joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b93e4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407be0
lea eax, [ebp - 0x278]
mov edx, dword [0x419cdc]
call fcn.0040913c
xor eax, eax
push ebp
push 0x5b95da
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041ff5c
test al, al
je 0x5b95a3
lea eax, [ebp - 0x27c]
mov ecx, 0x5b95f4
mov edx, dword [ebp - 4]
call fcn.00408be8
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.004203b0
test eax, eax
jne 0x5b959b
mov eax, dword [ebp - 0x264]
mov edx, 0x5b960c
call fcn.00408d20
je 0x5b957d
mov eax, dword [ebp - 0x264]
mov edx, 0x5b961c
call fcn.00408d20
je 0x5b957d
test byte [ebp - 0x268], 0x10
je 0x5b9515
push ebp
lea edx, [ebp - 0x280]
mov eax, dword [ebp - 4]
call fcn.005b932c
pop ecx
lea eax, [ebp - 0x280]
mov edx, dword [ebp - 0x264]
call fcn.00408b90
mov eax, dword [ebp - 0x280]
call fcn.005b93e4
push ebp
lea edx, [ebp - 0x284]
mov eax, dword [ebp - 4]
call fcn.005b932c
pop ecx
lea eax, [ebp - 0x284]
mov edx, dword [ebp - 0x264]
call fcn.00408b90
mov eax, dword [ebp - 0x284]
call fcn.00420c38
test al, al
jne 0x5b957d
mov byte [ebp - 5], 0
jmp 0x5b957d
push 0x20
push ebp
lea edx, [ebp - 0x288]
mov eax, dword [ebp - 4]
call fcn.005b932c
pop ecx
lea eax, [ebp - 0x288]
mov edx, dword [ebp - 0x264]
call fcn.00408b90
mov eax, dword [ebp - 0x288]
call fcn.0040897c
push eax
call sub.kernel32.dll_SetFileAttributesW
push ebp
lea edx, [ebp - 0x28c]
mov eax, dword [ebp - 4]
call fcn.005b932c
pop ecx
lea eax, [ebp - 0x28c]
mov edx, dword [ebp - 0x264]
call fcn.00408b90
mov eax, dword [ebp - 0x28c]
call fcn.00420440
test al, al
jne 0x5b957d
mov byte [ebp - 5], 0
lea eax, [ebp - 0x278]
call fcn.00420400
test eax, eax
je 0x5b947e
lea eax, [ebp - 0x278]
call fcn.00420424
mov eax, dword [ebp - 4]
call fcn.00420c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b95e1
lea eax, [ebp - 0x28c]
mov edx, 5
call fcn.00407b5c
lea eax, [ebp - 0x278]
mov edx, dword [0x419cdc]
call fcn.00409214
lea eax, [ebp - 4]
call fcn.00407afc
ret

Function at 0x5b9624
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407be0
xor eax, eax
push ebp
push 0x5b96ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x23]
xor ecx, ecx
mov edx, 0x1e
call fcn.00405358
mov dword [ebp - 0x1f], 3
mov word [ebp - 0x13], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x5b96c8
mov edx, dword [ebp - 4]
call fcn.00408be8
mov eax, dword [ebp - 0x28]
call fcn.0040897c
mov dword [ebp - 0x1b], eax
lea eax, [ebp - 0x23]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b96b3
lea eax, [ebp - 0x28]
call fcn.00407afc
lea eax, [ebp - 4]
call fcn.00407afc
ret
Function at 0x5b9958
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407be0
mov eax, dword [ebp - 8]
call fcn.00407be0
xor eax, eax
push ebp
push 0x5b99c2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.0040897c
push eax
mov eax, dword [ebp - 4]
call fcn.0040897c
push eax
call sub.kernel32.dll_CopyFileW
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00420244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b99c9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b5c
ret

Function at 0x5b99d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408b10
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040897c
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5b9a10
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408b10
jmp 0x5b9a1d
mov eax, dword [ebp - 4]
mov edx, 0x5b9a30
call fcn.00407edc
pop ecx
pop ecx
pop ebp
ret
Function at 0x5bcc80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
mov al, byte [ebp - 5]
dec eax
test eax, eax
jb 0x5bcd12
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
shl eax, 2
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax]
lea eax, [eax*4 + 0x6423d0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx + 1]
lea edx, [edx*4 + 0x6427d0]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx + 2]
lea edx, [edx*4 + 0x642bd0]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx + 3]
lea edx, [edx*4 + 0x642fd0]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
lea edx, [ecx + edx]
mov dword [edx], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x5bcca1
mov esp, ebp
pop ebp
ret

Function at 0x5d2798
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.00408b10
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5d27bd
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.0040897c
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5d27dc
mov eax, ebx
mov edx, dword [esp]
call fcn.00408b10
pop ecx
pop edx
pop ebx
ret
Function at 0x608598
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00407be0
xor eax, eax
push ebp
push 0x6086a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041ff5c
test al, al
jne 0x6085d9
mov byte [ebp - 9], 0
jmp 0x608683
mov dl, 1
mov eax, dword [0x43fc60]
call fcn.0044db98
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x60867c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x608658
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 8]
push 0x6086c0
push 0x6086d0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00408c70
mov edx, 0x6086f4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
mov byte [ebp - 9], 1
cmp byte [ebp - 9], 0
je 0x60864e
mov eax, dword [ebp - 0x14]
call fcn.0040897c
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x608666
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x608683
mov eax, dword [ebp - 0x10]
call fcn.00405e58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6086a8
lea eax, [ebp - 0x14]
call fcn.00407afc
lea eax, [ebp - 8]
call fcn.00407afc
ret

Function at 0x608704
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
call fcn.00614d44
cmp byte [eax + 0x24], 0
je 0x60871e
mov byte [ebp - 5], 1
jmp 0x608732
push 0
lea eax, [ebp - 0xc]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x60873c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407be0
mov eax, dword [ebp - 8]
call fcn.00407be0
xor eax, eax
push ebp
push 0x608850
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041fec4
test al, al
je 0x608785
mov eax, dword [ebp - 8]
call fcn.0040897c
push eax
call sub.kernel32.dll_DeleteFileW
mov word [ebp - 0x16], 0xff00
xor ecx, ecx
mov dl, 1
mov eax, dword [0x60268c]
call fcn.005285ec
mov dword [ebp - 0x10], eax
mov ax, word [ebp - 0x16]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x440b9c]
call fcn.0044e124
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x60882e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6087f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00603024
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041fec4
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x608802
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x608835
mov eax, dword [ebp - 8]
call fcn.0040897c
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 0x10]
call fcn.00405e58
mov eax, dword [ebp - 0x14]
call fcn.00405e58
ret
Function at 0x6133b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x613463
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00407afc
push 0
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 8]
call fcn.00613044
pop ecx
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004205b8
mov eax, dword [ebp - 4]
call fcn.0040897c
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
call fcn.006130cc
pop ecx
mov eax, dword [ebp - 0xc]
call fcn.0040897c
push eax
push 0x61347c
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
call fcn.00613044
pop ecx
push dword [ebp - 0x14]
push 0x61347c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00408c70
mov eax, dword [ebp - 0x10]
call fcn.0040897c
push eax
push 0x613480
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61346a
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00407b5c
ret

Function at 0x6225a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x6225b0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x62271b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00407afc
xor eax, eax
push ebp
push 0x6226c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00622d58
push 0x622738
call fcn.00614d44
lea edx, [ebp - 0x14]
call fcn.00615108
push dword [ebp - 0x14]
push 0x622774
call fcn.00614d44
mov eax, dword [eax + 0x20]
lea edx, [ebp - 0x18]
call fcn.0041f4a4
push dword [ebp - 0x18]
push 0x622784
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00408c70
mov ecx, dword [ebp - 0x10]
mov edx, 0x62279c
mov eax, dword [ebp - 4]
call fcn.00619b9c
push 0
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00622bc8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004205b8
mov eax, dword [ebp - 0x1c]
call fcn.0040897c
push eax
lea ecx, [ebp - 0x24]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00622c60
mov eax, dword [ebp - 0x24]
call fcn.0040897c
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00622bc8
mov eax, dword [ebp - 0x28]
call fcn.0040897c
push eax
push 0x6227bc
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x62269e
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 4]
call fcn.00622d38
test al, al
je 0x622694
mov ecx, 0x6227d4
mov edx, 0x62279c
mov eax, dword [ebp - 4]
call fcn.00619b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x622700
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622722
lea eax, [ebp - 0x28]
mov edx, 7
call fcn.00407b5c
ret
Function at 0x6227f8
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x622800
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x622acd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00407afc
xor eax, eax
push ebp
push 0x622a70
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x622ae8
call fcn.00614d44
lea edx, [ebp - 0x1c]
call fcn.00615108
push dword [ebp - 0x1c]
push 0x622b24
call fcn.00614d44
mov eax, dword [eax + 0x20]
lea edx, [ebp - 0x20]
call fcn.0041f4a4
push dword [ebp - 0x20]
push 0x622b34
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00408c70
mov ecx, dword [ebp - 0x18]
mov edx, 0x622b4c
mov eax, dword [ebp - 4]
call fcn.00619b9c
call fcn.00614d44
lea edx, [ebp - 0x24]
call fcn.00615120
mov eax, dword [ebp - 0x24]
mov dl, 1
call fcn.0041fec4
test al, al
je 0x6228cc
call fcn.00614d44
mov eax, dword [eax + 0x10]
call fcn.005b9e88
call fcn.00614d44
lea edx, [ebp - 0x28]
call fcn.00615120
mov eax, dword [ebp - 0x28]
call fcn.0040897c
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x622a48
call fcn.00614d44
lea edx, [ebp - 0x2c]
call fcn.006156b4
mov eax, dword [ebp - 0x2c]
mov dl, 1
call fcn.0041fec4
test al, al
je 0x6229e5
mov dl, 1
mov eax, dword [0x43fc60]
call fcn.0044db98
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x622964
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00614d44
lea edx, [ebp - 0x30]
call fcn.006156b4
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x622946
lea ecx, [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x10]
call fcn.0041eb70
jmp 0x62294e
lea eax, [ebp - 0x10]
call fcn.00407afc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62296b
mov eax, dword [ebp - 0xc]
call fcn.00405e58
ret
push 0
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 4]
call fcn.00622bc8
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.004205b8
mov eax, dword [ebp - 0x48]
call fcn.0040897c
push eax
lea ecx, [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00622c60
mov eax, dword [ebp - 0x50]
call fcn.0040897c
push eax
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 4]
call fcn.00622bc8
mov eax, dword [ebp - 0x54]
call fcn.0040897c
push eax
push 0x622b8c
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x622a48
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 4]
call fcn.00622d38
test al, al
jne 0x622a3e
mov ecx, 0x622ba4
mov edx, 0x622b4c
mov eax, dword [ebp - 4]
call fcn.00619b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x622aaa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622ad4
lea eax, [ebp - 0x54]
mov edx, 0x10
call fcn.00407b5c
lea eax, [ebp - 0x10]
call fcn.00407afc
ret
Function at 0x622d58
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x622ee1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43fc60]
call fcn.0044db98
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x622eb7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x622e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x622efc
mov edx, 0x622f60
mov eax, dword [ebp - 4]
call fcn.00619b9c
lea eax, [ebp - 0x1c]
call fcn.006068ac
mov edx, dword [ebp - 0x1c]
mov ecx, 0x622f8c
mov eax, dword [ebp - 8]
call fcn.005ba610
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x622e59
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x622e59
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004205b8
mov edx, dword [ebp - 0x20]
mov eax, 0x622fa8
call fcn.00427fdc
test eax, eax
jle 0x622e51
mov eax, dword [ebp - 0xc]
call fcn.0040897c
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov edx, 0x622fcc
call fcn.00408be8
mov ecx, dword [ebp - 0x24]
mov edx, 0x622f60
mov eax, dword [ebp - 4]
call fcn.0061986c
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x622df9
mov ecx, 0x622fe8
mov edx, 0x622f60
mov eax, dword [ebp - 4]
call fcn.00619b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x622ea1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622ebe
mov eax, dword [ebp - 8]
call fcn.00405e58
ret
Function at 0xa5b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a5b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa5b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5b06a
add dl, dl
jne 0xa5b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5b0dc
xor eax, eax
add dl, dl
jne 0xa5b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5b17d
add dl, dl
jne 0xa5b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa5b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa5b075
mov eax, 1
add dl, dl
jne 0xa5b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa5b0e1
sub eax, ebx
mov ebx, 1
jne 0xa5b128
mov ecx, 1
add dl, dl
jne 0xa5b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa5b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa5b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa5b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa5b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa5b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa5b136
cmp eax, 0x7d00
jae 0xa5b16d
cmp eax, 0x500
jb 0xa5b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa5b075
cmp eax, 0x7f
ja 0xa5b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa5b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa5b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa5b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40ef30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47175b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00466131
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40efb2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00463eb0
mov eax, dword [eax]
push 0x49d210
push eax
call fcn.00456af4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004663bc
test bl, bl
je 0x40efb2
push 0x49d210
lea ecx, [esp + 0xc]
call fcn.0046674c
push 0x4a0d8c
lea ecx, [esp + 0xc]
call fcn.0046674c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40efee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004663bc
jmp 0x40f0b9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40f072
lea edx, [esp + 0x7c]
push 0x4a0d88
push edx
call fcn.00456af4
add esp, 8
test eax, eax
je 0x40f072
lea eax, [esp + 0x7c]
push 0x4a0d84
push eax
call fcn.00456af4
add esp, 8
test eax, eax
je 0x40f072
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40f002
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004663bc
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f8b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f912
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc