joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6441b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00644140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00644140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00644140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00644140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x644bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x644c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x65687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x644c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x644c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x324890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x3248b3
cmp dword [ebp + 0x10], 0
je 0x3248b3
call fcn.00325b30
test eax, eax
jne 0x3248bb
mov eax, dword [ebp - 8]
jmp 0x32497b
mov byte [ebp - 0x18], 0x7b
mov byte [ebp - 0x17], 0x25
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x7c
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x7c
mov byte [ebp - 0x11], 0x25
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x7d
mov byte [ebp - 0xe], 0
call fcn.00325b30
mov esi, dword [eax + 0x14]
call fcn.00325b30
mov eax, dword [eax + 0x10]
lea ecx, [esi + eax + 0xa]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00327cc0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x324978
call fcn.00325b30
mov eax, dword [eax + 0x18]
push eax
call fcn.00325b30
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00321ab0
mov edx, dword [eax + 0x144]
call edx
add esp, 0x14
cmp eax, 0xffffffff
je 0x324966
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0032c980
add esp, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x324978
mov edx, dword [ebp - 4]
push edx
call fcn.00327bf0
add esp, 4
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x326290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x3262b6
cmp dword [ebp + 0xc], 0
je 0x3262b6
cmp dword [ebp + 0x10], 0
je 0x3262b6
cmp dword [ebp + 0x14], 0
jne 0x3262be
mov eax, dword [ebp - 0x10]
jmp 0x3263ea
mov eax, dword [ebp + 0xc]
push eax
call fcn.00327cc0
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x3263e7
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov dword [ebp - 8], 0
jmp 0x3262f1
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jae 0x3263c6
movzx eax, byte [ebp - 1]
add eax, 1
and eax, 0x800000ff
jns 0x326312
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx ecx, byte [eax + ecx]
movzx edx, byte [ebp - 2]
add ecx, edx
and ecx, 0x800000ff
jns 0x326338
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 2], cl
mov byte [ebp - 3], 0
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov al, byte [edx + eax]
mov byte [ebp - 3], al
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx edx, byte [ebp - 1]
mov esi, dword [ebp + 0x10]
mov esi, dword [esi]
mov al, byte [eax + ecx]
mov byte [esi + edx], al
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dl, byte [ebp - 3]
mov byte [eax + ecx], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [edx + eax]
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
movzx ecx, byte [edx + ecx]
add eax, ecx
and eax, 0x800000ff
jns 0x32639f
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
movzx edx, byte [edx + ecx]
xor eax, edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov byte [ecx], al
jmp 0x3262e8
mov edx, dword [ebp + 0x10]
mov al, byte [ebp - 1]
mov byte [edx + 4], al
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp - 2]
mov byte [ecx + 5], dl
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x327180
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 8], 0
je 0x3271ec
mov eax, dword [ebp + 8]
push eax
call fcn.0032c980
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x3271ec
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x3271ec
mov ecx, dword [ebp - 8]
shr ecx, 8
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
xor eax, dword [ebp - 8]
and eax, 0xff
xor ecx, dword [eax*4 + 0x339460]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x3271ae
mov eax, dword [ebp - 8]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x327200
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 8], 0
je 0x32726c
mov eax, dword [ebp + 8]
push eax
call fcn.0032c9b0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x32726c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x32726c
mov ecx, dword [ebp - 8]
shr ecx, 8
mov edx, dword [ebp - 0xc]
movzx eax, word [edx]
xor eax, dword [ebp - 8]
and eax, 0xff
xor ecx, dword [eax*4 + 0x339460]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0xc], ecx
jmp 0x32722e
mov eax, dword [ebp - 8]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x327280
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 8], 0
je 0x3272f0
cmp dword [ebp + 0xc], 0
je 0x3272f0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
cmp dword [ebp - 0x10], 0
je 0x3272f0
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 1], cl
mov esi, dword [ebp - 8]
shr esi, 8
movzx edx, byte [ebp - 1]
push edx
call fcn.0032d3a0
add esp, 4
movsx eax, al
xor eax, dword [ebp - 8]
and eax, 0xff
xor esi, dword [eax*4 + 0x339460]
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x3272a0
mov eax, dword [ebp - 8]
xor eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x327300
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 8], 0
je 0x327372
cmp dword [ebp + 0xc], 0
je 0x327372
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
cmp dword [ebp - 0x10], 0
je 0x327372
mov eax, dword [ebp - 0xc]
mov cx, word [eax]
mov word [ebp - 2], cx
mov esi, dword [ebp - 8]
shr esi, 8
movzx edx, word [ebp - 2]
push edx
call fcn.0032d3d0
add esp, 4
movzx eax, ax
xor eax, dword [ebp - 8]
and eax, 0xff
xor esi, dword [eax*4 + 0x339460]
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0xc], ecx
jmp 0x327320
mov eax, dword [ebp - 8]
xor eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x327380
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp + 8], 0
je 0x327400
mov eax, dword [ebp + 8]
push eax
call fcn.0032c980
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x327400
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x14], 0
je 0x327400
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov esi, dword [ebp - 0xc]
shr esi, 8
movzx eax, byte [ebp - 1]
push eax
call fcn.0032d3a0
add esp, 4
movsx ecx, al
xor ecx, dword [ebp - 0xc]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x339460]
mov dword [ebp - 0xc], esi
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x3273af
mov eax, dword [ebp - 0xc]
xor eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x327410
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp + 8], 0
je 0x327492
mov eax, dword [ebp + 8]
push eax
call fcn.0032c9b0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x327492
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x14], 0
je 0x327492
mov ecx, dword [ebp - 0x10]
mov dx, word [ecx]
mov word [ebp - 2], dx
mov esi, dword [ebp - 0xc]
shr esi, 8
movzx eax, word [ebp - 2]
push eax
call fcn.0032d3d0
add esp, 4
movzx ecx, ax
xor ecx, dword [ebp - 0xc]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x339460]
mov dword [ebp - 0xc], esi
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x10], edx
jmp 0x32743f
mov eax, dword [ebp - 0xc]
xor eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x32b2c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 4
imul ecx, eax, 0
cmp dword [ecx + 0x342810], 0
jne 0x32b2dc
call fcn.0032b490
cmp dword [0x3431d4], 0x270
jl 0x32b42f
mov dword [ebp - 0xc], 0x7fffffff
mov dword [ebp - 0x10], 0x80000000
mov dword [ebp - 8], 0
jmp 0x32b30c
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xe3
jge 0x32b361
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x342810]
and ecx, 0x80000000
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x342814]
and eax, 0x7fffffff
or ecx, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
shr ecx, 1
mov edx, dword [ebp - 8]
xor ecx, dword [edx*4 + 0x342e44]
mov eax, dword [ebp - 4]
and eax, 1
xor ecx, dword [eax*4 + 0x338044]
mov edx, dword [ebp - 8]
mov dword [edx*4 + 0x342810], ecx
jmp 0x32b303
jmp 0x32b36c
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x26f
jge 0x32b3c2
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*4 + 0x342810]
and edx, 0x80000000
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x342814]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x342484]
mov ecx, dword [ebp - 4]
and ecx, 1
xor edx, dword [ecx*4 + 0x338044]
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x342810], edx
jmp 0x32b363
mov ecx, 4
imul edx, ecx, 0x26f
mov eax, dword [edx + 0x342810]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [edx + 0x342810]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 4], eax
mov edx, 4
imul eax, edx, 0x18c
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, dword [eax + 0x342810]
mov edx, dword [ebp - 4]
and edx, 1
xor ecx, dword [edx*4 + 0x338044]
mov eax, 4
imul edx, eax, 0x26f
mov dword [edx + 0x342810], ecx
mov dword [0x3431d4], 0
mov eax, dword [0x3431d4]
mov ecx, dword [eax*4 + 0x342810]
mov dword [ebp - 4], ecx
mov edx, dword [0x3431d4]
add edx, 1
mov dword [0x3431d4], edx
mov eax, dword [ebp - 4]
shr eax, 0xb
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shl edx, 0xf
and edx, 0xefc60000
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shr eax, 0x12
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x32b490
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], 0x6c078965
call fcn.00321ab0
mov eax, dword [eax + 0x1a4]
call eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x32b4ea
lea ecx, [ebp - 0x18]
push ecx
call fcn.00321ab0
mov edx, dword [eax + 0x198]
call edx
test eax, eax
jne 0x32b4ea
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00321ab0
mov edx, dword [eax + 0x19c]
call edx
movzx eax, al
test eax, eax
je 0x32b4ea
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x32b4f7
mov dword [ebp - 4], 0x1337
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [eax + 0x342810], ecx
mov dword [0x3431d4], 1
jmp 0x32b523
mov edx, dword [0x3431d4]
add edx, 1
mov dword [0x3431d4], edx
cmp dword [0x3431d4], 0x270
jge 0x32b563
mov eax, dword [0x3431d4]
mov ecx, dword [eax*4 + 0x34280c]
shr ecx, 0x1e
mov edx, dword [0x3431d4]
xor ecx, dword [edx*4 + 0x34280c]
imul ecx, dword [ebp - 0x10]
add ecx, dword [0x3431d4]
mov eax, dword [0x3431d4]
mov dword [eax*4 + 0x342810], ecx
jmp 0x32b514
mov dword [ebp - 8], 0
jmp 0x32b575
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x25
jge 0x32b582
call fcn.0032b2c0
jmp 0x32b56c
mov dword [0x34280c], 0
mov esp, ebp
pop ebp
ret
Function at 0x26cb058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.026cb1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x26cb07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x26cb06a
add dl, dl
jne 0x26cb089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x26cb0dc
xor eax, eax
add dl, dl
jne 0x26cb096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x26cb17d
add dl, dl
jne 0x26cb0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26cb0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26cb0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26cb0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x26cb0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x26cb075
mov eax, 1
add dl, dl
jne 0x26cb0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26cb0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x26cb0e1
sub eax, ebx
mov ebx, 1
jne 0x26cb128
mov ecx, 1
add dl, dl
jne 0x26cb10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x26cb119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x26cb105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26cb075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x26cb13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x26cb14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x26cb136
cmp eax, 0x7d00
jae 0x26cb16d
cmp eax, 0x500
jb 0x26cb168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26cb075
cmp eax, 0x7f
ja 0x26cb170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26cb075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x26cb19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x26cb075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xa6b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a6b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa6b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6b06a
add dl, dl
jne 0xa6b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6b0dc
xor eax, eax
add dl, dl
jne 0xa6b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6b17d
add dl, dl
jne 0xa6b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa6b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa6b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa6b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa6b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa6b075
mov eax, 1
add dl, dl
jne 0xa6b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa6b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa6b0e1
sub eax, ebx
mov ebx, 1
jne 0xa6b128
mov ecx, 1
add dl, dl
jne 0xa6b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa6b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa6b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa6b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa6b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa6b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa6b136
cmp eax, 0x7d00
jae 0xa6b16d
cmp eax, 0x500
jb 0xa6b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa6b075
cmp eax, 0x7f
ja 0xa6b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa6b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa6b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa6b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x147c
call fcn.0042beb0
push ebx
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00425710
mov eax, dword [0x43f728]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ecx, ecx
inc ecx
add esp, 0xc
mov dword [ebp - 0x58], 0x44
test byte [eax + 0x56be], cl
mov edi, 0x206
je 0x4010bc
push eax
lea eax, [ebp - 0x1478]
mov dword [ebp - 0x264], ecx
call fcn.004052d3
push edi
lea eax, [ebp - 0x25e]
push esi
push eax
mov word [ebp - 0x260], si
call fcn.00425710
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x784]
mov word [ebp + eax - 0x260], cx
inc eax
inc eax
cmp cx, si
jne 0x40106f
push 0x42f090
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x784]
push eax
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [0x43f728]
test byte [eax + 0x56be], 2
je 0x40113d
push eax
lea eax, [ebp - 0x1478]
mov dword [ebp - 0x264], 2
call fcn.004052d3
push edi
lea eax, [ebp - 0x25e]
push esi
push eax
mov word [ebp - 0x260], si
call fcn.00425710
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x784]
mov word [ebp + eax - 0x260], cx
inc eax
inc eax
cmp cx, si
jne 0x4010f5
push 0x42f0b0
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x784]
push eax
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401142
Capabilities:
Create process on windows
Parse url

Disassembly:
mov eax, 0x42c851
call fcn.0042c0d8
sub esp, 0x14c
push ebx
push esi
call fcn.004040aa
push 0x114
call fcn.0041fb86
pop ecx
mov dword [ebp - 0x14], eax
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x401184
push ebx
push dword [ebp + 8]
mov ebx, eax
call fcn.00406ea2
mov esi, eax
mov dword [ebp - 0x10], esi
xor ebx, ebx
jmp 0x401189
mov dword [ebp - 0x10], ebx
mov esi, ebx
or dword [ebp - 4], 0xffffffff
push 0x864
call fcn.0041fb86
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, ebx
mov dword [ebp - 4], 1
je 0x4011b7
push ebx
push str.install:___uninstall.html
push dword [ebp + 8]
push eax
call fcn.004067e7
jmp 0x4011b9
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xd4], 0xa
je 0x4011cf
mov ecx, eax
mov eax, esi
call fcn.0040868f
push edi
mov edi, dword [0x43f728]
lea eax, [edi + 0x2630]
mov dword [ebp - 0x14], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4011e2
sub eax, edx
je 0x40129a
cmp dword [edi + 0x56c6], ebx
je 0x4012c5
mov esi, 0x103
push esi
lea eax, [ebp - 0x157]
push ebx
push eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x158], bl
call fcn.00425710
mov ecx, dword [ebp - 0x14]
push edi
push fcn.004033c8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x158]
call fcn.004038e1
lea eax, [ebp - 0x158]
add esp, 0x20
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401258
lea ecx, [ebp - 0x54]
push ecx
sub eax, esi
push ebx
push eax
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp dword [ebp - 0x48], 3
je 0x401280
cmp dword [ebp - 0x48], 4
jne 0x401297
push 1
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, dword [ebp - 0x10]
push 0x864
call fcn.0041fb86
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov dword [ebp - 4], 3
pop edi
je 0x401311
push ebx
push str.install:___uninstall_marketing.html
push dword [ebp + 8]
push eax
call fcn.004067e7
jmp 0x401313
push 0x864
call fcn.0041fb86
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov dword [ebp - 4], 2
je 0x4012f7
mov ecx, dword [0x43f728]
push ebx
add ecx, 0x2630
push ecx
push dword [ebp + 8]
push eax
call fcn.004067e7
jmp 0x4012f9
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xd4], 0xa
je 0x40129a
mov ecx, eax
mov eax, esi
call fcn.0040868f
jmp 0x40129a
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xd4], 0xa
je 0x401329
mov ecx, eax
mov eax, esi
call fcn.0040868f
call fcn.00408c62
test eax, eax
je 0x401349
push ebx
push ebx
push dword [0x43f728]
push 0x12
call fcn.00403969
add esp, 0x10
call fcn.004015ab
mov esi, dword [ebp - 0x10]
call fcn.0040135f
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret