joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b350
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4443c6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x45e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 4]
call fcn.0041ebed
mov dword [ebp - 4], 0
lea esi, [edi + 0x14]
mov dword [edi], vtable.ScriptEngineFactory.0
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.ActiveScriptSite.1.0
mov dword [esi + 4], vtable.ActiveScriptSite.0
mov dword [esi + 8], vtable.CArray_class_ExposedObject___class_ExposedObject__.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
call fcn.00413f51
mov dword [esi + 0x44], 1
mov eax, edi
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f0e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444908
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x45e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x14]
push 0
push 0
push eax
push 0x400
call esi
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.004144f5
mov ecx, eax
test ecx, ecx
jne 0x40f141
push 0x80004005
call fcn.00402370
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
push dword [ebp - 0x14]
call esi
push eax
lea eax, [ebp - 0x10]
push str.error__d_n_s
push eax
call fcn.00401c30
add esp, 0xc
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x18], ecx
push eax
call fcn.00402a80
mov ecx, edi
call fcn.00410590
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x410590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444aa8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x45e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi + 0x224], 0
je 0x410710
push 2
push 0x4534c4
lea ecx, [ebp + 8]
call fcn.00402940
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebx, eax
push ebx
mov dword [ebp - 0x14], ebx
call esi
cmp dword [edi + 0x228], 0
je 0x4106a9
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
test al, 1
jne 0x41068f
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call edi
mov esi, eax
push esi
call fcn.00413d07
add esp, 4
push 0
push 0
push esi
mov esi, eax
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call edi
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfde9
mov dword [ebp - 0x14], eax
call edi
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410667
push 0
lea eax, [ebp - 0x10]
sub ecx, edx
push eax
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call eax
push dword [ebp - 0x14]
call edi
push esi
jmp 0x410708
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call esi
jmp 0x410710
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 1
mov dword [ebp - 0x18], eax
call ebx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx - 0xc]
lea ecx, [esi + 1]
push ecx
call fcn.00413d07
push esi
mov edi, eax
push 0
push edi
call fcn.0042e550
add esp, 0x10
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CharToOemBuffW]
push 0
lea eax, [ebp - 0x10]
mov byte [edi + esi], 0
push eax
push esi
mov esi, dword [ebp - 0x14]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call eax
push dword [ebp - 0x18]
call ebx
push edi
call fcn.00413d10
add esp, 4
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410732
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4119b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444aa8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x45e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.004022b0
mov dword [ebp - 4], 0
push dword [ebx + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call edi
or esi, 0xffffffff
cmp dword [ebx + 0x24], 0
je 0x411ad4
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
test al, 1
jne 0x411ab6
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push esi
push dword [ebp + 8]
push 0
push 0xfde9
call edi
mov esi, eax
push esi
call fcn.00413d07
push esi
push 0
push eax
mov dword [ebp - 0x10], eax
call fcn.0042e550
add esp, 0x10
push 0
push 0
push esi
push dword [ebp - 0x10]
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call edi
mov edi, dword [ebp - 0x10]
mov byte [edi + esi - 1], 0
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfde9
mov dword [ebp - 0x10], eax
call esi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411a80
push 0
lea eax, [ebp - 0x18]
sub ecx, edx
push eax
push ecx
push edi
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp - 0x10]
call esi
push edi
call fcn.00413d10
add esp, 4
or esi, 0xffffffff
jmp 0x411b14
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x20]
call edi
jmp 0x411b14
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0040de50
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push 0
push ecx
push dword [eax - 0xc]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x20]
call edi
mov edx, dword [ebp - 0x10]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x411b14
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x411b33
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x412ca0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x412cb0
lea edi, [ecx + 0x20]
sub esi, edx
xor ebx, ebx
mov dword [ebp - 8], edi
sub ecx, edi
mov dword [ebp - 4], ecx
xor edx, edx
lea ecx, [edi + ebx]
mov eax, ebx
mov edi, dword [ebp + 8]
div esi
mov al, byte [edx + edi]
mov edx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov byte [ecx], bl
inc ebx
mov byte [edx + ecx + 0x120], al
cmp ebx, 0xff
jle 0x412cc6
xor ebx, ebx
mov edx, edi
mov esi, 0x100
nop word [eax + eax]
mov al, byte [edx + 0x100]
lea edx, [edx + 1]
mov cl, byte [edx - 1]
add al, bl
add al, cl
movzx ebx, al
movzx eax, byte [ebx + edi]
mov byte [edx - 1], al
mov byte [ebx + edi], cl
sub esi, 1
jne 0x412d00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x412d30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
inc esi
mov dword [ebp - 4], ebx
push esi
call fcn.00413d07
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 8], edi
call fcn.0042e550
add esp, 0x10
mov ecx, ebx
push dword [ebp + 0x10]
call fcn.00412ca0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x412ddb
mov eax, dword [ebp - 4]
xor ebx, ebx
add eax, 0x20
xor ecx, ecx
sub dword [ebp + 8], edi
mov dword [ebp + 0xc], eax
nop word [eax + eax]
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [eax + ebx]
add cl, dl
movzx ecx, cl
mov dword [ebp + 0x10], ecx
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + ebx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], dl
movzx ecx, byte [eax + ebx]
movzx eax, dl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp - 4]
movzx eax, byte [eax + ecx + 0x20]
mov ecx, dword [ebp + 8]
xor al, byte [ecx + edi - 1]
mov ecx, dword [ebp + 0x10]
mov byte [edi - 1], al
mov eax, dword [ebp + 0xc]
sub esi, 1
jne 0x412d80
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4135e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444ef1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.00420a3a
test eax, eax
jne 0x413649
push str.Fatal_Error:_MFC_initialization_failed_n
call fcn.00401af0
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x268
call fcn.00413cd0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x413677
mov ecx, eax
call fcn.0040e7f0
mov edi, eax
jmp 0x413679
xor edi, edi
mov ebx, 1
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], ebx
jle 0x41372b
nop
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push dword [eax + ebx*4]
call fcn.004022b0
mov dword [ebp - 4], 1
cmp dword [edi + 0x25c], 0
mov eax, dword [ebp - 0x10]
jne 0x4136f0
mov edx, str.____
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x4136de
test si, si
je 0x4136da
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4136de
add ecx, 4
add edx, 4
test si, si
jne 0x4136b8
xor ecx, ecx
jmp 0x4136e3
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4136f0
mov byte [edi + 0x220], 1
jmp 0x413702
lea ecx, [edi + 0x254]
push eax
push dword [ecx + 8]
call fcn.00414260
mov eax, dword [ebp - 0x10]
lea edx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413721
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x413690
mov ecx, edi
call fcn.0040f500
cmp byte [edi + 0x220], 0
jne 0x41376c
mov eax, dword [edi + 0x238]
cmp dword [eax - 0xc], 0
je 0x41376c
mov eax, dword [edi + 0x23c]
cmp dword [eax - 0xc], 0
je 0x41376c
mov ecx, edi
call fcn.0040f1a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x462900]
test eax, eax
jne 0x4137a4
push 0x7c
call fcn.00413cd0
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x413796
mov ecx, eax
call fcn.0040b350
jmp 0x413798
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x462900], eax
push edi
mov ecx, eax
call fcn.0040b7d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4265bb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x4458c9
call fcn.0042bfc9
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [ecx], edi
cmp dword [eax + 0x58], edi
je 0x426665
push dword [ebp + 8]
mov ecx, eax
call fcn.004268f3
mov esi, eax
test esi, esi
je 0x4266f8
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
test eax, eax
jne 0x42664e
push edx
call fcn.00413d07
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42664e
xor edi, edi
inc edi
jmp 0x426658
push dword [ebx]
call fcn.00413d10
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00421cfb
jmp 0x4266f6
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [esi + 0x84]
mov ecx, esi
push eax
call fcn.0042bf8c
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4266ee
mov ecx, dword [ebp + 0x14]
mov eax, esi
shr eax, 1
push eax
mov dword [ecx], eax
call fcn.00413d07
mov dword [ebx], eax
pop ecx
test esi, esi
jle 0x4266e8
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040afd0
push edi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.0040afd0
add al, bl
mov edx, edi
test edx, edx
jns 0x4266d9
add edx, 1
sar edx, 1
mov ecx, dword [esi]
add edi, 2
mov byte [edx + ecx], al
cmp edi, dword [ebp - 0x18]
jl 0x4266b0
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.004023f0
mov eax, edi
call fcn.0042bf92
ret 0x10

Function at 0x426700
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x426753
push esi
push dword [ebp + 8]
call fcn.004268f3
mov edi, eax
test edi, edi
jne 0x426723
mov eax, dword [ebp + 0x10]
jmp 0x426765
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42671e
mov eax, dword [ebp - 8]
jmp 0x426765
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43a80e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043a68d

Function at 0x43d9e2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043d350

Function at 0x43d9ed
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043d58b
Function at 0x1004605f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100870c0]
jne 0x10046069
repz ret
jmp fcn.1004ef8a

Function at 0x100490e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x100490f5
pop dword [ebp - 0x14]
mov eax, 0xe918951b
add eax, 0x26ebfbda
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x57695
push 0
mov eax, 0x6d610ca2
add eax, 0xa29f0482
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3ea6
mov esi, eax
mov edx, 0x86a7a0ee
sub edx, 0x769d94ee
add edx, dword [ebp - 0x14]
mov ebx, 0xd1d810c0
add dword [ebp - 0x10], 0x1a7ad1b2
mov edi, dword [edx]
add dword [ebp - 8], edi
sub edi, ebx
sub dword [ebp - 0x10], 0x28128873
mov dword [esi], edi
xor dword [ebp - 4], 0x4fff040d
add esi, 4
add edx, 0x89da1216
sub edx, 0x89da1212
loop 0x10049148
add eax, 0xed6b
mov ebx, eax
add eax, 0x2e3f1ff1
add eax, 0xd1c0e014
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x104e6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push 0x10352
mov dword [0x10a88], eax
mov eax, dword [ebp + 0xc]
push esi
push esi
mov dword [0x10a84], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [section..data], eax
push esi
lea eax, [ebp + 0xc]
push eax
mov dword [0x10a94], esi
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
call edi
test al, al
je 0x10533
xor cl, cl
call dword [sym.imp.HAL.dll_KfRaiseIrql]
call edi
test al, al
je 0x1053d
xor eax, eax
jmp 0x10567
push esi
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x1f03ff
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov eax, dword [0x10a94]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x6c8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x6c81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x6c807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6c806a
add dl, dl
jne 0x6c8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6c80dc
xor eax, eax
add dl, dl
jne 0x6c8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6c817d
add dl, dl
jne 0x6c80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6c80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6c80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6c80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x6c80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x6c8075
mov eax, 1
add dl, dl
jne 0x6c80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6c80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6c80e1
sub eax, ebx
mov ebx, 1
jne 0x6c8128
mov ecx, 1
add dl, dl
jne 0x6c810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6c8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6c8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6c8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6c813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6c814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6c8136
cmp eax, 0x7d00
jae 0x6c816d
cmp eax, 0x500
jb 0x6c8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6c8075
cmp eax, 0x7f
ja 0x6c8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6c8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x6c819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x6c8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x405a12
pop dword [ebp - 0x18]
mov eax, 0x9ee8a243
sub eax, 0x9ea84831
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x81490a63
add dword [ebp - 0x28], 0xcd093ae8
mov dword [ebp - 0x24], 0x5bd64198
add dword [ebp - 0x24], 0xd65d0aad
mov dword [ebp - 0x20], 0xe07dc482
add dword [ebp - 0x20], 0x6bce7fac
mov dword [ebp - 0x1c], 0xc5da2c82
sub dword [ebp - 0x1c], 0xc5da2c82
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xb3df89e6
sub dword [ebp - 0x28], 0x3f6d2090
mov dword [ebp - 0x24], 0xb3bb15c9
add dword [ebp - 0x24], 0x8db14bac
mov dword [ebp - 0x20], 0x33ba7e52
add dword [ebp - 0x20], 0x2fb4ee1a
mov dword [ebp - 0x1c], 0xbd446e10
sub dword [ebp - 0x1c], 0xbd446e10
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xf98698f7
sub eax, 0xf94617f7
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3476c
push 0
call eax
mov ecx, 0x755092d4
sub ecx, 0x755054e5
xor edi, edi
add edi, eax
mov ebx, 0x30d9828c
sub ebx, 0x30929e8c
add ebx, dword [ebp - 0x18]
mov edx, 0x51c578a7
sub edx, 0xa720edf0
sub dword [ebp - 8], ecx
mov esi, dword [ebx]
xor dword [ebp - 8], 0x18a49a6
xor esi, edx
xor dword [ebp - 0x10], 0x20eba9cb
mov dword [edi], esi
xor dword [ebp - 0x14], ecx
add edi, 0xce67c575
add edi, 0x31983a8f
add ebx, 0x742c2f00
sub ebx, 0x742c2efc
loop 0x405b31
add eax, 0xea8f
mov ebx, eax
add eax, 0x413e466c
sub eax, 0x413e4667
mov ecx, 0x3108907
sub ecx, 0x2d08907
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc