joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0x408962
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
call fcn.0040898d
sub esi, edx
add edx, 0x14f44e7e
xor dword [edi], eax
sub edx, 0x48077e08
inc esi
inc edi
mov esi, 0xcbdd8a7d
and edx, esi
cmp edi, ecx
jne fcn.00408962
sub edx, esi
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
mov dword [0x402452], eax
mov edx, eax
xor edi, edi
push 2
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor esi, esi
push dword [0x403583]
call dword [sym.imp.winmm.dll_waveOutClose]
add eax, 6
test eax, 0xb
jne 0x401036
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x100021e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x10026470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14c], 0xffffffff
lea eax, [ebp - 0x148]
push eax
push str.c:.
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
jne 0x10002225
or eax, 0xffffffff
jmp 0x1000227c
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1000226d
push str.jevjxxpzmot
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1000226b
mov ecx, dword [ebp + 8]
mov dx, word [ebp - 0x11c]
mov word [ecx + 0xe6], dx
mov eax, 1
jmp 0x1000227c
jmp 0x10002225
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007df5
mov esp, ebp
pop ebp
ret

Function at 0x10002450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d16e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10026470]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10028d6c]
and eax, 1
jne 0x100024b5
mov ecx, dword [0x10028d6c]
or ecx, 1
mov dword [0x10028d6c], ecx
mov dword [ebp - 4], 0
push 0x104
call fcn.10007ace
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [0x10028d68], edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x100210b8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100024e9
mov eax, dword [0x10028d68]
jmp 0x1000253d
cmp dword [ebp - 0x10], 3
je 0x100024f3
xor eax, eax
jmp 0x1000253d
cmp dword [0x10028d68], 0
je 0x10002538
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x10028d68]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push str.ueZVqBttHwA
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000252e
mov eax, dword [0x10028d68]
jmp 0x1000253d
cmp dword [ebp - 0x10], 3
je 0x10002538
xor eax, eax
jmp 0x1000253d
mov eax, dword [0x10028d68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100027b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x100]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x101]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
test edx, edx
jbe 0x10002860
mov ecx, dword [ebp - 0xc]
add ecx, 1
and ecx, 0xff
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
and ecx, 0xff
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0xc]
mov dl, byte [ebp - 0x14]
mov byte [ecx], dl
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
mov cl, byte [ebp - 4]
mov byte [eax], cl
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
and edx, 0xff
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
jmp 0x100027d6
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0xc]
mov byte [eax + 0x100], cl
mov edx, dword [ebp + 8]
mov al, byte [ebp - 8]
mov byte [edx + 0x101], al
mov esp, ebp
pop ebp
ret
Function at 0x10006110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d348
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10026470]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x44], 0
je 0x10006150
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x1000615c
mov al, 1
jmp 0x100062ff
mov dword [ebp - 0x10], 8
call fcn.10001210
push eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10001210
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.100011c0
add esp, 8
movzx eax, al
test eax, eax
je 0x1000619f
xor al, al
jmp 0x100062ff
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.100053b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x34]
call fcn.10005540
mov ecx, eax
call fcn.100064a0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.10003a80
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x34]
call fcn.10005540
mov ecx, eax
call fcn.100064a0
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x58]
mov ecx, dword [edx + 0x44]
call fcn.10006ac0
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x1000621a
cmp dword [ebp - 0x5c], 1
je 0x10006221
cmp dword [ebp - 0x5c], 3
je 0x100062bb
jmp 0x100062d3
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.10005540
mov ecx, eax
call fcn.100064a0
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x10006284
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.10005540
mov ecx, eax
call fcn.100064a0
push eax
call fcn.10009164
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10006284
mov byte [ebp - 0x51], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10003a60
mov al, byte [ebp - 0x51]
jmp 0x100062ff
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x100062a7
mov byte [ebp - 0x52], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10003a60
mov al, byte [ebp - 0x52]
jmp 0x100062ff
cmp dword [ebp - 0x38], 0
jne 0x100062b9
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.10005430
jmp 0x100062eb
mov byte [ebp - 0x53], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10003a60
mov al, byte [ebp - 0x53]
jmp 0x100062ff
mov byte [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10003a60
mov al, byte [ebp - 0x54]
jmp 0x100062ff
jmp 0x100061b2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10007df5
mov esp, ebp
pop ebp
ret

Function at 0x10007df5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10026470]
jne 0x10007dff
repz ret
jmp fcn.1000b806
Function at 0x100157c3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10026470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000ccdc
and dword [ebp - 0x14], 0
cmp dword [0x10028654], 0
mov dword [ebp - 0x18], eax
jne 0x10015876
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1001591e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1001591e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10028654], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10028658], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1002865c], eax
call edi
push eax
call esi
mov dword [0x10028664], eax
test eax, eax
je 0x10015876
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10028660], eax
mov eax, dword [0x10028660]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100158cf
cmp dword [0x10028664], ecx
je 0x100158cf
push eax
call esi
push dword [0x10028664]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100158cf
test ebx, ebx
je 0x100158cf
call edi
test eax, eax
je 0x100158c6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100158c6
test byte [ebp - 8], 1
jne 0x100158cf
or dword [ebp + 0x10], 0x200000
jmp 0x10015902
mov eax, dword [0x10028658]
cmp eax, dword [ebp - 0x18]
je 0x10015902
push eax
call esi
test eax, eax
je 0x10015902
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10015902
mov eax, dword [0x1002865c]
cmp eax, dword [ebp - 0x18]
je 0x10015902
push eax
call esi
test eax, eax
je 0x10015902
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10028654]
call esi
test eax, eax
je 0x1001591e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10015920
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007df5
leave
ret
Function at 0x401031
Capabilities:
Create thread

Disassembly:
call sub.COMCTL32.DLL_InitCommonControls
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x405e24], eax
push 0
push 0x401031
push 0
push 0x3e8
push dword [0x405e24]
call sub.USER32.DLL_DialogBoxParamA
push 0
call sub.KERNEL32.DLL_ExitProcess
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x110
jne 0x401096
push 0x405d51
push 0x3ff
push dword [ebp + 8]
call sub.USER32.DLL_SetDlgItemTextA
push 1
push 0x7cf
push 0x405582
call fcn.00401566
push eax
push 1
push 0x80
push dword [ebp + 8]
call sub.USER32.DLL_SendMessageA
xor eax, eax
push 0x405e5a
push eax
push dword [ebp + 8]
push 0x4010ee
push eax
push eax
call sub.KERNEL32.DLL_CreateThread
mov dword [0x405e5e], eax
push 0xfffffffffffffffe
push eax
call sub.KERNEL32.DLL_SetThreadPriority
jmp 0x4010e8
cmp dword [ebp + 0xc], 0x111
jne 0x4010d8
mov eax, dword [ebp + 0x10]
cmp ax, 0x3ea
jne 0x4010c5
shr eax, 0x10
cmp ax, 0x300
jne 0x4010e8
push 0x405d72
push 0x3ef
push dword [ebp + 8]
call sub.USER32.DLL_SetDlgItemTextA
jmp 0x4010e8
cmp dword [ebp + 0x10], 0x3e9
jne 0x4010e8
push dword [ebp + 8]
call fcn.004011cf
jmp 0x4010e8
cmp dword [ebp + 0xc], 0x10
jne 0x4010e8
push 0
push dword [ebp + 8]
call sub.USER32.DLL_EndDialog
xor eax, eax
leave
ret 0x10
Function at 0x401566
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
call fcn.00401757
cmp dword [ebp + 8], 0
je 0x401751
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [0x406f14], edx
mov dword [0x406f20], edx
mov dword [0x406f18], eax
dec cl
mov esi, 0x405dd0
js 0x4015ab
mov esi, 0x405dc0
je 0x4015ab
mov esi, 0x405de0
mov edi, 0x406f04
lea ecx, [eax + 4]
rep movsd dword es:[edi], dword [esi]
push eax
push eax
push eax
lea edx, [ebp - 0x12]
push edx
dec eax
push eax
mov dword [ebp - 0x12], 0x20001
mov dword [ebp - 6], 0x100004
mov dword [ebp - 0xe], 0xac44
mov dword [ebp - 0xa], 0x2b110
push 0x406f00
call sub.WINMM.DLL_waveOutOpen
test eax, eax
cdq
xchg edx, eax
jne 0x401751
push 0x14b
push pe_nt_image_headers32
call sub.KERNEL32.DLL_LocalAlloc
xchg edi, eax
push dword [ebp + 8]
call dword [0x406f04]
push edi
call fcn.004031d0
test eax, eax
jne 0x401616
push edi
call fcn.00401757
xor edi, edi
call dword [0x406f08]
pop ecx
pop ecx
xchg edi, eax
test eax, eax
mov dword [0x406ef4], eax
je 0x401751
xchg esi, eax
mov ecx, 0x1500
xor eax, eax
mov edi, 0x4070c0
rep stosd dword es:[edi], eax
mov ecx, 0x418
mov edi, 0x405e70
rep stosd dword es:[edi], eax
mov eax, 0x40c4c0
dec cl
cdq
inc edx
sub eax, 0x54
mov dword [eax], ecx
mov dword [eax + 0x30], edx
dec ecx
jns 0x401650
lea edi, [esi + 0x12a]
mov dword [edi + 0x18], ecx
mov dword [edi + 0x14], ecx
dec edx
mov dword [esi + 8], edx
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
mov dword [edi], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x1c], edx
movzx ecx, word [esi + 0x1c]
test ecx, ecx
je 0x401692
mov dword [edx + 0x405e73], eax
add eax, 0x54
add edx, 0x83
loop 0x401681
mov word [ebp - 2], cx
movsx eax, word [esi + 0x22]
mov dword [edi + 4], eax
movsx eax, word [esi + 0x24]
mov dword [edi - 4], 0x40
mov dword [0x406f34], esi
push eax
push esi
call fcn.00401550
mov edi, sub.KERNEL32.DLL_LocalAlloc
push 0x258
push pe_nt_image_headers32
call edi
mov dword [0x406f30], eax
mov esi, 0x406ed0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, 0x56540
mov dword [esi + 4], eax
push eax
push pe_nt_image_headers32
call edi
or dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x20], eax
mov dword [esi], eax
mov dword [esi + 0x10], 0xc
push 0x20
push esi
push dword [0x406f00]
call sub.WINMM.DLL_waveOutPrepareHeader
push 0xacb80
push pe_nt_image_headers32
call edi
xor edi, edi
mov dword [0x406f28], eax
add eax, 0xf
and al, 0xf0
mov dword [0x406f2c], eax
call fcn.0040188b
cmp dword [0x406f38], edi
jne 0x401718
push 0x20
push esi
push dword [0x406f00]
call sub.WINMM.DLL_waveOutWrite
mov dword [0x406f24], edi
lea eax, [ebp + 8]
push eax
push edi
push edi
push 0x4019af
push edi
push edi
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
leave
ret 0xc
Function at 0x429d30
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00429daf
jae 0x429d3c
xor ecx, ecx
call fcn.00429daf
jae 0x429d66
xor eax, eax
call fcn.00429daf
jae 0x429d77
mov al, 0x10
call fcn.00429daf
adc al, al
jae 0x429d58
jne 0x429da4
stosb byte es:[edi], al
jmp 0x429d3d
call fcn.00429dbb
dec ecx
loop 0x429d83
mov eax, ebp
call fcn.00429db9
jmp 0x429da5
lodsb al, byte [esi]
shr eax, 1
je 0x429dcb
adc ecx, 2
mov ebp, eax
jmp 0x429da5
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00429db9
cmp eax, 0x7d00
jae 0x429da3
cmp eax, 0x500
jae 0x429da4
cmp eax, 0x7f
ja 0x429da5
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x429d3d
pop ebp
ret 8
Function at 0x4016c0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4016d2
mov eax, dword [0x68509f]
shl eax, 2
mov dword [0x6850a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov edx, eax
call fcn.00673100
pop edx
call fcn.00672d00
call fcn.0067361c
push 0
call fcn.006749fc
pop ecx
push 0x685048
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x6850a7], eax
push 0
jmp fcn.0067e74c

Function at 0x5b6d40
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b6dde
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x5b6da2
cmp byte [ebx + 0x10], 0
jne 0x5b6da2
cmp byte [ebx + 0x3c], 0
jne 0x5b6da2
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
je 0x5b6dc3
lea edx, [ebp - 4]
mov eax, dword [0x721194]
call fcn.005e2b3c
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x5a79a4]
call fcn.005cadd4
call fcn.005de9c4
jmp 0x5b6dc3
lea edx, [ebp - 8]
mov eax, dword [0x721194]
call fcn.005e2b3c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x5a79a4]
call fcn.005cadd4
call fcn.005de9c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b6de5
lea eax, [ebp - 8]
mov edx, 2
call fcn.005df8cc
ret

Function at 0x5b765c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x5b76aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.005b6cc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b76c3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5bc64c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5bc7c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.005df928
mov eax, dword [ebp - 4]
call fcn.005bbee4
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x5bc69e
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.005e00e4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.005bd2f8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x5bc77d
xor eax, eax
push ebp
push 0x5bc776
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.005bc24c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.005bc7fc
test al, al
je 0x5bc754
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.005dfa10
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x5bc754
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.005df960
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.005bc1ac
test al, al
je 0x5bc74e
mov eax, dword [ebp - 8]
call fcn.005df960
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.005dfa80
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.005bc64c
dec ebx
cmp ebx, 0xffffffff
jne 0x5bc6fd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bc77d
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.005bc24c
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
call fcn.005df960
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.005bc238
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.005bc1ac
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bc7ce
lea eax, [ebp - 0x3c]
call fcn.005df8c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.005df8cc
ret

Function at 0x5bd1d4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.005bbf58
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.005df960
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.005bc1ac
test al, al
jne 0x5bd23c
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x721168]
mov dl, 1
mov eax, dword [0x5bad08]
call fcn.005cafd8
call fcn.005de9c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8