joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4508d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x450a6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov edi, eax
mov eax, 0xc8
call fcn.004026fc
mov esi, eax
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 4], eax
push 0xc8
push edi
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00403cf4
mov eax, dword [ebp - 0xc]
mov edx, 0x450a80
call fcn.00403ecc
jne 0x450a41
xor ebx, ebx
push 0
push 0x450a8c
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x450a41
push 0
push 0x450a9c
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x450a41
push 0
push 0x450aa8
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov dword [ebp - 8], eax
push 0
push 0x450ab4
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
cmp dword [ebp - 8], 0
jle 0x450a41
test ebx, ebx
jle 0x450a41
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x450ac4
call fcn.00403e08
mov edx, dword [ebp - 0x10]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428d70
push 0
push 0
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x450ad4
call fcn.00403e08
mov edx, dword [ebp - 0x18]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428d70
mov eax, edi
call fcn.00402714
mov eax, esi
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450a71
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403b60
ret

Function at 0x450ba8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x450c31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403cf4
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00407d84
mov edx, dword [ebp - 4]
mov eax, 0x450c48
call fcn.004040a8
dec eax
jle 0x450c0f
push 0
push 0
push 0x10
push esi
call sub.user32.dll_PostMessageA
mov eax, ebx
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450c38
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b60
ret
Function at 0x450c4c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x450dce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov ebx, eax
push 0x450ddc
push 0x450dec
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
je 0x450dac
push 0
push 0x450df4
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x450cb4
push 0
push 0x450e00
push edi
push esi
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
mov esi, ebx
push esi
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x450e10
call fcn.00403e08
mov edx, dword [ebp - 8]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428d70
mov eax, dword [0x456d48]
mov eax, dword [eax]
mov edx, 0x450e24
call fcn.00403ecc
jne 0x450d48
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x450e30
call fcn.00403e08
mov edx, dword [ebp - 0x10]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428d70
jmp 0x450dac
push 0
push 0
push 0xcc
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x450e30
call fcn.00403e08
mov edx, dword [ebp - 0x18]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428d70
mov eax, ebx
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450dd5
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00403b60
ret
Function at 0x450f94
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x450f9c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4511c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov edi, eax
mov eax, 0xc8
call fcn.004026fc
mov esi, eax
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
push 0xc8
push edi
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 8]
mov edx, edi
call fcn.00403cf4
mov eax, dword [ebp - 8]
mov edx, 0x4511dc
call fcn.00403ecc
jne 0x45119c
xor eax, eax
push 0x4511e4
push 0x4511f0
push eax
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x45119c
push 0x4511f8
push 0x4511f0
push eax
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x45119c
push 0
push 0x451204
push 0
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
jle 0x4510d6
push esi
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00403cf4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004514a8
test al, al
je 0x4510a3
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x451218
call fcn.00403e08
mov edx, dword [ebp - 0x10]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428d70
jmp 0x4510d6
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
mov edx, 0x451218
call fcn.00428d70
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
mov edx, 0x451228
call fcn.00428d70
jmp 0x45119c
push 0
push 0x451230
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jle 0x45119c
mov eax, dword [0x456d48]
mov eax, dword [eax]
mov edx, 0x451240
call fcn.00403ecc
jne 0x451141
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x451228
call fcn.00403e08
mov edx, dword [ebp - 0x18]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428d70
jmp 0x45119c
push 0
push 0
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x24]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x451228
call fcn.00403e08
mov edx, dword [ebp - 0x20]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428d70
mov eax, edi
call fcn.00402714
mov eax, esi
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4511cc
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.00403b60
ret
Function at 0x451244
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451442
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
push 0
push 0x451450
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x451420
push 0x451458
push 0x45146c
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
jle 0x451420
push 0
push 0x451474
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x451474
push edi
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test edi, edi
je 0x451420
test esi, esi
je 0x451420
push ebx
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403cf4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004514a8
test al, al
je 0x451340
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x451484
call fcn.00403e08
mov edx, dword [ebp - 0xc]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428d70
jmp 0x451373
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
mov edx, 0x451484
call fcn.00428d70
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
mov edx, 0x451494
call fcn.00428d70
jmp 0x451420
mov eax, dword [0x456d48]
mov eax, dword [eax]
mov edx, 0x4514a4
call fcn.00403ecc
jne 0x4513c5
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x451494
call fcn.00403e08
mov edx, dword [ebp - 0x14]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428d70
jmp 0x451420
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x451494
call fcn.00403e08
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428d70
mov eax, ebx
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451449
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00403b60
ret
Function at 0x451ab0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451b97
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x451b61
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403b3c
push 0x65
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x451b23
pop dword fs:[0]
add esp, 8
jmp 0x451b76
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x451b4b
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x204]
call fcn.00408654
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 8]
call fcn.00403dc4
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x451b2a
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x451b6b
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403b90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451b9e
lea eax, [ebp - 0x204]
call fcn.00403b3c
lea eax, [ebp - 8]
call fcn.00403b3c
ret

