joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56d944
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x22c
mov eax, 0x59efd2
call fcn.005693c7
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push eax
push 0xf003f
xor ebx, ebx
mov dword [ebp - 0x238], 0x208
push ebx
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x234], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x56d992
xor eax, eax
jmp 0x56da40
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0056da48
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.0056f390
add esp, 0xc
lea ecx, [ebp - 0x238]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x234]
test eax, eax
je 0x56d9fd
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
jmp 0x56da30
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x218], 0
jne 0x56da11
mov eax, ebx
jmp 0x56da1e
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00403772
xor esi, esi
inc esi
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.00403628
mov eax, esi
call fcn.00569382
ret 4

Function at 0x56dab3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0xf003f
xor esi, esi
mov ebx, 0x208
push esi
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x56db04
xor eax, eax
jmp 0x56db78
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push str.SystemDefaultEUDCFont
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x56db48
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x56db00
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x20c], si
je 0x56db66
lea eax, [ebp - 0x20c]
push eax
call fcn.00578706
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00403772
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4
Function at 0x56dcb2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
xor edi, edi
push eax
push 0xf003f
push edi
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x56dd5d
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0056f390
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00578f87
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push str.SystemDefaultEUDCFont
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x56dd7e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, edi
push edi
push 1
lea ecx, [ebp + 8]
call fcn.00403628
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0056935c
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
inc esi
jmp 0x56dd5f

Function at 0x56de6d
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x59f0af
call fcn.005693c7
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
push edi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], ebx
call fcn.0056e119
mov esi, dword [ebp - 0x4c]
jmp 0x56df1d
push esi
lea ecx, [ebp - 0x40]
call fcn.00402a71
push str.Dict
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004117f1
add esp, 0xc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56df01
push 0x611980
call fcn.00578706
pop ecx
push eax
push ebx
push 0x611980
lea ecx, [ebp - 0x28]
call fcn.00403968
cmp eax, 0xffffffff
jne 0x56df01
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.0041271e
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00403628
add esi, 0x18
cmp esi, dword [ebp - 0x48]
jne 0x56de9b
lea ecx, [ebp - 0x4c]
call fcn.0040c264
call fcn.00569382
ret 4
Function at 0x56df36
Capabilities:
Enumerate files on windows

Disassembly:
push 0x67c
mov eax, 0x59f0df
call fcn.005693c7
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x420]
mov ebx, dword [ebp + 0xc]
push 0x208
push 0
push eax
call fcn.0056f390
push edi
lea eax, [ebp - 0x420]
push 0x5a35bc
push eax
call fcn.00408d5e
add esp, 0x18
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x56e076
lea eax, [ebp - 0x688]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x56e076
push 0x2e
pop eax
cmp word [ebp - 0x65c], ax
je 0x56df92
cmp word [ebp - 0x65a], 0
je 0x56df92
cmp word [ebp - 0x65a], ax
jne 0x56dfd1
cmp word [ebp - 0x658], 0
je 0x56df92
test byte [ebp - 0x688], 0x10
je 0x56df92
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056f390
lea eax, [ebp - 0x65c]
push eax
push edi
lea eax, [ebp - 0x218]
push 0x5a0b04
push eax
call fcn.00408d5e
and dword [ebp - 0x428], 0
xor eax, eax
add esp, 0x1c
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
cmp word [ebp - 0x218], ax
je 0x56e039
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00403772
and dword [ebp - 4], 0
lea eax, [ebp - 0x438]
push eax
mov ecx, ebx
call fcn.004115d9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
push 0
push 1
call fcn.00403628
jmp 0x56df92
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00569382
ret 8

Function at 0x56e085
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov dword [ebp - 8], 7
mov esi, 0x611eec
mov word [ebp - 0x1c], ax
xor edi, edi
push esi
mov dword [ebp - 0xc], edi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.00403772
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push edi
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x56e0fb
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
call fcn.00403628
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x56e14d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x418]
mov ebx, str.WnWBImeDictFile
push eax
push ebx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x56e2a0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push eax
push ebx
push 1
push 0x5a06d8
push dword [ebp - 0x418]
call edi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0056f390
add esp, 0xc
mov ebx, str.WnDictInst.exe
push ebx
call fcn.0056b1cb
mov ecx, eax
call fcn.0056cf59
push eax
lea eax, [ebp - 0x414]
push 0x5a0ac0
push eax
call fcn.00408d5e
add esp, 0x10
lea eax, [ebp - 0x414]
push 0x104
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x418]
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056f390
add esp, 0xc
push ebx
call fcn.0056b1cb
mov ecx, eax
call fcn.0056cf59
push eax
lea eax, [ebp - 0x20c]
push str.__s_s___install
push eax
call fcn.00408d5e
lea eax, [ebp - 0x20c]
push 0x611f94
push eax
call fcn.00578f16
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x41c]
push eax
push str..wncl
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x56e29f
push 0x104
push str.WnWBImeDictFile
push 1
push 0x5a06d8
push dword [ebp - 0x41c]
call edi
push dword [ebp - 0x41c]
call ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret

Function at 0x56e2af
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
call fcn.0056e2bf
mov ecx, esi
pop esi
jmp fcn.0056e14d
Function at 0x56e2bf
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 0x41c]
push eax
mov ebx, str.WnWBImeSkinFile
push ebx
push connect
call esi
test eax, eax
jne 0x56e449
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push eax
push ebx
push 1
push 0x5a06d8
push dword [ebp - 0x41c]
call edi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0056f390
add esp, 0xc
mov ebx, str.WnSkinInst.exe
push ebx
call fcn.0056b1cb
mov ecx, eax
call fcn.0056cf59
push eax
lea eax, [ebp - 0x414]
push 0x5a0ac0
push eax
call fcn.00408d5e
add esp, 0x10
lea eax, [ebp - 0x414]
push 0x104
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x41c]
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056f390
add esp, 0xc
push ebx
call fcn.0056b1cb
mov ecx, eax
call fcn.0056cf59
push eax
lea eax, [ebp - 0x20c]
push str.__s_s___install
push eax
call fcn.00408d5e
lea eax, [ebp - 0x20c]
push 0x611f94
push eax
call fcn.00578f16
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x41c]
call edi
push dword [ebp - 0x41c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x418]
push eax
push str..wnpf
push connect
call esi
test eax, eax
jne 0x56e448
push 0x104
push str.WnWBImeSkinFile
push 1
push 0x5a06d8
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call ebx
lea eax, [ebp - 0x418]
push eax
push str..swnpf
push connect
call esi
test eax, eax
jne 0x56e448
push 0x104
push str.WnWBImeSkinFile
push 1
push 0x5a06d8
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret

Function at 0x56e4a5
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
call fcn.0056e4b5
mov ecx, esi
pop esi
jmp fcn.0056e459

Function at 0x56e4b5
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x5a06d8
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x56e507
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.WnWBImeSkinFile
push dword [ebp - 4]
call esi
push str..wnpf
push dword [ebp - 4]
call esi
push str..swnpf
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x56e772
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x23c
mov eax, 0x59f11d
call fcn.005693c7
mov esi, ecx
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x10
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x56e68f
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x56e57b
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403772
mov edi, 0x5a0a50
mov dword [ebp - 4], ebx
push edi
call fcn.00578706
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.00408c34
mov edi, 0x5a49e8
push edi
call fcn.00578706
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.00408c34
mov edi, str..lnk
push edi
call fcn.00578706
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.00408c34
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56e681
call fcn.0056b1cb
mov ecx, eax
call fcn.0056cf59
push eax
lea ecx, [ebp - 0x248]
call fcn.00402ac4
mov edi, str.wnwb.exe
mov byte [ebp - 4], 1
push edi
call fcn.00578706
pop ecx
push eax
push edi
lea ecx, [ebp - 0x248]
call fcn.00408c34
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x248]
push ebx
cmovae ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
push ebx
cmovae eax, dword [ebp - 0x230]
push 0x657
push 1
push 0x612010
push ecx
push eax
mov ecx, esi
call fcn.0056e695
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.00403628
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.00403628
call fcn.00569382
ret
jmp 0x56e50b
Function at 0x56e8bc
Capabilities:
Set registry value

Disassembly:
push 0x244
mov eax, 0x59f150
call fcn.005693c7
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 0x228], esi
call fcn.0056f390
push esi
lea eax, [ebp - 0x218]
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy_s
push eax
call fcn.00408d5e
add esp, 0x18
mov dword [ebp - 0x220], edi
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x22c], 3
call fcn.00403ac6
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], edi
call fcn.00403b8c
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x56ea1e
lea eax, [ebp - 0x220]
push eax
push 0xf013f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x56eadf
xor ecx, ecx
lea eax, [ebp - 0x21c]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push dword [ebp - 0x228]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x56e9a8
push dword [ebp - 0x220]
call esi
jmp 0x56eadf
push ebx
call fcn.00578706
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push str.AppName
push dword [ebp - 0x21c]
call edi
push dword [ebp - 0x224]
call fcn.00578706
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x224]
push 1
push 0
push str.AppPath
push dword [ebp - 0x21c]
call edi
push 4
lea eax, [ebp - 0x22c]
push eax
push 4
push 0
push str.Policy
push dword [ebp - 0x21c]
call edi
push dword [ebp - 0x21c]
call esi
push dword [ebp - 0x220]
call esi
lea eax, [ebp - 0x220]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x56eadf
xor ecx, ecx
lea eax, [ebp - 0x21c]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push dword [ebp - 0x228]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x56ead7
push ebx
call fcn.00578706
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push str.AppName
push dword [ebp - 0x21c]
call edi
mov ebx, dword [ebp - 0x224]
push ebx
call fcn.00578706
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push str.AppPath
push dword [ebp - 0x21c]
call edi
push 4
lea eax, [ebp - 0x22c]
push eax
push 4
push 0
push str.Policy
push dword [ebp - 0x21c]
call edi
push dword [ebp - 0x21c]
call esi
push dword [ebp - 0x220]
call esi
lea ecx, [ebp - 0x250]
call fcn.00403ad9
call fcn.00569382
ret 0xc
Function at 0x58f1d3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058f052

Function at 0x593db4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00593a74

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x696c3ed8
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x6e317f37
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1004f9d0
Capabilities:
Encode data using xor

Disassembly:
push cs
cwde
stosb byte es:[edi], al
push 0x350341fc
add al, 0x38
loop 0x1004f9ce
imul edi, dword [ecx], 0x38e0636f
adc eax, ebx
popfd
mov dword [0xd24f94b5], eax
mov ebx, 0xf143017f
pop ebx
out 0x46, al
lds eax, [esi - 0x71]
inc ecx
dec esi
cmp eax, 0x6122b2f0
test eax, ebx
dec ecx
push edi
or dword [ebx - 0x61], esi
xor eax, 0x557281cc
push ds
loope 0x1004f9fb
jns 0x1004fa19
test al, 0x9a
push edx
adc eax, 0x7125f56d
test al, 0xb0
int 0x55
inc esp
xchg esi, eax
adc dl, ah
mov bl, 0x28
adc al, byte [edi + 0x63]
dec edx
and dword [eax + 0x5c0fffb2], esp
add dword [esp + eax], ebx
dec edi
sbb al, 0xdd
leave
imul edi, ebx, 0x7ba8bce9
invalid

Function at 0x10050150
Capabilities:
Encode data using xor

Disassembly:
pop ebx
sbb ebp, dword [edi - 0x2f]
inc ecx
xor dword [edi - 0x26], edi
dec ecx
jge 0x10050145
sbb bh, byte [edi - 0x2333ff25]

Function at 0x10050aa0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xaaa67cf2
jl 0x10050a6b
inc esp
jge 0x10050a38
scasb al, byte es:[edi]
mov byte [0x1f5c0efc], al
mov ebp, 0x38f8cb94
mov esi, 0xb74f82dd
cmc
jnp 0x10050acf
jmp 0x10050aee
cmc
cld
fstp dword [ebp + 0x35]
arpl word [edi + 0x5f96029], si
rcr dword [ecx], cl
int3
inc ebp
dec edi
fdiv dword [eax - 0x555ffb26]
inc ecx
punpckhdq mm7, qword [ebx]
test dword [esi - 0x1c], edx
invalid
Function at 0x105d4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105d41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105d407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105d406a
add dl, dl
jne 0x105d4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105d40dc
xor eax, eax
add dl, dl
jne 0x105d4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105d417d
add dl, dl
jne 0x105d40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105d40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105d40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105d40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105d40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105d4075
mov eax, 1
add dl, dl
jne 0x105d40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105d40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105d40e1
sub eax, ebx
mov ebx, 1
jne 0x105d4128
mov ecx, 1
add dl, dl
jne 0x105d410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105d4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105d4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105d4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105d413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105d414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105d4136
cmp eax, 0x7d00
jae 0x105d416d
cmp eax, 0x500
jb 0x105d4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105d4075
cmp eax, 0x7f
ja 0x105d4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105d4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105d419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105d4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40182a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401869
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401869
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401869
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401869
cmp dword [ecx + 0x74], 0xe
jbe 0x401869
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret