joyce8/EMBER2024-capa huggingface dataset:
Function at 0x122e250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1242808
push 0x1232288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x122e329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x122e329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.012311d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x122e329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x122e329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x122e32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0122e351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x122ed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x122ed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x122ed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x122ed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x122ed94
push eax
push esi
call fcn.0123120b
add esp, 8
pop esi
ret 0x10

Function at 0x122eda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x122ee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x122ee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x1247320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01230dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x122edda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x122ee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x122eec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x122eeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x1247320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01230dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x122eeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x122ee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x122f000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x122f131
push esi
call fcn.01232145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.01221080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x122f131
push 0
push ebp
call fcn.012213a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.01221260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x122f08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.012212f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x122f121
push 0x1247918
push edi
call fcn.012303f0
push eax
push ebx
push esi
call fcn.0122ef60
push 0x12478f8
push edi
call fcn.012303f0
push eax
push ebx
push esi
call fcn.0122ef60
push 0x12478d8
push edi
call fcn.012303f0
push eax
push ebx
push esi
call fcn.0122ef60
push 0x12478c0
push edi
call fcn.012303f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0122ef60
push 0x12478a0
push edi
call fcn.012303f0
push eax
push ebx
push esi
call fcn.0122ef60
push 0x1247888
push edi
call fcn.012303f0
push eax
push ebx
push esi
call fcn.0122ef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x12301b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.01230140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.01230140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.01230140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.01230140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x1230bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1230c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x124287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1230c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1230c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c008]
jne 0x40100a
repz ret
jmp fcn.00401720

Function at 0x40829b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004034fe
and dword [ebp - 4], 0
cmp dword [0x41e1c0], 0
mov ebx, eax
jne 0x40834c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4083fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4083fd
push eax
call fcn.0040348c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41e1c0], eax
call esi
push eax
call fcn.0040348c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41e1c4], eax
call esi
push eax
call fcn.0040348c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41e1c8], eax
call esi
push eax
call fcn.0040348c
pop ecx
mov dword [0x41e1d0], eax
test eax, eax
je 0x40834c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040348c
pop ecx
mov dword [0x41e1cc], eax
mov eax, dword [0x41e1cc]
cmp eax, ebx
je 0x4083a4
cmp dword [0x41e1d0], ebx
je 0x4083a4
push eax
call fcn.00403507
push dword [0x41e1d0]
mov esi, eax
call fcn.00403507
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083a4
test edi, edi
je 0x4083a4
call esi
test eax, eax
je 0x40839b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40839b
test byte [ebp - 0xc], 1
jne 0x4083a4
or dword [ebp + 0x10], 0x200000
jmp 0x4083dd
mov eax, dword [0x41e1c4]
cmp eax, ebx
je 0x4083dd
push eax
call fcn.00403507
pop ecx
test eax, eax
je 0x4083dd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083dd
mov eax, dword [0x41e1c8]
cmp eax, ebx
je 0x4083dd
push eax
call fcn.00403507
pop ecx
test eax, eax
je 0x4083dd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41e1c0]
call fcn.00403507
pop ecx
test eax, eax
je 0x4083fd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4083ff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp ebx, 0x182
jne 0x41896c
lea eax, [ebp - 0x20]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x41897c
cmp ebx, 0x19f
jne 0x41897c
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push edi
xor edi, edi
test ebx, ebx
jle 0x4189ae
push esi
jmp 0x418990
lea esi, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.00418940
mov cl, byte [ebp - 4]
mov eax, dword [ebp + 8]
xor byte [edi + eax], cl
inc edi
cmp edi, ebx
jl 0x418990
pop esi
pop edi
cmp ebx, 0x2d
jne 0x4189c8
mov dword [0x513ea0], 0xa62e7790
mov dword [0x513ea4], 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x4189d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x41c008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x513d6c]
push ebx
push esi
mov esi, dword [0x513bb4]
mov ebx, eax
cmp eax, 0x5dd
jne 0x418a0a
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x41cf70]
call fcn.00418910
cmp dword [0x513d6c], 0x2f
jne 0x418a25
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.00418950
add esp, 4
cmp dword [0x513d6c], 0x568
pop esi
pop ebx
jne 0x418a57
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [ebp - 0x808]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x40a225
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x40e3f8
call fcn.0040a2f3
push 1
call fcn.0040a4c4
pop ecx
test al, al
jne 0x40a0ce
push 7
call fcn.0040a9a9
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040a48f
mov byte [ebp - 0x24], al
mov eax, dword [0x4130b0]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40a0c7
test eax, eax
jne 0x40a138
mov dword [0x4130b0], ecx
push 0x40c230
push 0x40c218
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40a11b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40a21f
push 0x40c214
push 0x40c200
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4130b0], 2
jmp 0x40a13d
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040a621
pop ecx
call fcn.0040a99d
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40a16d
push esi
call fcn.0040a594
pop ecx
test al, al
je 0x40a16d
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0040abd8
call esi
call fcn.0040a9a3
mov esi, eax
cmp dword [esi], edi
je 0x40a18b
push esi
call fcn.0040a594
pop ecx
test al, al
je 0x40a18b
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.0040aabe
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.0040aaf1
test al, al
jne 0x40a1c4
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x40a1cd
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040a63e
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40a21f
call fcn.0040a339
ret
call fcn.00409f34
jmp 0x40a0af

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x403a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi - 0x6b]
mov ch, 0x49
jne 0x403ac4
mov eax, dword [esi + 0x210824]
test eax, eax
je 0x403ac4
mov eax, dword [0xaf8cb4]
test eax, eax
je 0x65653c25
dec eax
add eax, 0x3fb802b4
jmp 0xf78f25
sub dword [eax + 0xfb02fb], 1
pop edi
add eax, 0xa3104692
or al, 2
dec ecx
add bl, ch
mov byte [0xa1104e8b], al
mov word [edx], es
inc ecx
add byte [ebx], bh
enter 0x1874, 0xffffffffffffff8b
or eax, 0x4102b8
mov eax, dword [0x4102a4]
inc ecx
inc eax
mov dword [0x4102f2], ecx
mov dword [0xb502c0], eax
mov eax, dword [0x8902ac]
mov ecx, dword [0x3cd010]
scasb al, byte es:[edi]
shr eax, 0x8d
inc edi
add dword [0xc8159c00], edi
xchg esp, eax
inc ecx
add byte [ebx + 0x5e7c1b8], cl
add edi, edx
inc eax
mov dword [0xda02ac], eax
call 0x2bb62100
mov dword [0x410ba0], eax
mov dword [0xd7c20ba4], edx
mov ebx, eax
push eax
or byte [edx], al
pop edi
push 0xffffffffffffffa4
or eax, dword [ecx]
mov ecx, dword [edi]
xor byte [eax], cl
add byte [eax], al
jl 0x403adb
push esp
or byte [eax], al
add byte [ecx + 0x34962803], cl
or byte [eax], al
add byte [ecx - 0x717491b1], cl
cmp byte [eax], cl
cmp al, byte [eax]
mov eax, dword [esi - 0x51fff7c8]
popal
lds esi, [eax + ecx]
add byte [eax], al
sub ecx, eax
mov eax, dword [esi + 0x83c]
or eax, 0x7f2e62c2
or bh, byte [esp + eax - 0x7b]
push eax
jae 0x403b7e
xor ecx, ecx
xor eax, eax
retf
Function at 0x406810
Capabilities:
Connect socket

Disassembly:
and eax, 0x9256ec8b
jne 0x40681f
push 0x1540662d
push esi
mov eax, dword [esi]
push eax
call fcn.00405640
push esi
xchg byte [ebp - 0x7cd6a702], dh
les eax, [esi + ebx*2]
pop ebp
and eax, dword [eax + eax]
nop
nop
nop
nop
nop
push ecx
nop
salc
nop
nop
sub al, 0x90
and al, 0x13
mov ebp, esp
sahf
in al, dx
scasb al, byte es:[edi]
add al, dl
add byte [ebx - 0x75], dl
in al, 8
push esi
push edi
out dx, al
cmpsd dword [esi], dword es:[edi]
cmp eax, 0xffffffff
je 0x4069ef
mov esi, dword [ecx + 0xf518510]
test byte [ecx - 0x7404ffff], cl
push edx
or al, 0x31
dec esi
adc al, 0x27
lds esi, [eax]
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
or dword [edx], ebp
aaa
push 0x4e
add byte [ebx + 0x40c1d8bb], cl
add bh, bh
salc
test edx, ebx
mov es, word [eax + edi - 0xeac400]
salc
add eax, 0xafc80
cmp eax, 0x5e0b23b3
or eax, dword [ebp + 0xe10151]
mov edi, dword [ebx + 0x20]
mov esi, dword [ebx + 0x24]
mov eax, edi
or eax, 0x5f8b75c6
pop esi
mov eax, 0xbe5cc5
push ebp
mov esp, ebp
pop ebp
ret 0x1d08
mov eax, 0x97513
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp - 0xa]
push esi
rol esp, 1
add al, 0x85
inc eax
jne 0x40a35f
ror dword cs:[ecx + edx*2], 0xff
sub al, 0x36
inc eax
add byte [ebx], dh
ljmp 0x8390
xor ebp, edx
pop esi
pop ebp
jne 0x40a362
nop
cmp eax, 1
jne 0x40a370
mov eax, dword [ecx + 8]
cmp bh, 0x9b
xor byte [ebx], dl
inc eax
add bl, ch
jae 0xe3b5a66d
cmp eax, 2
jne 0x40a358
mov ecx, dword [ecx - 0xe]
cmpsb byte [esi], byte es:[edi]
inc eax
adc eax, 0x393934
test eax, eax
imul edx, ebp, 0x83469020
inc eax
add bh, dh
salc
test eax, eax
je 0x40a358
call esi
salc
pop edi
jnp 0x40a390
or bh, byte [ecx + 0x4555d5e]
add byte [eax - 0x6f6f1a70], dl
and al, 0x8b
in al, dx
or eax, dword [ebp + 8]
push 0x40a280
push eax
mov eax, dword [eax]
or eax, 0xffb30c2e
call [ebp - 0x3e]
add al, 0
nop
nop
nop
nop
pop ebp
nop
test byte [eax + 0x4c2c033], dl
add byte [eax + 0xa1b9090], dl
enter 0xffffffffffff9090, 0xffffffffffffff90
nop
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
inc esi
xor ecx, dword [ebx + 0x50510c4d]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call 0x565f19ad
xchg dword [ecx - 0x36533f68], ebx
call esi
test eax, eax
jne 0x40a3fe
pop esi
pop ebp
mov dl, 8
add bh, bh
salc
call esi
add eax, 0xafc80
pop esi
pop ebp
ret 0x7008
Function at 0x10aa51b8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10aa5308
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10aa51de
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10aa51ca
add dl, dl
jne 0x10aa51e9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10aa523c
xor eax, eax
add dl, dl
jne 0x10aa51f6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10aa52dd
add dl, dl
jne 0x10aa5205
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10aa5210
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10aa521b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10aa5226
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10aa5232
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10aa51d5
mov eax, 1
add dl, dl
jne 0x10aa524a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10aa5255
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10aa5241
sub eax, ebx
mov ebx, 1
jne 0x10aa5288
mov ecx, 1
add dl, dl
jne 0x10aa526e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10aa5279
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10aa5265
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10aa51d5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10aa529f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10aa52aa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10aa5296
cmp eax, 0x7d00
jae 0x10aa52cd
cmp eax, 0x500
jb 0x10aa52c8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10aa51d5
cmp eax, 0x7f
ja 0x10aa52d0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10aa51d5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10aa52fe
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10aa51d5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3dc9321d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4f57b21
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x116a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x116a38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x1193074
push ecx
mov edi, eax
call fcn.0117e198
mov esi, eax
add esp, 8
test esi, esi
jne 0x116a3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0117e02e
push esi
call fcn.0117dfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x116d850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x116d8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x1198720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x116d8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0117e1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x116d8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x1198720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x116d92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0117f082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x116d957
mov word [eax], si
add eax, 2
push eax
call fcn.0117f030
add esp, 4
jmp 0x116d959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x116d8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x116d8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x116dff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret