joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e93700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02e9378f
jae 0x2e9370e
xor ecx, ecx
call fcn.02e9378f
jae 0x2e9373d
xor eax, eax
call fcn.02e9378f
jae 0x2e9374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02e9378f
adc al, al
jae 0x2e9372f
jne 0x2e93779
stosb byte es:[edi], al
jmp 0x2e93711
call fcn.02e9379b
sub ecx, ebx
jne 0x2e93756
call fcn.02e93799
jmp 0x2e93775
lodsb al, byte [esi]
shr eax, 1
je 0x2e93783
adc ecx, ecx
jmp 0x2e93772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02e93799
cmp eax, 0x7d00
jae 0x2e93772
cmp ah, 5
jae 0x2e93773
cmp eax, 0x7f
ja 0x2e93774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2e93711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x2eaea1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x100]
lodsb al, byte [esi]
or al, al
je 0x2eaea45
inc ecx
test cl, 3
je 0x2eaea42
shl eax, 8
jmp 0x2eaea32
stosd dword es:[edi], eax
jmp 0x2eaea32
mov al, 0x80
push ecx
inc ecx
test cl, 3
je 0x2eaea53
shl eax, 8
jmp 0x2eaea48
stosd dword es:[edi], eax
xor eax, eax
jmp 0x2eaea5c
stosd dword es:[edi], eax
add ecx, 4
cmp ecx, 0x3c
jb 0x2eaea58
pop eax
shl eax, 3
stosd dword es:[edi], eax
sub ecx, 0xc
mov eax, dword [edi - 0x3c]
push ecx
mov ecx, eax
mov edx, eax
ror eax, 7
ror ecx, 0x12
shr edx, 3
xor eax, ecx
xor eax, edx
push eax
mov eax, dword [edi - 8]
mov ecx, eax
mov edx, eax
ror eax, 0x11
ror ecx, 0x13
shr edx, 0xa
xor eax, ecx
xor eax, edx
add dword [esp], eax
pop eax
add eax, dword [edi - 0x40]
pop ecx
add eax, dword [edi - 0x1c]
stosd dword es:[edi], eax
loop 0x2eaea69
call int.02eaeac6
out 9, al
push 0xffffffffffffff85
scasb al, byte es:[edi]
mov ebx, 0x3c6ef372
cmp dh, ch
dec edi
movsd dword es:[edi], dword [esi]
jg 0x2eaeb0a
push cs
push ecx
mov word [eax + 5], gs
wait
stosd dword es:[edi], eax
fld dword [ebx - 0x1f32e6e1]
pop ebx
invalid
Function at 0x402ac5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x7a2810]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b59
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402b16
cmp dword [ebp + 0x10], ebx
jne 0x402b4d
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402ac5
test eax, eax
jne 0x402b28
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405dd4
cmp eax, ebx
je 0x402b60
push ebx
push dword [0x7a2810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402b59
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x7a2810], ebx
jne 0x402b56
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402b56
jmp 0x402b59
Function at 0x402f74
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402fa1
mov ecx, dword [0x7a27b8]
push edi
add eax, ecx
push edi
push eax
mov dword [0x795914], eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.0040309f
cmp eax, edi
jl 0x403098
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409024]
call ebx
test eax, eax
je 0x403095
cmp dword [ebp - 4], esi
jne 0x403095
push dword [ebp + 8]
add dword [0x795914], esi
call fcn.0040309f
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403098
cmp dword [ebp + 0x10], edi
jne 0x403064
cmp dword [ebp + 8], edi
jle 0x403090
mov esi, 0x7918d0
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x403014
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409024]
call ebx
test eax, eax
je 0x403095
cmp edi, dword [ebp - 4]
jne 0x403095
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403060
cmp dword [ebp + 0x14], edi
jne 0x403060
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x795914], eax
cmp dword [ebp + 8], 0
jg 0x403007
jmp 0x403090
push 0xfffffffffffffffe
jmp 0x403097
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40306f
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409024]
call ebx
test eax, eax
je 0x403095
mov eax, dword [ebp - 4]
add dword [0x795914], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403098
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40309f
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x795914]
mov edi, eax
sub esi, dword [0x40b004]
add edi, 0x1f4
add esi, dword [esp + 0x1c]
cmp esi, ebp
jle 0x403275
push dword [0x79d924]
call fcn.004032b2
push ebp
push ebp
push dword [0x40b004]
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x79d920], esi
mov dword [0x795910], ebp
mov eax, dword [0x795918]
mov ebx, 0x4000
sub eax, dword [0x79d924]
cmp eax, ebx
jg 0x403112
mov ebx, eax
mov esi, 0x7918d0
push ebx
push esi
call fcn.00403280
test eax, eax
je 0x403240
add dword [0x79d924], ebx
mov dword [0x40b008], esi
mov dword [0x40b00c], ebx
cmp dword [0x7a2768], ebp
je 0x4031a3
cmp dword [0x7a2800], ebp
jne 0x4031a3
cmp dword [esp + 0x10], ebp
je 0x403170
mov eax, dword [0x79d920]
push ebp
sub eax, dword [0x795914]
sub eax, dword [esp + 0x20]
add eax, dword [0x40b004]
mov dword [0x795910], eax
call fcn.00405e0d
jmp 0x4031a3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x4031a3
mov eax, dword [0x7a2764]
neg eax
sbb eax, eax
not eax
and eax, 0x4091ec
push eax
push 0x402bca
push ebp
push 0x6f
push dword [0x7a2760]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
push 0x40b008
mov dword [0x40b010], 0x7898d0
mov dword [0x40b014], 0x8000
call fcn.00405eae
test eax, eax
jl 0x403249
mov esi, dword [0x40b010]
mov eax, 0x7898d0
sub esi, eax
je 0x40320a
lea ecx, [esp + 0x14]
push ebp
push ecx
push esi
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403245
cmp esi, dword [esp + 0x14]
jne 0x403245
add dword [0x40b004], esi
cmp dword [0x40b00c], ebp
jne 0x403138
jmp 0x403216
cmp dword [0x40b00c], ebp
jne 0x403249
cmp ebx, ebp
je 0x403249
mov eax, dword [0x795914]
mov ecx, eax
sub ecx, dword [0x40b004]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x4030fc
push ebp
push ebp
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40324e
or eax, 0xffffffff
jmp 0x403277
push 0xfffffffffffffffe
jmp 0x40324b
push 0xfffffffffffffffd
pop eax
jmp 0x403277
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x403275
mov eax, dword [0x79d920]
push ebp
push ebp
push 0x113
push esi
mov dword [0x795910], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x40535b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x7a0d78], 0x44
push eax
xor eax, eax
push 0x7a0d78
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405396
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405420
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.004056c2
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405456
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7a27e8], eax
jmp 0x4055db
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x405471
test eax, eax
je 0x405586
test cl, 2
je 0x405586
mov esi, 0x79fd78
push ebx
push esi
call fcn.00405aee
cmp dword [ebp + 8], 0
je 0x405490
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405496
push ebx
call fcn.00405628
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x40557c
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.0040560c
cmp byte [eax], 0
je 0x4054e7
cmp byte [ebp - 0x18], 0
je 0x4054e7
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4054fd
mov al, byte [esi + 1]
test al, al
je 0x40555b
cmp al, 0x2e
jne 0x4054fd
cmp byte [esi + 2], 0
je 0x40555b
push esi
push edi
call fcn.00405aee
test byte [ebp - 0x148], 0x10
je 0x405522
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40555b
push dword [ebp + 0xc]
push ebx
call fcn.00405420
jmp 0x40555b
push ebx
call fcn.004057a6
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405553
test byte [ebp + 0xc], 4
je 0x40554b
push ebx
push 0xfffffffffffffff1
call fcn.00404ea2
push 0
push ebx
call fcn.0040583c
jmp 0x40555b
inc dword [0x7a27e8]
jmp 0x40555b
push ebx
push 0xfffffffffffffff2
call fcn.00404ea2
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054c5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405586
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x4055db
cmp dword [ebp - 8], esi
jne 0x40559b
inc dword [0x7a27e8]
jmp 0x4055db
push ebx
call fcn.00405d96
test eax, eax
je 0x4055db
push ebx
call fcn.004055e1
push ebx
call fcn.004057a6
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4055d3
test byte [ebp + 0xc], 4
je 0x405593
push ebx
push 0xfffffffffffffff1
call fcn.00404ea2
push esi
push ebx
call fcn.0040583c
jmp 0x4055db
push ebx
push 0xffffffffffffffe5
call fcn.00404ea2
pop esi
pop ebx
leave
ret 8
Function at 0x4056c2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7a0178
push esi
call fcn.00405aee
push esi
call fcn.00405675
mov edi, eax
test edi, edi
jne 0x4056e3
xor eax, eax
jmp 0x405735
push edi
call fcn.00405cfd
test byte [0x7a2770], 0x80
je 0x4056fc
mov al, byte [edi]
test al, al
je 0x4056df
cmp al, 0x5c
je 0x4056df
sub edi, esi
jmp 0x405714
call fcn.00405d96
test eax, eax
je 0x40570e
test byte [eax], 0x10
je 0x4056df
push esi
call fcn.00405628
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405700
call fcn.004055e1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4057a6
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4057c2
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4057c5
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4057f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405838
test edi, edi
jne 0x4057ff
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405832
Function at 0x40583c
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405dd4
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405860
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405999
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x7a0f00], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x7a0f00
je 0x4058a4
push 1
push 0
push esi
call fcn.004057c5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40599f
cmp eax, edi
jg 0x40599f
mov esi, 0x7a0978
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40599f
cmp eax, edi
jg 0x40599f
push esi
push ebp
push str._s_s_r_n
push 0x7a0578
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x7a2768]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405b10
push 4
push 0xc0000000
push esi
call fcn.004057c5
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405999
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405992
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405992
cmp edi, dword [esp + 0x18]
jne 0x405992
push str._Rename__r_n
push esi
call fcn.0040573a
test eax, eax
jne 0x4059a6
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405aee
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x7a0578
push eax
call fcn.00405786
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x7a27f0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x4093a0
push eax
call fcn.0040573a
test eax, eax
je 0x40595d
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x4059cd
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4059c2
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x40595f
Function at 0x4059d5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405a46
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405a35
cmp dword [ebp + 0x14], 1
je 0x405a37
cmp dword [ebp + 0x14], 2
je 0x405a37
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405b10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jge 0x405b31
mov ecx, dword [0x7a1f3c]
lea eax, [edi*4 + 4]
sub ecx, eax
mov edi, dword [ecx]
mov eax, dword [0x7a2798]
mov ecx, dword [ebp + 8]
add edi, eax
mov eax, 0x7a1700
sub ecx, eax
mov ebx, eax
cmp ecx, 0x800
jae 0x405cd7
mov ebx, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405cd7
mov edx, ebx
sub edx, eax
cmp edx, 0x400
jge 0x405ce4
inc edi
cmp cl, 0xfc
jbe 0x405cca
movsx eax, byte [edi + 1]
movsx ecx, byte [edi]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
or ecx, edx
or eax, edx
inc edi
mov dword [ebp - 0x10], ecx
inc edi
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 8], eax
jne 0x405c75
cmp dword [0x7a27e4], 0
push 2
pop esi
je 0x405bbc
push 4
pop esi
mov eax, dword [ebp - 0x14]
test al, al
jns 0x405bf3
mov ecx, eax
and eax, 0x3f
add eax, dword [0x7a2798]
and ecx, 0x40
push ecx
push ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004059d5
cmp byte [ebx], 0
jne 0x405c5c
push dword [ebp - 0xc]
push ebx
call fcn.00405b10
jmp 0x405c57
cmp eax, 0x25
jne 0x405c06
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405c57
cmp eax, 0x24
jne 0x405c53
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor esi, esi
jmp 0x405c53
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x14]
push dword [0x7a2764]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405c50
push ebx
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp + 0xc], 0
jne 0x405c57
and byte [ebx], 0
test esi, esi
jne 0x405c1b
cmp byte [ebx], 0
je 0x405c6d
cmp dword [ebp - 0xc], 0x1a
jne 0x405c6d
push str.MicrosoftInternet_ExplorerQuick_Launch
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call fcn.00405cfd
jmp 0x405cbb
cmp byte [ebp + 0xf], 0xfd
jne 0x405ca9
cmp esi, 0x1d
jne 0x405c8e
push dword [0x7a2764]
push ebx
call fcn.00405a4c
jmp 0x405c9f
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push ebx
call fcn.00405aee
add esi, 0xffffffeb
cmp esi, 7
jae 0x405cbb
jmp 0x405c6d
cmp byte [ebp + 0xf], 0xff
jne 0x405cbb
or eax, 0xffffffff
sub eax, esi
push eax
push ebx
call fcn.00405b10
push ebx
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
mov eax, 0x7a1700
jmp 0x405cd7
jne 0x405cd4
mov cl, byte [edi]
mov byte [ebx], cl
inc ebx
inc edi
jmp 0x405cd7
mov byte [ebx], cl
inc ebx
mov cl, byte [edi]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405b5c
and byte [ebx], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405cf9
push eax
push dword [ebp + 8]
call fcn.00405aee
leave
ret 8
Function at 0x405e40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a1304], 0
push esi
jne 0x405e77
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405e51
mov dword [ecx*4 + 0x7a1300], eax
inc ecx
cmp ecx, 0x100
jl 0x405e4c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405ea8
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1300]
xor eax, esi
inc ecx
dec edx
jne 0x405e8a
pop edi
not eax
pop esi
ret 0xc
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x402ee4
pop dword [ebp - 0x44]
mov eax, 0x42cc3a67
add eax, 0xbd73f47d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x4907525b
sub dword [ebp - 0x54], 0xfab50d10
mov dword [ebp - 0x50], 0xb67c2310
sub dword [ebp - 0x50], 0x8448d6cb
mov dword [ebp - 0x4c], 0xe6e909b1
sub dword [ebp - 0x4c], 0x9a9cc583
mov dword [ebp - 0x48], 0xb7fb78c2
add dword [ebp - 0x48], 0x4804873e
lea eax, [ebp - 0x54]
push eax
mov eax, 0xe27f03db
sub eax, 0xe23e82d7
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x1beb92a0
add dword [ebp - 0x54], 0x5886d6b6
mov dword [ebp - 0x50], 0x24391120
sub dword [ebp - 0x50], 0xe2ccafab
mov dword [ebp - 0x4c], 0x12b24025
add dword [ebp - 0x4c], 0x50bd2c47
mov dword [ebp - 0x48], 0x14e44502
add dword [ebp - 0x48], 0xeb1bbafe
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xd847dfd0
sub eax, 0xd8075ed0
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3a66f
push 0
call eax
mov ecx, 0x5577
xor edx, edx
add edx, eax
mov ebx, 0x4ef54006
sub ebx, 0x4eae5c06
add ebx, dword [ebp - 0x44]
mov edi, 0x16e805e1
sub edi, 0x201c3a64
add dword [ebp - 0x10], 0x29bdf12b
mov esi, dword [ebx]
sub dword [ebp - 0x30], esi
xor esi, edi
sub dword [ebp - 0xc], 0x649e1ea5
mov dword [edx], esi
add dword [ebp - 0x34], 0x4876038a
add edx, 0x2e6a28a5
sub edx, 0x2e6a28a1
add ebx, 0x291a6231
sub ebx, 0x291a622d
loop 0x403002
add eax, 0x148af
xor ebx, ebx
add ebx, eax
add eax, 0xf189e9e
sub eax, 0xf189e99
mov ecx, 0x1f9d23bc
add ecx, 0xe0a2dc44
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219