joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90054d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x90054e4
pop dword [ebp - 0x2c]
mov eax, 0x9f896669
sub eax, 0x96891185
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x966cd5f4
sub dword [ebp - 0x3c], 0x481a90a9
mov dword [ebp - 0x38], 0x548ed987
add dword [ebp - 0x38], 0xdda472be
mov dword [ebp - 0x34], 0x8309ce0
sub dword [ebp - 0x34], 0xbbe458b2
mov dword [ebp - 0x30], 0x7633d125
sub dword [ebp - 0x30], 0x7633d125
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x19d59eb0
sub eax, 0x10c83dec
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x6ac93ee0
add dword [ebp - 0x3c], 0x9a92a76
mov dword [ebp - 0x38], 0xd615236b
sub dword [ebp - 0x38], 0x94a8c1f6
mov dword [ebp - 0x34], 0x87bb632f
sub dword [ebp - 0x34], 0x244bf6c3
mov dword [ebp - 0x30], 0xcc2c1642
sub dword [ebp - 0x30], 0xcc2c1642
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x360dc591
add eax, 0xd2ff9b2f
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x75df5
push 0
call eax
mov ecx, 0x683612fd
add ecx, 0x97ca2c95
xor esi, esi
add esi, eax
mov edi, 0x9125c00
add edi, dword [ebp - 0x2c]
mov edx, 0x64deda3b
sub edx, 0x80464be4
add dword [ebp - 0x14], eax
mov ebx, dword [edi]
xor dword [ebp - 0x1c], 0xecb0372
xor ebx, edx
mov dword [esi], ebx
add dword [ebp - 0x10], edi
add esi, 4
add edi, 4
loop 0x9005602
add eax, 0xf11b
mov ebx, eax
add eax, 0xf8f074c5
add eax, 0x70f8b40
mov ecx, 0x9000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x405b32
pop dword [ebp - 0x44]
mov eax, 0xf5643435
add eax, 0xadc26fd
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xb1bcbc49
add dword [ebp - 0x54], 0x9c958902
mov dword [ebp - 0x50], 0xef8a0a3a
sub dword [ebp - 0x50], 0xbd56bdf5
mov dword [ebp - 0x4c], 0xc1e6c5dd
sub dword [ebp - 0x4c], 0x759a81af
mov dword [ebp - 0x48], 0xcd1d89c7
sub dword [ebp - 0x48], 0xcd1d89c7
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xca9beb55
sub dword [ebp - 0x54], 0x562981ff
mov dword [ebp - 0x50], 0xce83a27
add dword [ebp - 0x50], 0x3484274e
mov dword [ebp - 0x4c], 0xe031fb48
add dword [ebp - 0x4c], 0x833d7124
mov dword [ebp - 0x48], 0xa9af9c51
add dword [ebp - 0x48], 0x565063af
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39788
push 0
call eax
mov ecx, 0x6c417395
add ecx, 0x93bede43
xor esi, esi
add esi, eax
mov edi, 0x451400
add edi, dword [ebp - 0x44]
mov edx, 0x1c78b72a
sub edx, 0xbc661963
xor dword [ebp - 0x40], ecx
mov ebx, dword [edi]
sub dword [ebp - 0x30], 0x3d6b7a40
add ebx, edx
sub dword [ebp - 0x28], esi
mov dword [esi], ebx
add dword [ebp - 0x28], ebx
add esi, 0x870818ef
sub esi, 0x870818eb
add edi, 0x844b2034
add edi, 0x7bb4dfd0
loop 0x405c46
add eax, 0x643afa00
add eax, 0x9bc64033
mov ebx, eax
add eax, 5
mov ecx, 0x6071a289
sub ecx, 0x6031a289
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10007c2e
pop dword [ebp - 0x30]
mov eax, 0xc1ff1746
add eax, 0x4e0164e8
