joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1018cd3
Capabilities:
Print debug messages
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2148
call fcn.01015e00
mov eax, dword [0x1020204]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push eax
mov dword [ebp - 0x2148], eax
mov dword [ebp - 0x2138], ebx
mov dword [ebp - 0x213c], 1
xor esi, esi
mov dword [ebp - 0x2134], ebx
mov dword [ebp - 0x2140], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x2144], eax
jne 0x1018d4b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01015dd4
leave
ret 8
cmp esi, dword [ebp - 0x2134]
jb 0x1018dab
push ebx
lea eax, [ebp - 0x2134]
push eax
push 0x2000
lea eax, [ebp - 0x2130]
push eax
push dword [ebp - 0x2144]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1018de0
mov eax, dword [ebp - 0x2134]
cmp eax, ebx
je 0x1018dd5
cmp dword [ebp - 0x2140], ebx
jne 0x1018df3
test al, 3
je 0x1018da9
mov dword [ebp - 0x2140], 1
mov byte [ebp + eax - 0x2130], bl
inc eax
test al, 3
jne 0x1018d97
mov dword [ebp - 0x2134], eax
xor esi, esi
mov eax, dword [ebp - 0x213c]
mov ecx, dword [ebp + esi - 0x2130]
imul eax, eax, 0x19660d
imul ecx, eax
add dword [ebp - 0x2138], ecx
mov dword [ebp - 0x213c], eax
add esi, 4
jmp 0x1018d4b
mov eax, dword [ebp - 0x2138]
xor ebx, ebx
mov dword [edi], eax
inc ebx
push dword [ebp - 0x2144]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1018d3a
push dword [ebp - 0x2148]
lea eax, [ebp - 0x130]
push 0x1002790
push 0x12c
push eax
call fcn.010161e1
add esp, 0x10
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1018de0

Function at 0x1018e26
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [0x1021c58], ebx
je 0x1018ea9
cmp dword [0x102052c], 0xffffffff
jne 0x1018e5b
push ebx
push ebx
push 2
push ebx
push 2
push 0x40000000
push 0x10027b8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x102052c], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp + 0xc]
push dword [0x102052c]
call edi
push ebx
lea eax, [ebp + 0x10]
push eax
mov ebx, 0x1001548
push ebx
call esi
push eax
push ebx
push dword [0x102052c]
call edi
push dword [0x102052c]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor eax, eax
pop edi
inc eax
pop esi
jmp 0x1018ec8
xor eax, eax
cmp dword [ebp + 0x10], ebx
setne al
add eax, 0x10
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
dec eax
neg eax
sbb eax, eax
inc eax
pop ebx
pop ebp
ret 0xc
Function at 0x10196a0
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
xor ebx, ebx
cmp esi, ebx
jne 0x10196e4
push dword [ebp + 0x18]
mov esi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call fcn.01019560
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x10196df
push ebx
push 0x100285c
push ebx
call fcn.01018e26
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [eax + 0x14]
jmp 0x1019732
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.01019560
mov edi, eax
cmp edi, ebx
je 0x10196cb
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
jae 0x101971a
cmp dword [esi + 8], ebx
je 0x1019715
push ebx
push 0x100283c
push ebx
call fcn.01018e26
mov dword [esi + 8], edi
jmp 0x101972e
cmp dword [esi + 0xc], ebx
je 0x101972b
push ebx
push 0x100281c
push ebx
call fcn.01018e26
mov dword [esi + 0xc], edi
mov eax, dword [edi + 0x14]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x101c5fd
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0101bcea
mov ebx, eax
cmp ebx, 0xffffffff
je 0x101c6bb
mov eax, dword [ebp + 0x14]
cdq
idiv dword [esi + 0x54]
push edi
push eax
push esi
push dword [ebp + 8]
call fcn.0101bb30
mov edi, eax
cmp edi, dword [esi + 0xc]
jl 0x101c63c
cmp ebx, dword [esi + 0x10]
jge 0x101c642
cmp dword [esi + 0x14], 0
je 0x101c6ba
cmp edi, dword [esi + 4]
jge 0x101c6ba
cmp ebx, dword [esi + 8]
jge 0x101c6ba
push ebx
push edi
push esi
call fcn.0101bb7c
test eax, eax
jne 0x101c693
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x101c674
push 1
push ebx
push edi
push esi
push dword [ebp + 8]
call fcn.0101bfd8
jmp 0x101c693
xor ecx, ecx
inc ecx
test byte [esi + 0x20], cl
je 0x101c683
mov eax, dword [esi + 8]
xor ebx, ebx
jmp 0x101c685
mov eax, ecx
push ecx
push eax
push ecx
push ebx
push edi
push esi
push dword [ebp + 8]
call fcn.0101bbf0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
movzx ecx, word [ebp + 0x14]
movzx edx, word [ebp + 0x10]
shl ecx, 0x10
or ecx, edx
push ecx
push 0
push 0x204
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x101c6c6
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x78], 0
jne 0x101c7a4
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push esi
push ebx
call fcn.0101bcea
mov edi, eax
cmp edi, 0xffffffff
je 0x101c7a2
push edi
push dword [ebp + 0x10]
push esi
push ebx
call fcn.0101bd2c
test eax, eax
jne 0x101c718
test edi, edi
jle 0x101c725
lea eax, [edi - 1]
push eax
push dword [ebp + 0x10]
push esi
push ebx
call fcn.0101bd2c
test eax, eax
je 0x101c725
push dword [ebp + 0x10]
push edi
push esi
push ebx
call fcn.0101be49
jmp 0x101c7a2
mov eax, dword [ebp + 0x14]
cdq
idiv dword [esi + 0x54]
push eax
push esi
push ebx
call fcn.0101bb30
cmp eax, dword [esi + 0xc]
mov dword [ebp + 0xc], eax
jl 0x101c741
cmp edi, dword [esi + 0x10]
jge 0x101c747
cmp dword [esi + 0x14], 0
je 0x101c7a2
cmp eax, dword [esi + 4]
jge 0x101c7a2
cmp edi, dword [esi + 8]
jge 0x101c7a2
push ebx
mov dword [esi + 0x78], 2
call dword [sym.imp.USER32.dll_SetCapture]
test byte [esi + 0x20], 1
je 0x101c76f
mov eax, dword [esi + 8]
xor edi, edi
mov dword [ebp + 0x10], eax
jmp 0x101c776
mov dword [ebp + 0x10], 1
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push 0
jns 0x101c792
push edi
push dword [ebp + 0xc]
push esi
push ebx
call fcn.0101bfd8
jmp 0x101c7a2
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 0xc]
push esi
push ebx
call fcn.0101bbf0
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x101d2e2
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1020204]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x7f02
push 0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x54], 1
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebx
mov ecx, dword [esi + 0x60]
mov edx, dword [esi + 4]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0xc]
sub ecx, eax
sub edx, eax
lea eax, [edx + ecx - 1]
cdq
idiv ecx
mov dword [0x1022424], eax
mov dword [ebp - 0x4c], eax
mov eax, dword [edi + 0x10]
test byte [eax + 0x14], 2
je 0x101d358
mov ecx, eax
movzx edx, word [ecx + 0x18]
movzx ecx, word [ecx + 0x1a]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [eax + 0x10]
mov eax, 0x101c9d0
push eax
push ecx
mov dword [ebp - 0x44], ecx
mov dword [0x1022430], eax
call dword [sym.imp.GDI32.dll_SetAbortProc]
mov eax, 0x1002898
push eax
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x44]
call dword [sym.imp.GDI32.dll_StartDocA]
and dword [0x1021dcc], 0
push 0
push 0x101ca40
push dword [ebp - 0x48]
push 0x100288c
push dword [0x1022448]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
test eax, eax
mov dword [0x102242c], eax
je 0x101d3d9
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp - 0x50]
call ebx
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x4c]
mov dword [0x1022428], eax
jg 0x101d474
mov ebx, 0x1021c60
push 0x3c
lea eax, [ebp - 0x40]
push eax
push 0x193
push dword [0x1022448]
call dword [sym.imp.USER32.dll_LoadStringA]
push dword [0x1022424]
lea eax, [ebp - 0x40]
push dword [0x1022428]
push eax
push 0x100
push ebx
call fcn.010161e1
mov eax, dword [0x102242c]
add esp, 0x14
test eax, eax
je 0x101d43c
push ebx
push 0x66
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [0x1022428]
push edi
push esi
push dword [ebp - 0x48]
call fcn.0101cfff
test eax, eax
mov dword [ebp - 0x50], eax
jl 0x101d465
inc dword [0x1022428]
mov eax, dword [0x1022428]
cmp eax, dword [ebp - 0x4c]
jle 0x101d3f4
jmp 0x101d46e
push dword [ebp - 0x44]
call dword [sym.imp.GDI32.dll_AbortDoc]
cmp dword [ebp - 0x50], 0
jl 0x101d47d
push dword [ebp - 0x44]
call dword [sym.imp.GDI32.dll_EndDoc]
cmp dword [0x102242c], 0
pop edi
pop esi
pop ebx
je 0x101d4a0
push 1
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [0x102242c]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [ebp - 0x44]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01015dd4
leave
ret 0xc
Function at 0x101e3f6
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1020204]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10028b8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101e4cb
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101e4ba
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x101e4a4
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x101e4ba
push eax
push edi
push dword [ebp - 0x110]
call fcn.01013aa1
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x101e4cd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01015dd4
leave
ret 4
Function at 0x17c19
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
nop
push ebp
nop
mov ebp, esp
nop
push ecx
nop
and dword [ebp - 4], 0
nop
push ebx
nop
push esi
nop
push edi
nop
mov esi, 0x1000
nop
push esi
nop
push 0
nop
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov edi, eax
nop
test edi, edi
nop
je 0x17c88
lea eax, [ebp - 4]
nop
push eax
nop
push esi
nop
push edi
nop
push dword [ebp + 8]
nop
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, eax
nop
cmp ebx, 0xc0000004
nop
jne 0x17c75
push 0
nop
push edi
nop
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add esi, esi
nop
test ebx, ebx
nop
jne 0x17c34
mov eax, edi
nop
pop edi
nop
pop esi
nop
pop ebx
nop
leave
nop
ret 4
xor eax, eax
nop
jmp 0x17c7d

Function at 0x17d18
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
nop
push ebp
nop
mov ebp, esp
nop
sub esp, 0xc
nop
push ebx
nop
push edi
nop
xor ebx, ebx
nop
push 5
nop
mov dword [ebp - 4], ebx
nop
mov dword [ebp - 8], ebx
nop
call fcn.00017c19
mov edi, eax
nop
cmp edi, ebx
nop
mov dword [ebp - 0xc], edi
nop
je 0x17e2b
mov eax, dword [edi + 0x3c]
nop
cmp eax, ebx
nop
je 0x17d93
mov ecx, dword [ebp + 8]
nop
mov dx, word [eax]
nop
cmp dx, word [ecx]
nop
jne 0x17d87
cmp dx, bx
nop
je 0x17d82
mov dx, word [eax + 2]
nop
cmp dx, word [ecx + 2]
nop
jne 0x17d87
add eax, 4
nop
add ecx, 4
nop
cmp dx, bx
nop
jne 0x17d58
xor eax, eax
nop
jmp 0x17d8e
sbb eax, eax
nop
sbb eax, 0xffffffff
nop
cmp eax, ebx
nop
je 0x17da4
mov eax, dword [edi]
nop
cmp eax, ebx
nop
je 0x17e1e
add edi, eax
nop
jmp 0x17d4b
cmp dword [edi + 4], ebx
nop
push esi
nop
jbe 0x17df5
lea esi, [edi + 0xd8]
nop
push esi
nop
call fcn.00017c93
test eax, eax
nop
je 0x17de0
mov ecx, dword [0x16d60]
nop
cmp byte [ecx + eax], 1
nop
jne 0x17dd3
mov dword [ebp - 4], eax
nop
jmp 0x17dd7
mov dword [ebp - 8], eax
nop
mov ecx, eax
nop
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
inc ebx
nop
add esi, 0x40
nop
cmp ebx, dword [edi + 4]
nop
jb 0x17db3
mov eax, dword [ebp - 4]
nop
test eax, eax
nop
jne 0x17df9
mov eax, dword [ebp - 8]
nop
push dword [ebp + 0x10]
nop
mov esi, dword [ebp + 0xc]
nop
mov dword [esi], eax
nop
push dword [edi + 0x44]
nop
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
nop
jl 0x17e1c
mov ecx, dword [esi]
nop
call dword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
pop esi
nop
push 0
nop
push dword [ebp - 0xc]
nop
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
nop
mov al, 1
nop
pop ebx
nop
leave
nop
ret 0xc
Function at 0x17e7b
Capabilities:
Attach user process memory

Disassembly:
push 0x3c
nop
push 0x133c8
nop
call fcn.0001ae4a
lea eax, [ebp - 0x30]
nop
push eax
nop
lea eax, [ebp - 0x34]
nop
push eax
nop
push 0x13164
nop
call fcn.00017d18
test al, al
nop
je 0x18023
mov esi, dword [0x134c4]
nop
lea esi, [esi + 0x13488]
nop
mov ebx, dword [esi + 0x50]
nop
mov dword [ebp - 0x2c], ebx
nop
push ebx
nop
xor edi, edi
nop
push edi
nop
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [ebp - 0x24], eax
nop
cmp eax, edi
nop
je 0x18023
push ebx
nop
push edi
nop
push eax
nop
call sub.ntoskrnl.exe_memset
add esp, 0xc
nop
push dword [esi + 0x54]
nop
push 0x13488
nop
push dword [ebp - 0x24]
nop
call fcn.00017e44
mov dword [ebp - 0x20], edi
nop
cmp word [esi + 6], di
nop
jbe 0x17f3e
lea ebx, [esi + 0x10c]
nop
push dword [ebx - 4]
nop
mov eax, dword [ebx]
nop
add eax, 0x13488
nop
push eax
nop
mov eax, dword [ebx - 8]
nop
add eax, dword [ebp - 0x24]
nop
push eax
nop
call fcn.00017e44
add ebx, 0x28
nop
inc dword [ebp - 0x20]
nop
movzx eax, word [esi + 6]
nop
cmp dword [ebp - 0x20], eax
nop
jl 0x17f0d
push 0x30
nop
push edi
nop
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [ebp - 0x1c], eax
nop
cmp eax, edi
nop
je 0x18023
push edi
nop
push edi
nop
push edi
nop
push dword [ebp - 0x2c]
nop
push dword [ebp - 0x24]
nop
call dword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov dword [ebp - 0x20], eax
nop
cmp eax, edi
nop
je 0x18017
mov dword [ebp - 4], edi
nop
xor ebx, ebx
nop
inc ebx
nop
push ebx
nop
push edi
nop
push eax
nop
call dword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
or dword [ebp - 4], 0xffffffff
nop
lea eax, [ebp - 0x4c]
nop
push eax
nop
push dword [ebp - 0x30]
nop
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [ebp - 4], ebx
nop
push 0x10
nop
push edi
nop
push dword [esi + 0x34]
nop
push ebx
nop
push ebx
nop
push dword [ebp - 0x20]
nop
call dword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov dword [ebp - 0x28], eax
nop
or dword [ebp - 4], 0xffffffff
nop
lea eax, [ebp - 0x4c]
nop
push eax
nop
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp dword [ebp - 0x28], edi
nop
je 0x1800d
push edi
nop
push ebx
nop
mov eax, dword [esi + 0x28]
nop
add eax, dword [ebp - 0x28]
nop
push eax
nop
push edi
nop
push 0x109ba
nop
push edi
nop
push dword [ebp - 0x34]
nop
push dword [ebp - 0x1c]
nop
call dword [sym.imp.ntoskrnl.exe_KeInitializeApc]
push edi
nop
push edi
nop
push edi
nop
push dword [ebp - 0x1c]
nop
call dword [sym.imp.ntoskrnl.exe_KeInsertQueueApc]
push dword [ebp - 0x20]
nop
call dword [sym.imp.ntoskrnl.exe_IoFreeMdl]
push edi
nop
push dword [ebp - 0x1c]
nop
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
nop
call fcn.0001ae97
ret
Function at 0x5dc010
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x554015
lea edi, [esi - 0x153015]
push edi
or ebp, 0xffffffff
jmp 0x5dc032
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5dc039
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5dc028
mov eax, 1
add ebx, ebx
jne 0x5dc04b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5dc05c
jne 0x5dc07b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5dc07b
dec eax
add ebx, ebx
jne 0x5dc068
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5dc040
add ebx, ebx
jne 0x5dc077
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5dc0cd
xor ecx, ecx
sub eax, 3
jb 0x5dc093
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5dc102
sar eax, 1
mov ebp, eax
jmp 0x5dc09e
add ebx, ebx
jne 0x5dc09e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5dc06c
inc ecx
add ebx, ebx
jne 0x5dc0ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5dc06c
add ebx, ebx
jne 0x5dc0b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5dc0ae
jne 0x5dc0ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5dc0ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5dc0ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5dc0de
jmp 0x5dc02e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5dc0ec
add edi, ecx
jmp 0x5dc02e
pop esi
mov edi, esi
mov ecx, 0x181a2
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x5dc127
cmp byte [edi], 1
jne 0x5dc10c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x5dc10a
lea edi, [esi + 0x1da000]
mov eax, dword [edi]
or eax, eax
je 0x5dc16f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1dd004]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1dd0b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5dc12d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1dd0bc]
or eax, eax
je 0x5dc169
mov dword [ebx], eax
add ebx, 4
jmp 0x5dc14a
call dword [esi + 0x1dd0c0]
popal
jmp section.code
Function at 0xbc4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bc41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbc407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbc406a
add dl, dl
jne 0xbc4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbc40dc
xor eax, eax
add dl, dl
jne 0xbc4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbc417d
add dl, dl
jne 0xbc40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbc40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbc4075
mov eax, 1
add dl, dl
jne 0xbc40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbc40e1
sub eax, ebx
mov ebx, 1
jne 0xbc4128
mov ecx, 1
add dl, dl
jne 0xbc410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbc4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbc4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbc4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbc413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbc414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbc4136
cmp eax, 0x7d00
jae 0xbc416d
cmp eax, 0x500
jb 0xbc4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbc4075
cmp eax, 0x7f
ja 0xbc4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbc4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbc419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbc4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4014f3
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x14c
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [0x7c2364]
mov dword [ebp - 0x130], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], edx
or eax, 8
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x40156c
jmp 0x401607
cmp dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x1c]
je 0x40155d
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
push ecx
jmp 0x401607
xor ecx, ecx
mov edx, edi
call fcn.004014f3
test eax, eax
je 0x40157d
jmp 0x4015a4
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edi, [ebp - 0x121]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x12c]
sub esp, 0x10
test eax, eax
je 0x40153d
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov dword [esp], 2
call fcn.00407ccb
test eax, eax
push edx
je 0x4015e2
mov edx, dword [0x7c2364]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], edx
call eax
sub esp, 0x10
jmp 0x401607
cmp dword [0x7c2364], 0
mov eax, 1
jne 0x401607
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
push ecx
setne al
push ecx
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403979
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x4039a4
mov eax, dword [0x41884c]
test eax, eax
je 0x403998
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push eax
mov dword [0x41884c], 0
jmp 0x403a13
cmp dword [0x41884c], 0
je 0x4039bc
mov dword [esp], 0
call fcn.0040826c
push ecx
jmp 0x403a13
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x7c23b8]
jbe 0x403a13
mov eax, dword [0x7c23d0]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4038c4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x41884c], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edx
push edx
leave
ret

Function at 0x403a15
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
sub esp, 0x14
test eax, eax
je 0x403a58
xor edx, edx
cmp dword [ebp - 0xc], ebx
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 8