joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466f78
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.0040388c
ret

Function at 0x467364
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor edx, edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4675db
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4675f0
call fcn.004671cc
lea eax, [ebp - 0x3f0]
call fcn.004050b0
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.00405540
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46759c
xor eax, eax
push ebp
push 0x467595
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x467630
call fcn.004671cc
mov eax, dword [ebp - 0x408]
call fcn.00405540
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x467467
push ebp
mov eax, 0x46765c
call fcn.004672bc
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x40c]
mov eax, 0x467668
call fcn.004671cc
mov eax, dword [ebp - 0x40c]
call fcn.00405540
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4674f1
push dword [ebp - 0x3f0]
push 0x467690
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405320
push dword [ebp - 0x410]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.00405444
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x414]
mov eax, 0x46769c
call fcn.004671cc
mov eax, dword [ebp - 0x414]
call fcn.00405540
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46757b
push dword [ebp - 0x3f0]
push 0x467690
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405320
push dword [ebp - 0x418]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.00405444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46759c
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.00405104
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4675e2
lea eax, [ebp - 0x418]
mov edx, 5
call fcn.004050d4
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.004050d4
ret
Function at 0x467ba8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405530
mov eax, dword [ebp - 8]
call fcn.00405530
mov ebx, 0x476da0
xor eax, eax
push ebp
push 0x467dac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
call fcn.004095d8
add eax, dword [0x476e28]
lea edx, [ebp - 0x1c]
call fcn.0040949c
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00405104
xor edx, edx
push ebp
push 0x467d74
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x417590]
call fcn.0041b6c8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00409968
test al, al
je 0x467c3a
mov eax, dword [ebp - 8]
call fcn.00405540
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00405540
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x417590]
call fcn.0041b6c8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x467d63
push dword fs:[eax]
mov dword fs:[eax], esp
mov cx, 2
mov edx, 0xfffffffc
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041b440
mov eax, dword [ebx]
call fcn.004095d8
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, 8
add edx, eax
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebx]
call fcn.004095d8
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041b4b0
mov eax, dword [ebx]
call fcn.004095d8
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, 0xc
add edx, eax
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041b440
mov eax, dword [ebx]
call fcn.004095d8
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, 0xc
add edx, eax
add edx, dword [ebp - 0x18]
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041b4b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467d6a
mov eax, dword [ebp - 0x10]
call fcn.00404284
mov eax, dword [ebp - 0xc]
call fcn.00404284
ret
Function at 0x467dbc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405530
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x467f24
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00465934
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00465954
mov ebx, eax
jmp 0x467ef6
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405320
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409c7c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408e18
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408e18
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004054d8
je 0x467ed6
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405320
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408e18
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408e18
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004054d8
jne 0x467eeb
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.00465974
mov ebx, eax
test ebx, ebx
jne 0x467e37
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467f2b
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004050d4
lea eax, [ebp - 4]
call fcn.004050b0
ret
Function at 0x467f34
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x467f3c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x46815a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x468170
call fcn.00465dc8
test al, al
jne 0x467f6c
mov eax, 0x468170
call fcn.00409e18
mov eax, dword [0x476da8]
mov edx, 0x468188
call fcn.004054d8
jne 0x46813f
lea eax, [ebp - 4]
call fcn.00469180
push dword [ebp - 4]
lea edx, [ebp - 0xc]
mov eax, dword [0x471bd4]
mov eax, dword [eax]
call fcn.00463f4c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00467b00
push dword [ebp - 8]
push dword [0x476db0]
mov eax, 0x476df0
mov edx, 3
call fcn.00405444
lea edx, [ebp - 0x10]
mov eax, dword [0x476db0]
call fcn.00408ea0
mov eax, dword [ebp - 0x10]
mov edx, 0x468194
call fcn.004054d8
jne 0x468029
mov eax, 0x4681a4
call fcn.00465dc8
test al, al
jne 0x467ff2
mov eax, 0x4681a4
call fcn.00409e18
push 0x4681c0
lea edx, [ebp - 0x18]
mov eax, dword [0x471bd4]
mov eax, dword [eax]
call fcn.00463f4c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00467b00
push dword [ebp - 0x14]
push dword [0x476db0]
mov eax, 0x476df0
mov edx, 3
call fcn.00405444
mov edx, dword [0x476df0]
mov eax, dword [0x476dc8]
call fcn.00467ba8
mov eax, dword [0x476da8]
mov edx, 0x468188
call fcn.004054d8
jne 0x46813f
mov eax, dword [0x476df0]
call fcn.00409968
test al, al
je 0x46813f
mov eax, 0x4681dc
call fcn.00467dbc
mov edx, 6
mov eax, dword [0x476df0]
call fcn.00409aa8
push 1
lea edx, [ebp - 0x20]
mov eax, dword [0x471bd4]
mov eax, dword [eax]
call fcn.00463f4c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409c48
mov eax, dword [ebp - 0x1c]
call fcn.00405540
push eax
push 0x4681f0
push dword [0x476df0]
push 0x4681f0
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405444
mov eax, dword [ebp - 0x24]
call fcn.00405540
push eax
push 0x4681f4
push 0x468200
push 0
call sub.shell32.dll_ShellExecuteA
lea edx, [ebp - 0x28]
mov eax, dword [0x476df0]
call fcn.0046e6f8
mov edx, dword [ebp - 0x28]
mov eax, 0x476e20
call fcn.00405104
mov eax, dword [0x476d74]
mov eax, dword [eax + 0x380]
mov dl, 1
call fcn.00435e88
mov eax, dword [0x476d74]
mov eax, dword [eax + 0x37c]
mov dl, 1
call fcn.00435e88
xor eax, eax
push ebp
push 0x468135
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004382e8
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46813f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468161
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004050d4
ret
Function at 0x469180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x469283
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.0040a08c
lea ecx, [ebp - 0x108]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00432f5c
mov eax, dword [ebp - 0x108]
mov edx, 0x469298
call fcn.004054d8
je 0x469221
lea ecx, [ebp - 0x10c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00432f5c
mov eax, dword [ebp - 0x10c]
mov edx, 0x4692a4
call fcn.004054d8
je 0x469221
lea eax, [ebp - 4]
mov edx, 0x4692a4
call fcn.0040537c
lea eax, [ebp - 4]
mov edx, 0x4692b0
call fcn.0040537c
mov eax, 0x476e0c
mov edx, dword [ebp - 4]
call fcn.00405104
mov eax, dword [0x476e0c]
call fcn.00465dc8
test al, al
jne 0x469253
mov eax, dword [0x476e0c]
call fcn.00465dd0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405104
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46928a
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.004050d4
lea eax, [ebp - 4]
call fcn.004050b0
ret

Function at 0x46976c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405530
mov eax, dword [ebp - 8]
call fcn.00405530
xor eax, eax
push ebp
push 0x4698ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [0x476e2c]
add ebx, 0x64
xor edx, edx
push ebp
push 0x46987d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x417590]
call fcn.0041b6c8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00409968
test al, al
je 0x4697de
mov eax, dword [ebp - 8]
call fcn.00405540
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00405540
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x417590]
call fcn.0041b6c8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x46986c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041b4b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469873
mov eax, dword [ebp - 0x10]
call fcn.00404284
mov eax, dword [ebp - 0xc]
call fcn.00404284
ret
Function at 0x46bd48
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x5d
push 0
push 0
dec ecx
jne 0x46bd50
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405530
lea eax, [ebp - 0x168]
mov edx, dword [0x40814c]
call fcn.00405b48
xor eax, eax
push ebp
push 0x46bf75
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x2ac]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00432f5c
mov eax, dword [ebp - 0x2ac]
mov edx, 0x46bf8c
call fcn.004054d8
je 0x46bdb4
lea eax, [ebp - 4]
mov edx, 0x46bf8c
call fcn.0040537c
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2b0]
mov ecx, 0x46bf98
mov edx, dword [ebp - 4]
call fcn.004053c8
mov eax, dword [ebp - 0x2b0]
call fcn.00405540
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
lea eax, [ebp - 0x2c0]
mov edx, ebx
mov cl, 4
call fcn.00414a48
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2d0]
call fcn.00415e1c
lea edx, [ebp - 0x2d0]
pop eax
call fcn.00415e24
je 0x46beff
jmp 0x46bee4
mov eax, dword [ebp - 0x2a8]
sub eax, 0x10
jne 0x46bea9
lea edx, [ebp - 0x2d4]
lea eax, [ebp - 0x27c]
call fcn.0040a08c
mov eax, dword [ebp - 0x2d4]
mov edx, 0x46bfa4
call fcn.004054d8
je 0x46bee4
lea edx, [ebp - 0x2d8]
lea eax, [ebp - 0x27c]
call fcn.0040a08c
mov eax, dword [ebp - 0x2d8]
mov edx, 0x46bfb0
call fcn.004054d8
je 0x46bee4
lea eax, [ebp - 0x2e0]
lea edx, [ebp - 0x27c]
mov ecx, 0x104
call fcn.00405320
mov ecx, dword [ebp - 0x2e0]
lea eax, [ebp - 0x2dc]
mov edx, dword [ebp - 4]
call fcn.004053c8
mov eax, dword [ebp - 0x2dc]
call fcn.0046bd48
jmp 0x46bee4
lea eax, [ebp - 0x2e8]
lea edx, [ebp - 0x27c]
mov ecx, 0x104
call fcn.00405320
mov ecx, dword [ebp - 0x2e8]
lea eax, [ebp - 0x2e4]
mov edx, dword [ebp - 4]
call fcn.004053c8
mov eax, dword [ebp - 0x2e4]
call fcn.00405540
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x2a8]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x46be19
mov dword [ebp - 0x14c], ebx
lea eax, [ebp - 0x168]
call fcn.00409ba4
mov eax, dword [ebp - 4]
call fcn.00409e34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bf7c
lea eax, [ebp - 0x2e8]
mov edx, 6
call fcn.004050d4
lea eax, [ebp - 0x2d0]
mov edx, dword [0x4010a0]
mov ecx, 2
call fcn.00405c64
lea eax, [ebp - 0x2b0]
mov edx, 2
call fcn.004050d4
lea eax, [ebp - 0x168]
mov edx, dword [0x40814c]
call fcn.00405c18
lea eax, [ebp - 4]
call fcn.004050b0
ret
Function at 0x46e5a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405530
xor eax, eax
push ebp
push 0x46e6db
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x46e6ab
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405540
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.00409968
test al, al
jne 0x46e61b
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403624
lea eax, [ebp - 0x1d0]
call fcn.004033c0
call fcn.00402ffc
push dword [0x476d78]
push 0x46e6f4
push dword [0x476d7c]
push 0x46e6f4
push dword [0x476d80]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.00405444
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.00467958
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405860
call fcn.00403ce0
call fcn.00402ffc
lea eax, [ebp - 0x1d0]
call fcn.004036ec
call fcn.00402ffc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46e6b5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e6e2
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.004050d4
lea eax, [ebp - 4]
call fcn.004050b0
ret
Function at 0x197a370
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0197a4c0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x197a396
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x197a382
add dl, dl
jne 0x197a3a1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x197a3f4
xor eax, eax
add dl, dl
jne 0x197a3ae
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x197a495
add dl, dl
jne 0x197a3bd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x197a3c8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x197a3d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x197a3de
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x197a3ea
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x197a38d
mov eax, 1
add dl, dl
jne 0x197a402
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x197a40d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x197a3f9
sub eax, ebx
mov ebx, 1
jne 0x197a440
mov ecx, 1
add dl, dl
jne 0x197a426
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x197a431
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x197a41d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x197a38d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x197a457
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x197a462
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x197a44e
cmp eax, 0x7d00
jae 0x197a485
cmp eax, 0x500
jb 0x197a480
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x197a38d
cmp eax, 0x7f
ja 0x197a488
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x197a38d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x197a4b6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x197a38d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rdata
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4aac493f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x160e70b7
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x53dd9c
push eax
push dword fs:[0]
push ebx
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xe7
mov dword [0x98c0ec09], eax
mov eax, dword [0xf6a8b15c]
jecxz 0x401003
xor dword [ecx], ecx
iretd
ljmp 0x2bdb:0xc41a7522
jne 0x40109c
invalid
mov ch, byte [edx + 0x477bf67f]
jle 0x4010d4
salc
rcr cl, 1
cwde
add al, 0x60
sub byte [ecx + 0x485b75a6], bh
adc byte [eax], cl
xor eax, 0x4156615a
clc
or edi, dword [esi + 0x54]
xchg byte [ebx + 0x456a3141], bl
adc dword [edx + 0x30], ecx
jno 0x401110
sbb ebx, edi
cmp al, 0x6e
jae 0x40107e
out dx, al
aad 0x69
sub dword [edi + 0x33], ebx
retf
push ebp
mov cs, edx
mov bl, byte [edx + 0x3812e7a7]
adc eax, 0x31bdc80d
movsd dword es:[edi], dword [esi]
fild qword [eax]
add ch, al
cmpsd dword [esi], dword es:[edi]
dec eax
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret