joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401c66
pop dword [ebp - 0x24]
mov eax, 0x4ff4b6ba
sub eax, 0x4fb49a54
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x718ee23a
add dword [ebp - 0x34], 0xdcc36311
mov dword [ebp - 0x30], 0x2336999b
add dword [ebp - 0x30], 0xefcb2aa
mov dword [ebp - 0x2c], 0xf706e94c
add dword [ebp - 0x2c], 0x55455ae2
mov dword [ebp - 0x28], 0x4af355f4
add dword [ebp - 0x28], 0xb50caa0c
lea eax, [ebp - 0x34]
push eax
mov eax, 0x9d30fa9e
sub eax, 0x9cf0ca4a
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x2d32ad8c
sub dword [ebp - 0x34], 0xb8c04436
mov dword [ebp - 0x30], 0x6d8e3067
sub dword [ebp - 0x30], 0x2c21cef2
mov dword [ebp - 0x2c], 0x4123ef52
add dword [ebp - 0x2c], 0x224b7d1a
mov dword [ebp - 0x28], 0x264bc231
add dword [ebp - 0x28], 0xd9b43dcf
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xbde39314
add eax, 0x425c9d18
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x2f31a
push 0
call eax
mov ecx, 0x2ada
mov esi, eax
mov edi, 0x6451a6de
sub edi, 0x641136de
add edi, dword [ebp - 0x24]
mov edx, 0x5ae8f0bc
mov dword [ebp - 0x10], 0xb966677d
mov ebx, dword [edi]
add dword [ebp - 0x20], eax
sub ebx, edx
mov dword [ebp - 0x1c], 0xfd350ea0
mov dword [esi], ebx
xor dword [ebp - 0x1c], edi
add esi, 0xcfc90909
sub esi, 0xcfc90905
add edi, 0x6e0f3dc4
add edi, 0x91f0c240
loop 0x401d7c
add eax, 0xed4f394f
add eax, 0x12b164ec
mov ebx, eax
add eax, 5
mov ecx, 0xc8f94389
sub ecx, 0xc8b94389
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x40bfb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40bfd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40bfd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40bfc8
mov eax, 1
add ebx, ebx
jne 0x40bfeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40bfe0
jne 0x40bffc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40bfe0
xor ecx, ecx
sub eax, 3
jb 0x40c010
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c082
mov ebp, eax
add ebx, ebx
jne 0x40c01b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c028
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c04c
inc ecx
add ebx, ebx
jne 0x40c038
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c02d
jne 0x40c049
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c02d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c06c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c05d
jmp 0x40bfce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c06c
add edi, ecx
jmp 0x40bfce
pop esi
mov edi, esi
mov ecx, 0xe4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c08a
cmp byte [edi], 1
jne 0x40c08a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40c08f
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40c0fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc290]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c0bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc294]
or eax, eax
je 0x40c0f8
mov dword [ebx], eax
add ebx, 4
jmp 0x40c0d9
call dword [esi + 0xc2a4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40c12f
cmp al, 0xef
ja 0x40c122
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40c104
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40c111
mov ebp, dword [esi + 0xc298]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c163
sub esp, 0xffffff80
jmp 0x402ba8
Function at 0x40f9c5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ecx
push ebx
push ebp
xor ebp, ebp
push edi
mov ecx, ebp
movzx eax, byte [ecx + str.cw]
mov byte [eax + 0x4470f0], cl
inc ecx
cmp ecx, 0x100
jl 0x40f9ce
mov al, byte [ebp + str.cw]
mov byte [esp + 0x10], al
push 2
push dword [esp + 0x14]
mov byte [ebp*4 + 0x447df1], al
mov byte [ebp*4 + 0x447df0], al
mov byte [ebp*4 + 0x4479f3], al
mov byte [ebp*4 + 0x4479f0], al
mov byte [ebp*4 + 0x4475f3], al
mov byte [ebp*4 + 0x4475f2], al
mov byte [ebp*4 + 0x4471f2], al
mov byte [ebp*4 + 0x4471f1], al
call fcn.0041020a
push 3
push dword [esp + 0x14]
mov byte [ebp*4 + 0x447df3], al
mov byte [ebp*4 + 0x4479f2], al
mov byte [ebp*4 + 0x4475f1], al
mov byte [ebp*4 + 0x4471f0], al
call fcn.0041020a
mov bl, byte [ebp + 0x4470f0]
push 0xb
mov byte [esp + 0x10], bl
push dword [esp + 0x10]
mov byte [ebp*4 + 0x447df2], al
mov byte [ebp*4 + 0x4479f1], al
mov byte [ebp*4 + 0x4475f0], al
mov byte [ebp*4 + 0x4471f3], al
call fcn.0041020a
movzx edi, bl
push 9
push dword [esp + 0x10]
mov byte [ebp*4 + 0x448df2], al
mov byte [ebp*4 + 0x4489f1], al
mov byte [ebp*4 + 0x4485f0], al
mov byte [ebp*4 + 0x4481f3], al
mov byte [edi*4 + 0x449df2], al
mov byte [edi*4 + 0x4499f1], al
mov byte [edi*4 + 0x4495f0], al
mov byte [edi*4 + 0x4491f3], al
call fcn.0041020a
push 0xd
push dword [esp + 0x10]
mov byte [ebp*4 + 0x448df0], al
mov byte [ebp*4 + 0x4489f3], al
mov byte [ebp*4 + 0x4485f2], al
mov byte [ebp*4 + 0x4481f1], al
mov byte [edi*4 + 0x449df0], al
mov byte [edi*4 + 0x4499f3], al
mov byte [edi*4 + 0x4495f2], al
mov byte [edi*4 + 0x4491f1], al
call fcn.0041020a
push 0xe
push dword [esp + 0x10]
mov byte [ebp*4 + 0x448df1], al
mov byte [ebp*4 + 0x4489f0], al
mov byte [ebp*4 + 0x4485f3], al
mov byte [ebp*4 + 0x4481f2], al
mov byte [edi*4 + 0x449df1], al
mov byte [edi*4 + 0x4499f0], al
mov byte [edi*4 + 0x4495f3], al
mov byte [edi*4 + 0x4491f2], al
call fcn.0041020a
mov byte [ebp*4 + 0x448df3], al
mov byte [ebp*4 + 0x4489f2], al
mov byte [ebp*4 + 0x4485f1], al
mov byte [ebp*4 + 0x4481f0], al
inc ebp
mov byte [edi*4 + 0x449df3], al
mov byte [edi*4 + 0x4499f2], al
mov byte [edi*4 + 0x4495f1], al
mov byte [edi*4 + 0x4491f0], al
cmp ebp, 0x100
jl 0x40f9e4
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x41eb3b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041fe40
cmp byte [0x453898], 0
je 0x41ebca
cmp word [0x45389a], 0
je 0x41ebca
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x45389a
call fcn.0041d6d4
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41ebc9
push dword [ebp + 8]
call fcn.00424e13
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x41ebce
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041fe40
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.00411688
mov esi, eax
test esi, esi
je 0x41ec26
movzx ecx, word [esi]
push ecx
jmp 0x41ec11
add esi, 2
movzx eax, word [esi]
push eax
call fcn.004117a4
test al, al
jne 0x41ec0a
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
leave
ret 4

Function at 0x428888
Capabilities:
Enumerate pe sections

Disassembly:
dec esp
and al, 8
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4288c2
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4288a9
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4288ba
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4288c4
inc edi
add eax, 0x28
cmp edi, esi
jb 0x42889f
xor eax, eax
pop edi
pop esi
ret

Function at 0x428c1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
cmpsb byte [esi], byte es:[edi]
inc ecx
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00428847
cmovnp esp, dword [edx + 0x7c858d42]
invalid
ja 0x428cd5
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
Function at 0x428c7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00428857
push eax
push esi
push dword [ebp + 8]
call fcn.0042880c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00428847
je 0x428d0d
je 0x428c72
invalid
popfd
invalid

Function at 0x428ed5
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x428efb
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x428ef6
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x428ee0
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x428ee8
cmp edx, ebx
jne 0x429036
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x428eb7
add eax, dword [eax + 4]
jmp 0x428ea4
mov dword [ebp + 0xc], ebx
jmp 0x428f06
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x428f1e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x428f3c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x428f9a
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x428f81
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x428f8a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x428f94
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x428f76
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x428f00
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x428fe7
dec eax
je 0x428fde
sub eax, 3
je 0x428fd5
mov dword [ebp - 4], 0x40
jmp 0x429004
mov dword [ebp - 4], 4
jmp 0x428fea
mov dword [ebp - 4], 0x20
jmp 0x428fea
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x429036
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x428fb6
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00428847
nop
fist word [esi]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x429042
push 0x8000
push ebx
push esi
call dword [ebp - 8]
Function at 0x429152
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
invalid
test dword [edi - 4], eax
invalid

Function at 0x429c7e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x429c9d
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
dec dword [edi]
mov esi, 0xc133dc4d
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x429c47
call fcn.00428847
out dx, al
dec edx
inc eax
scasd eax, dword es:[edi]
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
invalid
Function at 0x10192d41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10192d50
pop dword [ebp - 0x40]
mov eax, 0x10192d50
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xbeee3fa6
sub dword [ebp - 0x50], 0x709bfa5b
mov dword [ebp - 0x4c], 0x77c021a1
sub dword [ebp - 0x4c], 0x458cd55c
mov dword [ebp - 0x48], 0xe2245376
sub dword [ebp - 0x48], 0x95d80f48
mov dword [ebp - 0x44], 0x104179cc
add dword [ebp - 0x44], 0xefbe8634
lea eax, [ebp - 0x50]
push eax
mov eax, 0xa7822560
sub eax, 0x97652330
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xd90185dd
sub dword [ebp - 0x50], 0x648f1c87
mov dword [ebp - 0x4c], 0x7aea81a0
add dword [ebp - 0x4c], 0xc681dfd5
mov dword [ebp - 0x48], 0x7be52bdd
add dword [ebp - 0x48], 0xe78a408f
mov dword [ebp - 0x44], 0x96aca041
add dword [ebp - 0x44], 0x69535fbf
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xa5a26a49
add eax, 0x6a7a97ef
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x36bba
push 0
call eax
mov ecx, 0x4235eff3
add ecx, 0xbdca5913
xor esi, esi
add esi, eax
mov edx, 0x13da9072
sub edx, 0x3bc0272
add edx, dword [ebp - 0x40]
mov edi, 0x6abde2aa
sub edi, 0x86826854
add dword [ebp - 0x2c], 0xfa2a90b1
mov ebx, dword [edx]
add dword [ebp - 0x14], eax
xor ebx, edi
add dword [ebp - 0x24], edx
mov dword [esi], ebx
add esi, 0xced9039
sub esi, 0xced9035
add edx, 4
loop 0x10192e6f
add eax, 0x95fa6c37
sub eax, 0x95f9554c
mov ebx, eax
add eax, 0x70291b59
add eax, 0x8fd6e4ac
mov ecx, 0xbaeb356f
sub ecx, 0xaaeb356f
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4586c3
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00458742
jae 0x4586cf
xor ecx, ecx
call fcn.00458742
jae 0x4586f9
xor eax, eax
call fcn.00458742
jae 0x45870a
mov al, 0x10
call fcn.00458742
adc al, al
jae 0x4586eb
jne 0x458737
stosb byte es:[edi], al
jmp 0x4586d0
call fcn.0045874e
dec ecx
loop 0x458716
mov eax, ebp
call fcn.0045874c
jmp 0x458738
lodsb al, byte [esi]
shr eax, 1
je 0x45875e
adc ecx, 2
mov ebp, eax
jmp 0x458738
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0045874c
cmp eax, 0x7d00
jae 0x458736
cmp eax, 0x500
jae 0x458737
cmp eax, 0x7f
ja 0x458738
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4586d0
pop ebp
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4061e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x478a0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046d86e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x406262
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046b780
mov eax, dword [eax]
push 0x5b0c58
push eax
call fcn.0045e494
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046daf9
test bl, bl
je 0x406262
push 0x5b0c58
lea ecx, [esp + 0xc]
call fcn.0046de89
push 0x5b0c64
lea ecx, [esp + 0xc]
call fcn.0046de89
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40629e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046daf9
jmp 0x406369
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x406322
lea edx, [esp + 0x7c]
push 0x5b0c60
push edx
call fcn.0045e494
add esp, 8
test eax, eax
je 0x406322
lea eax, [esp + 0x7c]
push 0x5b0c5c
push eax
call fcn.0045e494
add esp, 8
test eax, eax
je 0x406322
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4062b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046daf9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x406b70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x406bd2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x406be0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x478a8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5ba594]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x406d18
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x406c46
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046daf9
xor eax, eax
jmp 0x406d8f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046dc36
push esi
lea ecx, [esp + 0xc]
call fcn.0046dec5
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x406d6d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00406b70
test eax, eax
jne 0x406d6d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00406b70
test eax, eax
jne 0x406d6d
lea eax, [esp + 0x14]
push 0x5b0c74
push eax
call fcn.0045f510
mov esi, eax
add esp, 8
test esi, esi
jne 0x406d4c
lea ecx, [esp + 0x14]
push 0x5b0c70
push ecx
call fcn.0045f490
mov esi, eax
add esp, 8
test esi, esi
jne 0x406d4c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x406d4f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046dbe6
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x406c5e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046daf9
xor eax, eax
jmp 0x406d8f
mov byte [esi], 0
push 0x5b0c6c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046daf9
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4