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
xor eax, eax
jne 0x1000cb69
cmp dword [ebp + 0xc], 0
je 0x1000cb7c
mov dword [ebp - 0x10], 1
jmp 0x1000cb83
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x1000cb96
mov eax, 0xd
jmp 0x1000cbf4
xor edx, edx
jne 0x1000cb6d
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR120.dll_wcslen]
add esp, 4
add eax, 1
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*2]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx*2]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 1
jne 0x1000cba7
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x1000cc00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x1000cc09
cmp dword [ebp + 0xc], 0
je 0x1000cc1c
mov dword [ebp - 4], 1
jmp 0x1000cc23
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x1000cc36
mov eax, 0xd
jmp 0x1000cc66
xor edx, edx
jne 0x1000cc0d
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR120.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x404584]
push eax
mov ecx, dword [str.Usage:__s_______files__n_______print_usage_nIf_no_files_are_specified__stdin_is_used_n]
push ecx
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR90.dll_exit]
pop ebp
ret
Function at 0x408f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb eax, dword [edi - 0x11d51731]
test esp, esi
jp 0x408f80
in eax, 0x3e
xlatb
mov dl, 0xd0
sub byte [ebp + 0x43], ah
fcomp dword [ebp - 0x6fd03b55]

Function at 0x409f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp - 0x71]
push esi
fdiv qword [ebp + 3]
push edi
mov ecx, 0x100018
xor eax, eax
mov edi, esi
pop edi
stosd dword es:[edi], eax
inc ebx
test dword [ebx], esi
rcr bl, cl
and byte [eax], al
add byte [eax], al
sub dl, byte [ebp + 0x68]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
call fcn.0040b870
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
mov ecx, dword [ebx + 0xc]
mov edx, eax
mov eax, dword [esi + 0x3c]
jb 0x409f63
or edx, ecx
sub eax, 0x6c5689c7
mov dword [esi + 0x6c], edx
pop ss
inc esi
push ebx
lcall 0x1503, 0x848bcc8b
sbb eax, 0xc3e85052
scasb al, byte es:[edi]
xchg esp, eax
add byte [ecx + 0x4e8b4756], cl
cmp al, 0x63
ror byte [ecx - 0x6190c7ba], 1
inc ecx
ror byte [edi], 0xb7
adc ecx, 0xfff1a169
leave
push esi
cmp byte [ecx + 0x4b8ba84e], cl
or byte [ecx - 0x3e74b7b2], cl
mov eax, ecx
Function at 0x407a28
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push edi
mov edi, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
bnd call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov esp, edi
pop edi
dec eax
imul eax, dword [ecx]
cmp al, 0x3e
jne 0x407a7d
push 3
call dword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, dword [edx + ebp]
je 0x407aae
mov eax, 0x407a78
lea eax, [edx + eax]
push ebp
push eax
push 0
call dword ss:[sym.imp.KERNEL32.dll_EnumResourceTypesA]
push esi
jmp 0x407aae
cmc
nop
mov eax, esp
lea eax, [eax + 8]
xchg dword [eax], eax
or eax, 7
lock xchg dword ds:[esp + 0xc], edx
lea eax, es:[eax + 0x603b]
add dword es:[edx - 0x1b4], eax
pop ecx
add esp, 0x10
mov eax, 0
push cs
push ecx
retf
add byte [eax], al
add byte [eax], al
and esi, ecx
in al, dx
mov ah, 0xb4
inc eax
add byte [edx - 0x17ffbd2b], bh
adc al, 0xc8
and byte [eax], al
insd dword es:[edi], dx
iretd
Function at 0x40f762
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor dword [esp], eax
stc
jb 0x40e37d
add byte [ebp], al
out 0, eax
adc al, 0x3e
and dl, 0x39
push ebp
mov ebp, 0x410198
xchg dword [esp], ebp
ret
push esp
stc
jb 0x40e4ad
aaa
add byte [eax], al
add byte [eax], al
wait
movsb byte es:[edi], byte [esi]
add byte [ebp + 0x70], dl
ljmp 0xd56
je 0x40e8e8
stc
jb 0x40dd65
sti
xchg esp, eax
movsb byte es:[edi], byte [esi]
or eax, 0x1df5e8
add cl, bh
push ebx
pop ebx
or al, byte [eax]
add dh, dh
inc esp
mov es, word [eax]
xor byte [ebp - 0x6c389fd], ch
push esp
stc
jb 0x40eaf9
add byte [eax + eax], dh
mov byte [0x149b9434], al
xchg byte [eax], al
out 0x48, eax
mov ecx, dword [ecx + 0x90]
stc
jb 0x40f0dd
add byte [eax], al
out dx, eax
wait
xor dword [esp], eax
stc
jb 0x40e96f
add bh, cl
add dword [ebx], esi
fdivr dword [ebx + eax - 5]
ret
push ebx
stc
jb 0x40ec3c
add byte [eax], al
add byte [ebx], bh
add byte [esi + eax*2 + 0x56d2a791], dl
xchg edx, eax
mov al, 0xca
mov ecx, dword fs:[0x30]
stc
jb 0x4100ab
out dx, eax
sti
rcl word [edi + 0x5e8b6d61], cl
or al, 0x90
cmp dword [ecx], 0
nop
jmp 0x40e442
pushal
stc
jb 0x4101a9
xchg esp, eax
sar byte [esi + 0xbe44], 0
ret 0xdb00
and esp, dword [ecx + 4]
push ebp
mov ebp, 0x40e3c4
xchg dword [esp], ebp
ret
mov ecx, ebx
stc
jb 0x40f123
xchg ecx, eax
and eax, 0x256d2300
cmp dword [edi + 0x64], 0x300d8b
add byte [eax], al
adc byte [eax], al
sub cl, byte [edi]
test dword [esi - 7], edi
invalid
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2e360d10
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x78156fc2
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219