Function at 0x452cb4
Capabilities:
Terminate process

Disassembly:
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
test eax, eax
je 0x452cca
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
ret
Function at 0x453a94
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x453a9c
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x453cbc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x456b90]
mov edx, dword [0x456b88]
mov eax, 0x80000000
call fcn.004518d4
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0044ae28
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00403bd4
mov eax, dword [ebp - 0x18]
call fcn.004081fc
cmp al, 1
jne 0x453b43
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004530cc
push 0
mov ecx, dword [0x456b94]
mov edx, dword [0x456b88]
mov eax, 0x80000000
call fcn.00451804
push 0
mov ecx, dword [0x456b90]
mov edx, dword [0x456b88]
mov eax, 0x80000000
call fcn.00451804
push 0
mov ecx, dword [0x456b8c]
mov edx, dword [0x456b88]
mov eax, 0x80000000
call fcn.00451804
mov dl, 1
mov eax, dword [0x40e258]
call fcn.00402e00
mov dword [ebp - 4], eax
lea edx, [ebp - 0x20]
mov eax, dword [0x456e28]
mov eax, dword [eax]
call fcn.00447594
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 8]
call fcn.004082cc
lea edx, [ebp - 0x24]
mov eax, dword [0x456e28]
mov eax, dword [eax]
call fcn.00447594
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xc]
call fcn.00408328
mov eax, dword [ebp - 8]
call fcn.00403dbc
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x453baa
lea eax, [ebp - 0x10]
mov ecx, 0x453cd4
mov edx, dword [ebp - 8]
call fcn.00403e08
jmp 0x453bb5
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00403bd4
mov edx, 0x453ce0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x453cf4
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x453d04
push dword [ebp - 0xc]
push 0x453d14
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403e7c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x453d24
push dword [ebp - 0xc]
push 0x453d38
push 0x453d44
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00403e7c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x453d58
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
push ebp
push 0x453c83
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov ecx, 0x453d78
mov edx, dword [ebp - 0x10]
call fcn.00403e08
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov eax, dword [ebp - 8]
call fcn.00403f80
push eax
push 0x453d84
mov eax, dword [ebp - 0x14]
call fcn.00403f80
push eax
push 0x453d88
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x453c8d
mov eax, dword [ebp - 4]
call fcn.00402e30
mov eax, dword [0x456e28]
mov eax, dword [eax]
call fcn.00447180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453cc3
lea eax, [ebp - 0x2c]
mov edx, 0xa
call fcn.00403b60
ret
Function at 0x454674
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f70
xor eax, eax
push ebp
push 0x4547ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x44a620]
call fcn.00402e00
mov ebx, eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403bd4
lea eax, [ebp - 0x14c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0044a674
mov eax, dword [ebp - 0x14c]
mov edx, 0x454804
call fcn.00403ecc
je 0x45471e
push dword [ebp - 4]
push 0x454804
push 0x454810
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403e7c
lea eax, [ebp - 8]
mov ecx, 0x454804
mov edx, dword [ebp - 4]
call fcn.00403e08
jmp 0x45472b
lea eax, [ebp - 4]
mov edx, 0x454810
call fcn.00403dc4
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
call fcn.00403f80
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4547c3
mov eax, dword [ebp - 0x148]
add eax, 0xfffffff0
sub eax, 8
jb 0x45475d
add eax, 0xffffffe8
sub eax, 8
jae 0x4547ac
lea eax, [ebp - 0x11c]
cmp eax, 0x2e
je 0x4547ac
lea eax, [ebp - 0x11c]
cmp eax, 0x454814
je 0x4547ac
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403d6c
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 8]
call fcn.00403e08
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x454747
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4547f5
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00403b60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b60
ret

Function at 0x454818
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x45488e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x43
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ce4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4548a4
call fcn.00403e08
mov eax, dword [ebp - 4]
call fcn.00403f80
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x45486d
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00454674
inc ebx
cmp ebx, 0x57
jne 0x454836
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454895
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b60
ret
Function at 0xb66058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b661a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb6607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb6606a
add dl, dl
jne 0xb66089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb660dc
xor eax, eax
add dl, dl
jne 0xb66096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb6617d
add dl, dl
jne 0xb660a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb660b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb660bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb660c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb660d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb66075
mov eax, 1
add dl, dl
jne 0xb660ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb660f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb660e1
sub eax, ebx
mov ebx, 1
jne 0xb66128
mov ecx, 1
add dl, dl
jne 0xb6610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb66119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb66105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb66075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb6613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb6614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb66136
cmp eax, 0x7d00
jae 0xb6616d
cmp eax, 0x500
jb 0xb66168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb66075
cmp eax, 0x7f
ja 0xb66170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb66075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb6619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb66075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x59161c16
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x5dde1a51
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40be10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, 0x446288
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.0040ad60
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
je 0x40bece
xor esi, esi
push edi
lea esp, [esp]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 8]
push edx
push 0
xor ecx, ecx
push 2
test esi, esi
push 0
setne cl
push 0
push 0
push eax
mov dword [ebp - 8], 0
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40bec0
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test edx, edx
jne 0x40be81
lea eax, [edx + 0xd]
jmp 0x40beae
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be86
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x4410a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test edi, edi
je 0x40bec0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
inc esi
cmp esi, 2
jl 0x40be40
pop edi
lea esi, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bee8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8506ef
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0085076e
jae 0x8506fb
xor ecx, ecx
call fcn.0085076e
jae 0x850725
xor eax, eax
call fcn.0085076e
jae 0x850736
mov al, 0x10
call fcn.0085076e
adc al, al
jae 0x850717
jne 0x850763
stosb byte es:[edi], al
jmp 0x8506fc
call fcn.0085077a
dec ecx
loop 0x850742
mov eax, ebp
call fcn.00850778
jmp 0x850764
lodsb al, byte [esi]
shr eax, 1
je 0x85078a
adc ecx, 2
mov ebp, eax
jmp 0x850764
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00850778
cmp eax, 0x7d00
jae 0x850762
cmp eax, 0x500
jae 0x850763
cmp eax, 0x7f
ja 0x850764
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8506fc
pop ebp
ret 8
Function at 0x67e370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x67e38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x6a7074
push ecx
mov edi, eax
call fcn.00692198
mov esi, eax
add esp, 8
test esi, esi
jne 0x67e3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0069202e
push esi
call fcn.00691fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret