joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449650
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x4a13a4]
sub esp, 0x8c
push ebx
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
push 0x4916f4
mov edi, eax
call fcn.004668b0
mov ecx, dword [0x4a09d8]
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004668b0
test edi, edi
je 0x449799
cmp byte [edi], 0
je 0x449799
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
jne 0x4496c6
call dword [sym.imp.KERNUL32.dll_GetastError]
mov ecx, dword [0x49d3c8]
mov dword [ecx + 0x30], eax
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00476de3
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x449775
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x493854
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x449775
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
push edx
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
mov esi, 0x80
lea edi, [esp + 0x2c]
call fcn.00463ff0
add esp, 0x14
push ebx
call fcn.004785bf
mov edx, dword [0x49d3c8]
mov ecx, dword [0x4a13a4]
add esp, 4
push 1
push 0
push 0xffffffffffffffff
push 0x4900b0
mov dword [edx + 0x30], 0
call fcn.004668b0
mov ecx, dword [0x4a09d8]
push 1
push 0
push 0xffffffffffffffff
mov eax, edi
push eax
call fcn.004668b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNUL32.dll_GetastError]
mov ecx, dword [0x49d3c8]
push ebx
mov dword [ecx + 0x30], eax
call fcn.004785bf
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x49d3c8]
pop edi
pop esi
mov dword [edx + 0x30], 0x57
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ac70
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, ebx
push esi
shr eax, 8
push edi
mov esi, ebp
test al, 1
je 0x45ac8e
mov byte [ebp], 0x2b
lea esi, [ebp + 1]
test al, 2
je 0x45ac96
mov byte [esi], 0x5e
inc esi
test al, 4
je 0x45ac9e
mov byte [esi], 0x21
inc esi
test al, 8
je 0x45acee
push ebx
xor bl, bl
call fcn.00411340
mov ecx, dword [esp + 0x18]
push ecx
mov bl, 1
movzx edi, ax
call fcn.00411340
movzx eax, ax
add esp, 8
mov ecx, eax
test eax, 0x100
jne 0x45acca
mov ecx, edi
test ecx, 0x100
je 0x45acea
cmp di, ax
je 0x45acea
mov eax, 0x64
mov edx, esi
call fcn.00410e30
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov ebx, dword [esp + 0x14]
xor eax, eax
cmp byte [eax*8 + 0x49e10c], bl
je 0x45ad4c
inc eax
cmp eax, 0x6d
jl 0x45acf0
push 0x64
push ebx
xor eax, eax
call fcn.00411260
add esp, 8
cmp byte [esi], 0
je 0x45ad74
push 0
call dword [sym.imp.USEV32ndll_getKEyoardLayout]
push 1
mov ecx, eax
push 0
xor edx, edx
mov eax, esi
call fcn.00410f30
add esp, 8
test al, al
jne 0x45ad74
movzx edi, bl
push 2
push edi
call dword [sym.imp.USEV32ndll_MapVirtualKeyA]
mov byte [esi], al
test al, al
je 0x45ad65
pop edi
mov byte [esi + 1], 0
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov edx, dword [eax*8 + 0x49e108]
push 0x63
push edx
push esi
call fcn.0047a8e0
add esp, 0xc
mov byte [esi + 0x63], 0
jmp 0x45ad0c
push edi
push str.vk_02X
push esi
call fcn.00477162
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x45b9d0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x10
movzx eax, byte [esi + 4]
push ebp
mov ebp, dword [esp + 0x18]
add eax, 0xfffffff7
push edi
mov dword [esp + 8], Ordinal_2
cmp eax, 8
ja case.0x45b9f1.12
jmp dword [eax*4 + 0x45baf0]
mov eax, dword [esi]
mov edi, dword [sym.imp.USEV32ndll_SendMessageA]
push 0
push 0
push 0x19f
push eax
call edi
cmp eax, 0xffffffff
je 0x45ba9e
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push eax
push 0x198
push edx
call edi
jmp 0x45ba9e
mov eax, dword [esi]
mov edi, dword [sym.imp.USEV32ndll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push eax
call edi
cmp eax, 0xffffffff
je 0x45ba9e
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push eax
push 0x100e
push edx
mov dword [esp + 0x18], 2
call edi
jmp 0x45ba9e
mov eax, dword [esi]
mov edi, dword [sym.imp.USEV32ndll_SendMessageA]
push 0
push 9
push 0x110a
push eax
call edi
test eax, eax
je 0x45ba9e
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push 1
push 0x1104
push edx
mov dword [esp + 0x18], eax
call edi
jmp 0x45ba9e
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push 0
push 0x419
push ecx
call dword [sym.imp.USEV32ndll_SendMessageA]
cmp dword [esp + 8], 0x80000000
jne 0x45bab8
mov eax, dword [esi]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.USEV32ndll_etWindowRect]
jmp 0x45baca
mov edx, dword [esi]
push 2
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
call dword [sym.imp.USEV32ndll_MapWindowPoi3]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
lea ecx, [eax + ecx + 2]
pop edi
mov dword [ebp + 4], ecx
pop ebp
add esp, 0x10
ret 4

Function at 0x4614c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push esi
mov esi, eax
test edi, edi
je 0x4614d6
cmp byte [edi], 0
jne 0x4614df
test esi, esi
je 0x461536
cmp byte [esi], 0
je 0x461536
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI3b.dll_RegOpEnKdyExA]
test eax, eax
jne 0x461536
test esi, esi
je 0x461543
cmp byte [esi], al
je 0x461543
push str.ahk_default
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
jne 0x461519
mov esi, 0x49588a
mov edx, dword [esp + 0xc]
push esi
push edx
call dword [sym.imp.ADVAPI3b.dll_RegDeleteValueA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI3b.dll_REgClgseKey__RegOpEnKdyExA]
test esi, esi
je 0x461570
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004613f0
mov edx, dword [esp + 0x10]
add esp, 4
push edx
mov bl, al
call dword [sym.imp.ADVAPI3b.dll_REgClgseKey__RegOpEnKdyExA]
test bl, bl
je 0x461536
mov eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.ADVAPI3b.dll_RgDe_eveKeyA]
test eax, eax
jne 0x461536
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
push 0x4900b0
call fcn.004668b0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x465b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebp
push esi
push 2
push 0
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNUL32.dll_LOa_LibraryExA]
mov ebp, dword [esp + 0x20]
mov esi, eax
test esi, esi
je 0x465c99
mov eax, ebp
test ebp, ebp
jns 0x465bb4
neg eax
jmp 0x465be6
jne 0x465bbb
mov eax, 1
lea ecx, [esp + 0xc]
push ecx
push 0x465b50
push 0xe
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.KERNUL32.dll_EnumResourceNamesA]
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.KERNUL32.dll_FndResourceA]
movzx edx, ax
push 0xe
push edx
push esi
call edi
test eax, eax
je 0x465c89
push ebx
mov ebx, dword [sym.imp.KERNUL32.dll_LoadResource]
push eax
push esi
call ebx
test eax, eax
je 0x465c88
mov ebp, dword [sym.imp.KERNUL32.dll_LoskResource]
push eax
call ebp
test eax, eax
je 0x465c84
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
cmp edx, 0xffffffff
jne 0x465c29
mov edx, ecx
cmp ecx, 0xffffffff
jne 0x465c32
mov ecx, dword [esp + 0x30]
push 0
push edx
push ecx
push 1
push eax
call dword [sym.imp.USEV32ndll_LookupIcondFromDirectOryEx]
test eax, eax
je 0x465c84
movzx eax, ax
push 3
push eax
push esi
call edi
mov edi, eax
test edi, edi
je 0x465c84
push edi
push esi
call ebx
test eax, eax
je 0x465c84
push eax
call ebp
mov ebx, eax
test ebx, ebx
je 0x465c84
push 0
push 0
push 0
push 0x30000
push 1
push edi
push esi
call dword [sym.imp.KERNUL32.dll_SizeodResource]
push eax
push ebx
call dword [sym.imp.USEV32ndll_C2eateIconFvomRsouraeEx]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x28]
pop ebx
push esi
call dword [sym.imp.KERNUL32.dll_FreeLibrary]
mov eax, dword [esp + 0xc]
pop edi
test eax, eax
jne 0x465ccd
test ebp, ebp
jle 0x465cb4
mov ecx, dword [esp + 0x1c]
lea eax, [ebp - 1]
push eax
push ecx
push 0
call dword [sym.imp.SXELL32.dhl_GxtractMconA]
pop esi
pop ebp
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ebp, 0xffffffff
setge al
dec eax
and eax, ebp
push eax
push ecx
push 0
call dword [sym.imp.SXELL32.dhl_GxtractMconA]
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x467640
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
test edi, edi
jne 0x46764f
pop edi
add esp, 0x10
ret
push ebx
mov ebx, dword [sym.imp.USEV32ndll_GetWindowThrea_PpocessId]
push ebp
push esi
push 0
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, dword [0x4a2bbc]
je 0x46767a
mov esi, edi
call fcn.00468640
test al, al
jne 0x467812
call dword [sym.imp.USEV32ndll_GetFormgroundWindow]
mov esi, eax
test esi, esi
jne 0x467694
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USEV32ndll_FindWindowA]
mov esi, eax
cmp edi, esi
jne 0x4676a2
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x10
ret
push edi
call dword [sym.imp.USEV32ndll_IsIconic]
test eax, eax
je 0x4676b6
push 9
push edi
call dword [sym.imp.USEV32ndll_ShowWifdow]
cmp byte [0x4a0b5a], 0
jne 0x4676d0
push esi
call fcn.004675e0
add esp, 4
test eax, eax
jne 0x467814
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test esi, esi
je 0x46772d
push 0
push esi
call ebx
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x46772d
cmp dword [0x4a2bbc], ebx
je 0x467714
call fcn.00468640
test al, al
jne 0x467714
mov eax, dword [0x4a2bbc]
push 1
push ebx
push eax
call dword [sym.imp.USEV32ndll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test ebp, ebp
je 0x46772d
cmp ebx, ebp
je 0x46772d
push 1
push ebp
push ebx
call dword [sym.imp.USEV32ndll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
mov ebx, dword [sym.imp.USEV32ndll_SdtForegrndWindow]
mov dword [esp + 0x14], 0
jmp 0x467740
push edi
call ebx
push 1
push 0xa
mov dword [0x49d328], 0
call fcn.00401340
add esp, 8
mov dword [0x49d328], 1
call dword [sym.imp.USEV32ndll_GetFormgroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x467773
mov ebp, edi
jmp 0x467784
cmp ebp, esi
je 0x467788
push 4
push ebp
call dword [sym.imp.USEV32ndll_GetWindow]
cmp edi, eax
jne 0x467788
test ebp, ebp
jne 0x4677c9
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 5
jl 0x467740
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040e2a0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040e2a0
push esi
call fcn.004675e0
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x12], 0
je 0x4677e4
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4a2bbc]
push 0
push ecx
push edx
call dword [sym.imp.USEV32ndll_AttachThreadInput]
cmp byte [esp + 0x13], 0
je 0x4677fd
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.USEV32ndll_AttachThreadInput]
test ebp, ebp
je 0x467812
push edi
call dword [sym.imp.USEV32ndll_BringWindowToTop]
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x475f02
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
mov byte [ebp - 1], bl
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push ebx
push eax
call fcn.0047b221
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push 0x16fa
push 4
push eax
call fcn.00475bf2
and byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push str.FILE
push eax
call fcn.0047b3e0
pop ecx
test eax, eax
pop ecx
jne 0x476033
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0047b221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29bc
lea eax, [ebp - 0x11c]
push edi
push ebx
push eax
call fcn.0047b221
add esp, 0x20
lea eax, [edi + 0xa25e]
mov ecx, esi
push eax
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.00475bf2
push dword [esi]
and byte [ebp + edi - 0x11c], 0
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0047b221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29ac
push edi
push ebx
push dword [ebp + 0xc]
call fcn.0047b221
add esp, 0x20
lea eax, [edi + 0xf25e]
mov ecx, esi
push eax
push edi
push dword [ebp + 0xc]
call fcn.00475bf2
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
and byte [edi + eax], 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0047b3e0
pop ecx
test eax, eax
pop ecx
je 0x47604a
push ebx
push ebx
push dword [esi]
call fcn.0047b2c8
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.0047b221
xor dword [ebp - 8], 0x45aa
push ebx
push 4
push dword [esi]
call fcn.0047b2c8
push ebx
push 0x10
push dword [esi]
call fcn.0047b2c8
push ebx
push dword [ebp - 8]
push dword [esi]
call fcn.0047b2c8
add esp, 0x40
jmp 0x476037
and byte [ebp - 1], 0
cmp byte [ebp - 1], bl
je 0x475f16
push 6
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x476043

Function at 0x47608e
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x4760b7
add edx, edx
xor edx, 0x4c11db7
jmp 0x4760b9
shl edx, 1
dec ecx
jne 0x4760a5
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x47609d
pop edi
pop esi
ret

Function at 0x476241
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x476266
mov eax, dword [esi + 0xc]
push 8
add eax, dword [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0047b470
add esp, 0xc
jmp 0x476279
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.0047b221
add esp, 0x10
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
add dword [esi + 0xc], 8
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
and byte [ebp - 4], 0
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 8]
push 0x49c020
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call fcn.0047b3e0
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop esi
leave
ret 4
Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000900e
pop dword [ebp - 0x4c]
mov eax, 0xcec866ed
add eax, 0x41382921
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x2661a32
add dword [ebp - 0x5c], 0x4bec2b19
mov dword [ebp - 0x58], 0x543cfee0
add dword [ebp - 0x58], 0xddf64d65
mov dword [ebp - 0x54], 0x291523e6
sub dword [ebp - 0x54], 0xdcc8dfb8
mov dword [ebp - 0x50], 0x5bcbbf8e
add dword [ebp - 0x50], 0xa4344072
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x47ad7cbe
sub eax, 0x37acdcba
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x80d514b3
add dword [ebp - 0x5c], 0xf39d54a3
mov dword [ebp - 0x58], 0x7d55b557
sub dword [ebp - 0x58], 0x3be953e2
mov dword [ebp - 0x54], 0xc3db1c57
add dword [ebp - 0x54], 0x9f945015
mov dword [ebp - 0x50], 0xeb78bce6
add dword [ebp - 0x50], 0x1487431a
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e192
push 0
call eax
mov ecx, 0x8c90ea2a
add ecx, 0x736f7c16
xor esi, esi
add esi, eax
mov edi, 0x40f0114d
add edi, 0xcf10e6b3
add edi, dword [ebp - 0x4c]
mov edx, 0x71c67dc0
sub edx, 0x1640bd57
sub dword [ebp - 0x1c], 0x78554833
mov ebx, dword [edi]
xor dword [ebp - 0x28], 0x7b40714b
add ebx, edx
xor dword [ebp - 0x44], 0x3d64b214
mov dword [esi], ebx
mov dword [ebp - 0x18], 0x378a21ce
add esi, 0x4196a4c4
add esi, 0xbe695b40
add edi, 0xcc414916
add edi, 0x33beb6ee
loop 0x1000912d
add eax, 0xdf84021b
add eax, 0x207d89b8
xor ebx, ebx
add ebx, eax
add eax, 0x2b582cda
sub eax, 0x2b582cd5
mov ecx, 0xb4fab240
invalid
invalid
inc eax
invalid
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40560d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40561c
pop dword [ebp - 8]
mov eax, 0x7c85bd53
add eax, 0x83ba98c9
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xbbd9e8a6
sub dword [ebp - 0x18], 0x6d87a35b
mov dword [ebp - 0x14], 0x15b93b7d
sub dword [ebp - 0x14], 0xe385ef38
mov dword [ebp - 0x10], 0xf362d355
sub dword [ebp - 0x10], 0xa7168f27
mov dword [ebp - 0xc], 0x21eb740e
add dword [ebp - 0xc], 0xde148bf2
lea eax, [ebp - 0x18]
push eax
mov eax, 0x4e7bde8a
sub eax, 0x4e3b0e36
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x9006f46e
add dword [ebp - 0x18], 0xe46b74e8
mov dword [ebp - 0x14], 0xc5b7edfb
add dword [ebp - 0x14], 0x7bb4737a
mov dword [ebp - 0x10], 0x4b7ac74c
add dword [ebp - 0x10], 0x17f4a520
mov dword [ebp - 0xc], 0x3ad337cb
sub dword [ebp - 0xc], 0x3ad337cb
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x904da8e3
sub eax, 0x900cd897
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37923
push 0
call eax
mov ecx, 0x746bbef3
sub ecx, 0x746b7ebe
mov ebx, eax
mov edi, 0x288a3527
add edi, 0xd7b77ad9
add edi, dword [ebp - 8]
mov edx, 0x1d01081d
add dword [ebp - 4], 0xce39fc20
mov esi, dword [edi]
add dword [ebp - 4], 0x295f412
xor esi, edx
sub dword [ebp - 4], 0x85e12c42
mov dword [ebx], esi
add ebx, 0x6aafc0f8
sub ebx, 0x6aafc0f4
add edi, 4
loop 0x405738
add eax, 0x4b1b44fc
add eax, 0xb4e5aeab
mov ebx, eax
add eax, 0x8fd1e0ad
sub eax, 0x8fd1e0a8
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1061c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1061c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1061c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1061c06a
add dl, dl
jne 0x1061c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1061c0dc
xor eax, eax
add dl, dl
jne 0x1061c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1061c17d
add dl, dl
jne 0x1061c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1061c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1061c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1061c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1061c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1061c075
mov eax, 1
add dl, dl
jne 0x1061c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1061c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1061c0e1
sub eax, ebx
mov ebx, 1
jne 0x1061c128
mov ecx, 1
add dl, dl
jne 0x1061c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1061c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1061c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1061c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1061c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1061c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1061c136
cmp eax, 0x7d00
jae 0x1061c16d
cmp eax, 0x500
jb 0x1061c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1061c075
cmp eax, 0x7f
ja 0x1061c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1061c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1061c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1061c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4140e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47f99b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004741d4
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x414162
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00471b2d
mov eax, dword [eax]
push 0x4ba1e0
push eax
call fcn.00463e14
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047445f
test bl, bl
je 0x414162
push 0x4ba1e0
lea ecx, [esp + 0xc]
call fcn.004747ef
push 0x4bdd5c
lea ecx, [esp + 0xc]
call fcn.004747ef
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41419e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047445f
jmp 0x414269
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x414222
lea edx, [esp + 0x7c]
push 0x4bdd58
push edx
call fcn.00463e14
add esp, 8
test eax, eax
je 0x414222
lea eax, [esp + 0x7c]
push 0x4bdd54
push eax
call fcn.00463e14
add esp, 8
test eax, eax
je 0x414222
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4141b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047445f
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x414a60
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x414ac2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc