joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40af6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebx], 0
push esi
push edi
jne 0x40b010
cmp dword [ebx + 4], 0xffffffff
jne 0x40b010
lea esi, [ebx + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40af9b
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x242]
cmp eax, 0x5c
je 0x40afd3
cmp eax, 0x2f
je 0x40afd3
sub esi, 2
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x40afbf
mov edi, esi
mov esi, 0x42202c
movsd dword es:[edi], dword [esi]
push 0x20
call fcn.0040cc93
and dword [eax + 0x1c], 0
and dword [eax + 0xc], 0
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp + 0xc]
push eax
mov word [eax], 0x100
mov byte [eax + 0x10], 0
mov dword [eax + 0x18], ecx
call fcn.0040a3fe
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
jmp 0x40b015
mov eax, 0x1000000
pop edi
pop esi
pop ebp
ret 8

Function at 0x40c489
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4265d4]
jne 0x40c493
repz ret
jmp fcn.00411007
Function at 0x41ca63
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4265d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00411c9c
and dword [ebp - 0x14], 0
cmp dword [0x477914], 0
mov dword [ebp - 0x18], eax
jne 0x41cb16
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41cbbe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41cbbe
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x477914], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x477918], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47791c], eax
call edi
push eax
call esi
mov dword [0x477924], eax
test eax, eax
je 0x41cb16
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x477920], eax
mov eax, dword [0x477920]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41cb6f
cmp dword [0x477924], ecx
je 0x41cb6f
push eax
call esi
push dword [0x477924]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41cb6f
test ebx, ebx
je 0x41cb6f
call edi
test eax, eax
je 0x41cb66
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41cb66
test byte [ebp - 8], 1
jne 0x41cb6f
or dword [ebp + 0x10], 0x200000
jmp 0x41cba2
mov eax, dword [0x477918]
cmp eax, dword [ebp - 0x18]
je 0x41cba2
push eax
call esi
test eax, eax
je 0x41cba2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41cba2
mov eax, dword [0x47791c]
cmp eax, dword [ebp - 0x18]
je 0x41cba2
push eax
call esi
test eax, eax
je 0x41cba2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x477914]
call esi
test eax, eax
je 0x41cbbe
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41cbc0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c489
leave
ret
Function at 0x4027b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
push esi
mov esi, eax
xor eax, eax
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
cmp eax, ecx
ja 0x4027dd
jb 0x4027d5
cmp esi, edx
jae 0x4027dd
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
jmp 0x4027e3
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
ja 0x4027f1
cmp dword [ebp - 0x10], eax
jbe 0x402878
mov eax, dword [ebx]
or eax, dword [ebx + 4]
jne 0x40280f
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x16]
mov esi, dword [ebp + 8]
push ecx
call fcn.004028b0
add esp, 4
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebx]
cmp esi, eax
jb 0x402827
ja 0x402822
cmp edi, dword [ebp - 0x10]
jbe 0x402827
mov edi, dword [ebp - 0x10]
mov esi, eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
push edx
push edi
lea ecx, [eax + 0x27dc8a0]
push 1
push ecx
call fcn.0041b2f9
add esp, 0x10
xor ecx, ecx
cmp eax, edi
jne 0x402881
cmp ecx, esi
jne 0x402881
add dword [ebp - 0x18], edi
mov eax, dword [ebp - 0xc]
adc dword [ebp - 0x14], esi
add dword [ebp - 4], edi
sub dword [ebx], edi
sbb dword [ebx + 4], esi
sub dword [ebx + 8], edi
sbb dword [ebx + 0xc], esi
sub dword [ebp - 0x10], edi
sbb eax, esi
mov dword [ebp - 0xc], eax
test eax, eax
ja 0x4027f1
jb 0x402878
cmp dword [ebp - 0x10], ecx
ja 0x4027f1
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push edi
push str.Error_when_trying_to_read__llu_bytes_of_data_in_sparse_read_n
push 0xa7b
push str.sparse_read
push 2
call fcn.004016a0
add esp, 0x18
push 1
call fcn.00401c50
int3

Function at 0x4028b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4383f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xc
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.0041b2f9
add esp, 0x10
cmp eax, 0xc
je 0x4028f6
push str.Didnt_get_proper_amount_of_bytes_for_chunk_header_n
push 0xad2
push str.read_chunk_header
push 2
call fcn.004016a0
add esp, 0x10
push 1
call fcn.00401c50
movzx edi, di
cmp edi, 0xc
jbe 0x40290f
push 1
lea ecx, [edi - 0xc]
push 0
push ecx
push esi
call fcn.0041aa2a
add esp, 0x10
mov edx, 0xcac3
cmp word [ebp - 0x10], dx
jne 0x402956
lea ebx, [ebx]
push esi
push 0xc
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.0041b2f9
add esp, 0x10
cmp eax, 0xc
jne 0x40296d
cmp edi, eax
jbe 0x40294b
push 1
lea ecx, [edi - 0xc]
push 0
push ecx
push esi
call fcn.0041aa2a
add esp, 0x10
mov edx, 0xcac3
cmp word [ebp - 0x10], dx
je 0x402920
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp + 8]
xor ecx, ebp
xor edx, edx
call fcn.00418d55
mov esp, ebp
pop ebp
ret
push str.Didnt_get_proper_amount_of_bytes_for_chunk_header_n
push 0xae3
jmp 0x4028e0
Function at 0x402980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x1c]
push esi
push edi
push ebx
push 0x1c
lea ecx, [ebp - 0x28]
push 1
push ecx
mov dword [ebp - 4], eax
call fcn.0041b2f9
add esp, 0x10
cmp eax, 0x1c
je 0x4029c4
push str.Didnt_properly_read_the_sparse_header__n
push 0xaa0
push str.read_sparse_header
push 2
call fcn.004016a0
add esp, 0x10
push 1
call fcn.00401c50
movzx eax, word [ebp - 0x20]
cmp eax, 0x1c
jbe 0x4029de
push 1
add eax, 0xffffffe4
push 0
push eax
push ebx
call fcn.0041aa2a
add esp, 0x10
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0
push edx
push eax
mov ecx, 7
lea esi, [ebp - 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.0041aa2a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov di, word [eax + 0xa]
push ecx
mov esi, ebx
call fcn.004028b0
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403440
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0x4000
call fcn.0041a5e2
mov dword [esi + 0xd50], eax
mov eax, dword [esi + 0x938]
imul eax, dword [esi + 0x914]
add esp, 4
xor ecx, ecx
add eax, dword [esi + 0x948]
push 0
adc ecx, dword [esi + 0x94c]
push ecx
push eax
push edi
call fcn.0041aa2a
push edi
push 0x200
lea edx, [esi + 0x950]
push 1
push edx
call fcn.0041b2f9
add esp, 0x20
cmp eax, 0x200
je 0x4034b7
push str.ERROR___couldnt_properly_read_out_the_protective_MBR_n
push 0xbcf
push str.ReadFFUGPT
push 2
call fcn.004016a0
add esp, 0x10
push 1
call fcn.00401c50
push edi
push 4
lea eax, [esi + 0xb50]
push 1
push eax
call fcn.0041b2f9
add esp, 0x10
cmp eax, 4
je 0x4034dc
push str.ERROR___couldnt_properly_read_out_the_Gpt_Header_n
push 0xbd6
jmp 0x4034a1
mov ecx, dword [esi + 0xd50]
push edi
push 0x4000
push 1
push ecx
call fcn.0041b2f9
add esp, 0x10
cmp eax, 0x4000
je 0x403506
push str.ERROR___couldnt_properly_read_gpt_entries_n
push 0xbdd
jmp 0x4034a1
pop ecx
ret
Function at 0x40bd00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, 0x100000
jbe 0x40bd1d
mov esi, 0x100000
cmp byte [0x23b653a], 0
push esi
je 0x40bd68
push str._n_nINTERACTIVE_Press_any_key_to_attempt_to_READ__d_bytes__q_to_quit_interactive_:
call fcn.0041af1f
add esp, 8
call fcn.0041bffe
push 2
push edi
push edi
mov bl, al
call fcn.0041a706
push eax
call fcn.0041aa2a
add esp, 0x10
cmp bl, 0x71
jne 0x40bd59
mov byte [0x23b653a], 0
push 0x430c98
call fcn.0041af1f
add esp, 4
jmp 0x40bd87
mov eax, dword [0x23b6524]
push eax
push str.CharsInBuffer_d_Trying_to_read_from_USB__ld_bytes
push 0x16e1
push str.ReadPort
push 5
call fcn.004016a0
add esp, 0x18
xor ebx, ebx
cmp dword [0x4393c4], ebx
jl 0x40be0f
jg 0x40bd9b
cmp dword [0x4393c0], ebx
jbe 0x40be0f
mov edx, dword [ebp + 8]
mov eax, dword [0x23b6504]
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x40bdbc
add dword [ebp + 8], eax
sub esi, eax
test eax, eax
jne 0x40bdfd
cmp dword [0x4393c4], eax
jl 0x40bde3
jg 0x40bdd8
cmp dword [0x4393c0], 0x3e8
jbe 0x40bde3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 1
adc ebx, 0
cmp ebx, dword [0x4393c4]
jl 0x40bd9b
jg 0x40be0f
cmp edi, dword [0x4393c0]
jb 0x40bd9b
jmp 0x40be0f
cmp ebx, dword [0x4393c4]
jl 0x40be34
jg 0x40be0f
cmp edi, dword [0x4393c0]
jb 0x40be34
push 0x2458f80
push str.Could_not_read_from__s__Windows_API_ReadFile_failed__Your_device_is_probably_not_on_this_port_n_n
push 0x171b
push str.ReadPort
push 2
call fcn.004016a0
add esp, 0x14
push 1
call fcn.00401c50
push eax
push str.CHANNEL_DATA___ld_bytes______TARGET_to_HOST
push 0x171f
push str.ReadPort
push 5
call fcn.004016a0
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417457
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4383f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x23b6543], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x4173e7
lea eax, [ebp - 0x40]
push eax
push 0x2459780
call fcn.0041a198
add esp, 8
test eax, eax
jne 0x4173e7
push 0x2459780
push str._s_already_exists_and___forceoverwrite_not_set._Leaving_file_as_is.
push 0x2e3c
push str.MyCopyFile
push 4
call fcn.004016a0
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418d55
mov esp, ebp
pop ebp
ret
push 0x800
mov edx, 0x42ddb4
mov ecx, esi
call fcn.00412100
add esp, 4
mov esi, eax
push 0x800
mov edx, 0x42ede4
mov ecx, 0x2459780
mov dword [ebp - 0x48], esi
call fcn.00412100
add esp, 4
push str._BEGIN_COPY
mov dword [ebp - 0x44], eax
call fcn.0041af1f
add esp, 4
push esi
push 0x100000
push 1
push 0x259c7e0
xor ebx, ebx
call fcn.0041b2f9
push 0x4303b0
mov esi, eax
xor edi, edi
call fcn.0041af1f
mov ecx, esi
add esp, 0x14
or ecx, edi
je 0x4174a0
mov edx, dword [ebp - 0x44]
push edx
push esi
push 1
push 0x259c7e0
call fcn.0041b579
mov ebx, eax
add esp, 0x10
xor eax, eax
cmp ebx, esi
jne 0x4174a0
cmp eax, edi
jne 0x4174a0
mov eax, dword [ebp - 0x48]
push eax
push 0x100000
push 1
push 0x259c7e0
xor ebx, ebx
call fcn.0041b2f9
push 0x4303b0
mov esi, eax
xor edi, edi
call fcn.0041af1f
mov ecx, esi
add esp, 0x14
or ecx, edi
jne 0x417452
mov edx, dword [ebp - 0x48]
push edx
call fcn.0041bc41
mov eax, dword [ebp - 0x44]
add esp, 4
push eax
call fcn.0041bc41
add esp, 4
cmp ebx, esi
jne 0x4174c2
xor eax, eax
cmp eax, edi
je 0x4174d6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418d55
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00418d55
mov esp, ebp
pop ebp
ret
Function at 0x418a30
Capabilities:
Hash data using sha256

Disassembly:
test ebx, ebx
je 0x418a64
push esi
push edi
push 0x8c
push 0
push ebx
call fcn.0041e920
add esp, 0xc
lea edi, [ebx + 8]
mov ecx, 8
mov esi, 0x42ce60
rep movsd dword es:[edi], dword [esi]
pop edi
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop esi
ret

Function at 0x418d55
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4383f4]
jne 0x418d5f
repz ret
jmp fcn.0041c197

Function at 0x41ee2b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41ee52
call fcn.0041adb1
mov dword [eax], esi
call fcn.0041ad9e
push 0x16
pop esi
mov dword [eax], esi
call fcn.0041cee5
mov eax, esi
jmp 0x41eea7
test dword [ebp + 0xc], 0xfffffff9
jne 0x41ee38
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41ee7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041adc4
pop ecx
call fcn.0041ad9e
mov eax, dword [eax]
jmp 0x41eea7
test al, 0x10
jne 0x41eea5
test al, 1
je 0x41eea5
test byte [ebp + 0xc], 2
je 0x41eea5
call fcn.0041adb1
mov dword [eax], 5
call fcn.0041ad9e
mov dword [eax], 0xd
jmp 0x41ee76
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42631d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4383f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041db0c
and dword [ebp - 0x14], 0
cmp dword [0x474bec], 0
mov dword [ebp - 0x18], eax
jne 0x4263d0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x426478
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x426478
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x474bec], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x474bf0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x474bf4], eax
call edi
push eax
call esi
mov dword [0x474bfc], eax
test eax, eax
je 0x4263d0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x474bf8], eax
mov eax, dword [0x474bf8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x426429
cmp dword [0x474bfc], ecx
je 0x426429
push eax
call esi
push dword [0x474bfc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x426429
test ebx, ebx
je 0x426429
call edi
test eax, eax
je 0x426420
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x426420
test byte [ebp - 8], 1
jne 0x426429
or dword [ebp + 0x10], 0x200000
jmp 0x42645c
mov eax, dword [0x474bf0]
cmp eax, dword [ebp - 0x18]
je 0x42645c
push eax
call esi
test eax, eax
je 0x42645c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42645c
mov eax, dword [0x474bf4]
cmp eax, dword [ebp - 0x18]
je 0x42645c
push eax
call esi
test eax, eax
je 0x42645c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x474bec]
call esi
test eax, eax
je 0x426478
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42647a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418d55
leave
ret
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.DLL_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.DLL_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.DLL_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.DLL_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x6848bd
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0068493c
jae 0x6848c9
xor ecx, ecx
call fcn.0068493c
jae 0x6848f3
xor eax, eax
call fcn.0068493c
jae 0x684904
mov al, 0x10
call fcn.0068493c
adc al, al
jae 0x6848e5
jne 0x684931
stosb byte es:[edi], al
jmp 0x6848ca
call fcn.00684948
dec ecx
loop 0x684910
mov eax, ebp
call fcn.00684946
jmp 0x684932
lodsb al, byte [esi]
shr eax, 1
je 0x684958
adc ecx, 2
mov ebp, eax
jmp 0x684932
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00684946
cmp eax, 0x7d00
jae 0x684930
cmp eax, 0x500
jae 0x684931
cmp eax, 0x7f
ja 0x684932
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6848ca
pop ebp
ret 8
Function at 0x401c3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov eax, dword [ebp + 8]
and dword [ebp + 8], 0
mov edi, eax
mov eax, dword [edi + 0x3c]
push esi
mov esi, dword [eax + edi + 0x78]
add esi, edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x401cb8
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [esi + 0x20]
add ebx, edi
mov eax, dword [ebx]
add eax, edi
push eax
call fcn.00401c20
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov edx, eax
lodsd eax, dword [esi]
cmp eax, 0x200
jb 0x401ca7
cmp eax, edx
je 0x401c87
add edi, 4
jmp 0x401c76
mov edx, edi
pop edi
pop esi
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + edi]
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
mov dword [edx], eax
jmp 0x401ca9
pop edi
pop esi
add ebx, 4
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jne 0x401c62
pop ebx
pop esi
pop edi
pop ecx
pop ebp
ret 0xc

Function at 0x401f7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x401fae
mov ecx, 0xae528
mov eax, dword [section..data]
inc ecx
xor byte [esi], al
inc esi
imul eax, ecx
mov edx, 0x24d6a
dec dword [ebp + 0xc]
dec edx
add eax, edx
cmp dword [ebp + 0xc], 0
ja 0x401f97
xor eax, eax
pop esi
inc eax
pop ebp
ret 8
Function at 0x10007040
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012321
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x10023330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x140], edi
call dword [sym.imp.mfc140.dll_Ordinal_316]
push 0x105
lea ecx, [ebp - 0x13c]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_5095]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x100070b9
push 0xffffffffffffffff
lea ecx, [ebp - 0x13c]
call dword [sym.imp.mfc140.dll_Ordinal_12503]
push dword [0x10023228]
lea ecx, [ebp - 0x13c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
push 0
lea eax, [ebp - 0x138]
xorps xmm0, xmm0
push eax
push dword [ebp - 0x13c]
movlpd qword [ebp - 0x138], xmm0
movlpd qword [ebp - 0x130], xmm0
movlpd qword [ebp - 0x128], xmm0
call sub.mfc140.dll_Ordinal_6925
test eax, eax
jne 0x1000719e
call sub.mfc140.dll_Ordinal_2241
push 0x100164e4
push 0x3f5
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call sub.mfc140.dll_Ordinal_2241
push esi
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
call sub.mfc140.dll_Ordinal_2241
push esi
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10007180
push 0x100146f0
mov ecx, edi
call dword [sym.imp.mfc140.dll_Ordinal_310]
jmp 0x100071ad
push 0
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x140]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x13c]
mov ecx, edi
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
lea ecx, [ebp - 0x13c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f28b
mov esp, ebp
pop ebp
ret 4