joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402dd8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x402df2
xor eax, eax
jmp 0x402f72
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x402e06
xor eax, eax
jmp 0x402f72
cmp word [ebx + 0x14], 0xe0
jne 0x402e16
cmp word [ebx + 0x18], 0x10b
je 0x402e1d
xor eax, eax
jmp 0x402f72
mov dword [0x451c4c], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00402d5c
add esp, 8
test eax, eax
jne 0x402e48
xor eax, eax
jmp 0x402f72
mov edx, dword [0x451c4c]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00402da4
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x402e7a
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x402f72
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x402f44
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x402f36
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x402f31
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x402f28
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x402f1d
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x402f1d
test cl, cl
je 0x402f12
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x402f1d
add eax, 2
add edx, 2
test cl, cl
jne 0x402ef6
jne 0x402f1d
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x402f72
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x402edc
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x402eb4
jmp 0x402f70
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x402f68
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x402f64
cmp dword [eax], 0
je 0x402f64
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x402f72
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x402f4b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403084
Capabilities:
Query service status

Disassembly:
push ebx
add esp, 0xffffffe4
push 0xf003f
push str.ServicesActive
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
test eax, eax
jne 0x4030a1
xor eax, eax
jmp 0x4030de
push 0xf01ff
push str.NTice
push eax
call sub.ADVAPI32.DLL_OpenServiceA
mov ebx, eax
push esp
push ebx
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
jne 0x4030c8
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
jmp 0x4030de
cmp dword [esp + 4], 4
jne 0x4030dc
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, 1
jmp 0x4030de
xor eax, eax
add esp, 0x1c
pop ebx
ret

Function at 0x403140
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x403159
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop ebp
ret
Function at 0x403180
Capabilities:
Enumerate process modules
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc30
push ebx
push esi
push edi
lea edi, [ebp - 0x238]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x44e97c
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.00403118
pop ecx
test eax, eax
je 0x4031bc
push ebx
call fcn.00403160
pop ecx
mov dword [ebp - 0x2cc], 0x94
lea eax, [ebp - 0x2cc]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2bc], 1
jne 0x4031fa
push ebx
call fcn.00402ff4
pop ecx
test eax, eax
jne 0x4031f1
push ebx
call fcn.0040302c
pop ecx
test eax, eax
je 0x403217
push ebx
call fcn.00403160
pop ecx
jmp 0x403217
push ebx
call fcn.00403140
pop ecx
test eax, eax
jne 0x403210
push ebx
call fcn.004030e4
pop ecx
test eax, eax
je 0x403217
push ebx
call fcn.00403160
pop ecx
mov dword [ebp - 0x238], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x403283
jmp 0x403272
push str.explorer.exe
lea edx, [ebp - 0x214]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x403264
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x230]
jne 0x403272
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x403246
cmp esi, dword [ebp - 4]
je 0x4032a8
cmp dword [ebp - 4], 0
je 0x4032a8
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x403386
xor edx, edx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0xc], edx
push 0x105
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x44eb21
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea edx, [ebp - 0x110]
push edx
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x403386
lea eax, [ebp - 8]
lea edx, [ebp - 0x12cc]
push eax
push 0x1000
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x403362
xor esi, esi
lea ebx, [ebp - 0x12cc]

Function at 0x4033e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
je 0x4033f1
jne 0x4033f1
jmp fcn.00403375
cmp esi, 8
jb 0x40342f
xor ebx, ebx
jmp 0x403426
mov eax, dword [ebp + 0x10]
mov edx, ebx
add edx, edi
push eax
push edx
call fcn.00403434
add esp, 8
movsx ecx, word [ebp + 0xc]
mov eax, 0x64
sub eax, ecx
imul esi
mov ecx, 0x64
xor edx, edx
div ecx
add ebx, eax
add ebx, 8
mov eax, esi
sub eax, 8
cmp ebx, eax
jbe 0x4033fa
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403434
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.0040174c
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x4034e7
mov eax, fcn.004014e4
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x4034e7
mov eax, fcn.00403690
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x4034e7
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x4034e7
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x4034af
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403504
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.0040174c
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x4035ba
mov eax, fcn.004014e4
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x4035ba
mov eax, fcn.00403504
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x4035ba
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x4035ba
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403582
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4036e0
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.0040174c
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403796
mov eax, fcn.004014e4
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403796
mov eax, fcn.00403690
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403796
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403796
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x40375e
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e38
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x408f84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x408fe6
call fcn.00408f34
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00405524
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00405524
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x409044
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x45095c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40911e
cmp dword [0x450958], 0
jne 0x40911e
cmp dword [0x450b4c], 0
je 0x4090d8
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00408e34
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4090be
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00408e34
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4090be
lea ebx, [ebp - 0x84]
jmp 0x4090bf
inc ebx
call fcn.00409000
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x409159
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x450960
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00405524
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x450963
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x409159
cmp dword [0x450958], 0
je 0x409138
cmp dword [0x450958], 0xffffffff
je 0x409159
push esi
call dword [0x450958]
pop ecx
mov eax, dword [0x45095c]
test eax, eax
je 0x409159
cmp dword [0x45095c], 0xffffffff
je 0x409159
cmp byte [eax], 0
je 0x409159
push esi
push eax
call fcn.00408f84
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409944
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4526cc], 0
jne 0x4099c5
cmp dword [0x4526ec], 0
jne 0x409974
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4526ec], eax
test eax, eax
jne 0x409974
push str.GetEnvironmentStrings_failed
call fcn.00409170
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4526ec]
jmp 0x409988
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00405524
pop ecx
mov edi, eax
test eax, eax
jne 0x409980
lea edi, [ebp + 1]
push edi
call fcn.004043f0
pop ecx
mov ebx, eax
mov dword [0x4526d0], ebx
test ebx, ebx
jne 0x4099b2
xor eax, eax
jmp 0x409a88
push edi
mov edx, dword [0x4526ec]
push edx
push ebx
call fcn.004053d4
add esp, 0xc
jmp 0x4099e5
xor esi, esi
mov ebx, dword [0x4526cc]
jmp 0x4099df
push eax
call fcn.00405524
pop ecx
test eax, eax
jne 0x4099db
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4099cf
lea ebx, [esi + 4]
push 4
mov dword [0x4526d4], ebx
inc ebx
push ebx
call fcn.00403f54
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x409a08
xor eax, eax
jmp 0x409a88
cmp dword [0x4526cc], 0
jne 0x409a39
xor esi, esi
mov ebx, dword [0x4526d0]
mov eax, dword [esp]
mov ebp, eax
jmp 0x409a2a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00405524
pop ecx
mov edi, eax
test eax, eax
jne 0x409a20
jmp 0x409a6a
xor esi, esi
mov ebx, dword [0x4526cc]
mov eax, dword [esp]
mov edi, eax
jmp 0x409a64
push eax
call fcn.00405524
pop ecx
test eax, eax
je 0x409a59
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x409a5d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x409a48
mov eax, dword [0x4526cc]
test eax, eax
je 0x409a7a
push eax
call fcn.00404400
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4526cc], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40bd3c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x4513e0
sub eax, eax
test esi, esi
je 0x40be1c
sub eax, 1
test ecx, ecx
je 0x40be1a
test esi, 3
je 0x40bd7a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40bd5f
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x40be01
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40bd88
mov ecx, edx
test ecx, ecx
je 0x40be1a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40be07
not eax
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40c100
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040c183
jae 0x40c10e
xor ecx, ecx
call fcn.0040c183
jae 0x40c13d
xor eax, eax
call fcn.0040c183
jae 0x40c14d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040c183
adc al, al
jae 0x40c12f
jne 0x40c179
stosb byte es:[edi], al
jmp 0x40c111
call fcn.0040c18f
sub ecx, ebx
jne 0x40c156
call fcn.0040c18d
jmp 0x40c175
lodsb al, byte [esi]
shr eax, 1
je 0x40c19f
adc ecx, ecx
jmp 0x40c172
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0040c18d
cmp eax, 0x7d00
jae 0x40c172
cmp ah, 5
jae 0x40c173
cmp eax, 0x7f
ja 0x40c174
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40c111
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x40ca3c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x40cadb
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_1199Pid_8282
call fcn.00405524
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x45183c
call fcn.00405690
add esp, 0xc
test eax, eax
jne 0x40cadb
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x40cad8
mov ecx, dword [ebp + 0x10]
mov esi, 0x451868
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004054e8
add esp, 8
mov eax, 1
jmp 0x40cae6
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x40ca5b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d3a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x483efb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00476735
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40d422
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047418d
mov eax, dword [eax]
push 0x4ac220
push eax
call fcn.00466b24
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004769c0
test bl, bl
je 0x40d422
push 0x4ac220
lea ecx, [esp + 0xc]
call fcn.00476d9c
push 0x4afd94
lea ecx, [esp + 0xc]
call fcn.00476d9c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40d45e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004769c0
jmp 0x40d529
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40d4e2
lea edx, [esp + 0x7c]
push 0x4afd90
push edx
call fcn.00466b24
add esp, 8
test eax, eax
je 0x40d4e2
lea eax, [esp + 0x7c]
push 0x4afd8c
push eax
call fcn.00466b24
add esp, 8
test eax, eax
je 0x40d4e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d472
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004769c0
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40dd20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40dd82
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40dd90
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x483f7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4bd548]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40dec8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40ddf6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004769c0
xor eax, eax
jmp 0x40df3f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00476b49
push esi
lea ecx, [esp + 0xc]
call fcn.00476dd8
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40df1d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040dd20
test eax, eax
jne 0x40df1d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040dd20
test eax, eax
jne 0x40df1d
lea eax, [esp + 0x14]
push 0x4afda8
push eax
call fcn.00467cd0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40defc
lea ecx, [esp + 0x14]
push 0x4afda4
push ecx
call fcn.00467c50
mov esi, eax
add esp, 8
test esi, esi
jne 0x40defc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40deff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00476af9
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40de0e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004769c0
xor eax, eax
jmp 0x40df3f
mov byte [esi], 0
push 0x4afda0
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004769c0
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4