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xb7c25135
add dword [ebp - 0x40], 0x968ff416
mov dword [ebp - 0x3c], 0xc5b41980
add dword [ebp - 0x3c], 0x6c7f32c5
mov dword [ebp - 0x38], 0x87199bec
sub dword [ebp - 0x38], 0x3acd57be
mov dword [ebp - 0x34], 0xd2809cec
sub dword [ebp - 0x34], 0xd2809cec
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xc14ca4de
sub dword [ebp - 0x40], 0x4cda3b88
mov dword [ebp - 0x3c], 0xc320bb02
sub dword [ebp - 0x3c], 0x81b4598d
mov dword [ebp - 0x38], 0x2de28513
sub dword [ebp - 0x38], 0xca7318a7
mov dword [ebp - 0x34], 0x57774055
sub dword [ebp - 0x34], 0x57774055
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x39a12
push 0
call eax
mov ecx, 0x53d9
mov edx, eax
mov ebx, 0x3259dcf6
add ebx, 0xdda71d0a
add ebx, dword [ebp - 0x30]
mov esi, 0xeb2199e1
xor dword [ebp - 0x24], eax
mov edi, dword [ebx]
add dword [ebp - 0x2c], edx
add edi, esi
sub dword [ebp - 0x24], edx
mov dword [edx], edi
xor dword [ebp - 0x1c], eax
add edx, 4
add ebx, 0x1f85a5bd
sub ebx, 0x1f85a5b9
loop 0x10007d3a
add eax, 0x14237
mov ebx, eax
add eax, 0xf5e4669
sub eax, 0xf5e4664
mov ecx, 0x2bb06e6
add ecx, 0xd44f91a
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10005879
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10005888
pop dword [ebp - 0x2c]
mov eax, 0x3824d38e
sub eax, 0x28247b06
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xdbcbd803
sub dword [ebp - 0x3c], 0x8d7992b8
mov dword [ebp - 0x38], 0x985313e6
add dword [ebp - 0x38], 0x99e0385f
mov dword [ebp - 0x34], 0x37dea9b4
add dword [ebp - 0x34], 0x146d9a7a
mov dword [ebp - 0x30], 0x973844da
add dword [ebp - 0x30], 0x68c7bb26
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x8c41bf86
add eax, 0x83c19192
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x9a5e6b7f
sub dword [ebp - 0x3c], 0x25ec0229
mov dword [ebp - 0x38], 0xb5bd06ba
sub dword [ebp - 0x38], 0x7450a545
mov dword [ebp - 0x34], 0x9a16ba02
add dword [ebp - 0x34], 0xc958b26a
mov dword [ebp - 0x30], 0x8bb5f723
sub dword [ebp - 0x30], 0x8bb5f723
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a349
push 0
call eax
mov ecx, 0x448c
xor edx, edx
add edx, eax
mov ebx, 0x10088400
add ebx, dword [ebp - 0x2c]
mov esi, 0x85091bdd
sub esi, 0x6cd04c66
sub dword [ebp - 0x1c], 0xf81c7354
mov edi, dword [ebx]
sub dword [ebp - 0x24], edi
sub edi, esi
xor dword [ebp - 0xc], edx
mov dword [edx], edi
xor dword [ebp - 8], edx
add edx, 4
add ebx, 0x9b2a8229
add ebx, 0x64d57ddb
loop 0x1000599b
add eax, 0x10503
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x10005a23
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x4c09b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4c09dd
test al, 0x10
jne 0x4c09d4
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4c09dd
mov eax, 1
pop esi
ret 4
push esi
push 0x4bf
call fcn.004750b0
push eax
mov eax, dword [0x51f844]
push eax
call fcn.004ace90
add esp, 0xc
xor eax, eax
pop esi
ret 4

Function at 0x4c0c62
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4eb984]
jne 0x4c0c6c
repz ret
jmp fcn.004c5d43

Function at 0x4cf17f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004c6c76
and dword [ebp - 4], 0
cmp dword [0x58a2e4], 0
mov ebx, eax
jne 0x4cf230
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4cf2e1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4cf2e1
push eax
call fcn.004c6c04
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x58a2e4], eax
call esi
push eax
call fcn.004c6c04
mov dword [esp], 0x4e152c
push edi
mov dword [0x58a2e8], eax
call esi
push eax
call fcn.004c6c04
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x58a2ec], eax
call esi
push eax
call fcn.004c6c04
pop ecx
mov dword [0x58a2f4], eax
test eax, eax
je 0x4cf230
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004c6c04
pop ecx
mov dword [0x58a2f0], eax
mov eax, dword [0x58a2f0]
cmp eax, ebx
je 0x4cf288
cmp dword [0x58a2f4], ebx
je 0x4cf288
push eax
call fcn.004c6c7f
push dword [0x58a2f4]
mov esi, eax
call fcn.004c6c7f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4cf288
test edi, edi
je 0x4cf288
call esi
test eax, eax
je 0x4cf27f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4cf27f
test byte [ebp - 0xc], 1
jne 0x4cf288
or dword [ebp + 0x10], 0x200000
jmp 0x4cf2c1
mov eax, dword [0x58a2e8]
cmp eax, ebx
je 0x4cf2c1
push eax
call fcn.004c6c7f
pop ecx
test eax, eax
je 0x4cf2c1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4cf2c1
mov eax, dword [0x58a2ec]
cmp eax, ebx
je 0x4cf2c1
push eax
call fcn.004c6c7f
pop ecx
test eax, eax
je 0x4cf2c1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x58a2e4]
call fcn.004c6c7f
pop ecx
test eax, eax
je 0x4cf2e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4cf2e3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10001060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call fcn.1000106f
Function at 0x100293f
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x10029b1
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x10029b0
push edi
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10029a9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1001208
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10029a9
cmp dword [ebp - 8], ebx
je 0x10029a9
mov ecx, dword [ebp - 0xc]
mov eax, 0x6ffff
cmp eax, dword [ecx + 8]
sbb bl, bl
inc bl
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4

Function at 0x13875e4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13875ee
pushal
call 0x13875f4
pop ebp
sub ebp, 0x10
sub ebp, 0xf875e4
jmp 0x138760a
mov eax, 0xf875e4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b6
mov edx, 0xb6f3f8d1
xor byte [eax], dl
inc eax
dec ecx
jne 0x1387621
jmp 0x1387634
pop edx
sbb al, 0x5a
pop eax
in eax, dx
rcl ecx, 1
rcl dword [eax + 0x10]
sub ecx, edx
rcl ecx, 1
rcr byte [ecx + ebp*2], cl
aad 0xd1
rcl ecx, 1
imul edi, ecx, 0xffffffd1
rcl ecx, 1
xor edx, edx
shl dword [esi], 1
xor edx, edx
sbb dword [edx + 0x50], ebx
fst st(1)
rcl ecx, 1
rcl byte [ecx + eax*4], cl
pop esp
mov ch, 0xf5
sub eax, 0xb9f5d558
test esp, eax
sar dword [ecx - 0x2ef84ea1], 1
sar ch, 1
cmc
mov ecx, 0x1d1a0b50
cmp esp, edx
rcl ecx, 1
sar dword [eax], 1
loope 0x138764d
rcl ecx, 1
pop esp
mov ch, 0xf5
sub eax, 0x5cf5fd58
mov ebp, 0x545ad1f5
invalid
Function at 0x48558d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048540a

Function at 0x48854b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004881ed

Function at 0x417a09
Capabilities:
Encode data using xor

Disassembly:
fnstcw word [esi + 0x1a]
and byte [ebp - 0x5bcbe860], dh
mov ch, 0xa0
pop ss
xor al, 0xa4
jne 0x417a0c
sbb ch, ah
in al, dx
jge 0x4179f0
loopne 0x4179f1
in al, 0xf5
cmc
inc edi
jne 0x417995

Function at 0x4bac9d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43a8
cmp edx, dword [eax]
je 0x4bacbf
add eax, 8
inc ecx
cmp eax, 0x4c4438
jl 0x4bacb0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43a8]
jne 0x4baded
mov eax, dword [0x4c8d2c]
cmp eax, 1
je 0x4badc7
test eax, eax
jne 0x4bacf0
cmp dword [0x4c42d0], 1
je 0x4badc7
cmp edx, 0xfc
je 0x4baded
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bad27
lea eax, [ebp - 0x1a4]
push 0x4bfd10
push eax
call fcn.004bb680
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbb10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bad6a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbb10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfd0c
push edi
call fcn.004bd9e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfcf0
push eax
call fcn.004bb680
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb690
lea eax, [ebp - 0xa0]
push 0x4bfcec
push eax
call fcn.004bb690
push dword [esi + 0x4c43ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb690
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfcc4
push eax
call fcn.004bd954
add esp, 0x2c
pop edi
jmp 0x4baded
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43ac]
push 0
push eax
push dword [esi]
call fcn.004bbb10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x405e97
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43e74c], 0
jne 0x405ed5
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405eab
mov dword [ecx*4 + 0x43e748], eax
inc ecx
cmp ecx, 0x100
jl 0x405ea6
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x405f02
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x43e748]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x405ee3
not eax
pop ebp
ret 0xc

Function at 0x1000f4b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000f4c7
pop dword [ebp - 0x4c]
mov eax, 0x1000f4c7
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x395d0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xc542e52c
add ecx, 0x3abd6c0e
xor esi, esi
add esi, eax
mov edi, 0xb172380e
add edi, 0x5e8f5ff2
add edi, dword [ebp - 0x4c]
mov edx, 0xb6f745fc
add edx, 0xed855dbb
xor dword [ebp - 0x1c], ecx
mov ebx, dword [edi]
add dword [ebp - 0x20], 0x67f3b785
xor ebx, edx
xor dword [ebp - 0x18], 0x67cf46ad
mov dword [esi], ebx
add dword [ebp - 0x24], esi
add esi, 0xd587c97
add esi, 0xf2a7836d
add edi, 4
loop 0x1000f51e
add eax, 0xb21c67d3
add eax, 0x4de4cfe8
mov ebx, eax
add eax, 0xf2b122e1
add eax, 0xd4edd24
mov ecx, 0xa1053d9
add ecx, 0x5efac27
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x163e6a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x86b015
lea edi, [esi - 0x46a015]
lea eax, [edi + 0x11d0fd0]
push dword [eax]
mov dword [eax], 0x7bff5afa
push eax
push edi
or ebp, 0xffffffff
jmp 0x163e6d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x163e6d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x163e6c8
mov eax, 1
add ebx, ebx
jne 0x163e6eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x163e6fc
jne 0x163e71b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x163e71b
dec eax
add ebx, ebx
jne 0x163e708
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x163e6e0
add ebx, ebx
jne 0x163e717
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x163e76d
xor ecx, ecx
sub eax, 3
jb 0x163e733
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x163e7a2
sar eax, 1
mov ebp, eax
jmp 0x163e73e
add ebx, ebx
jne 0x163e73e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x163e70c
inc ecx
add ebx, ebx
jne 0x163e74c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x163e70c
add ebx, ebx
jne 0x163e759
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x163e74e
jne 0x163e76a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x163e74e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x163e78c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x163e77e
jmp 0x163e6ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x163e78c
add edi, ecx
jmp 0x163e6ce
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xebd4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x163e7ae
cmp byte [edi], 0x7c
jne 0x163e7ae
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x163e7b3
lea edi, [esi + 0x122c000]
mov eax, dword [edi]
or eax, eax
je 0x163e822
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x125e73c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x125e854]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x163e7e0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x125e85c]
or eax, eax
je 0x163e81c
mov dword [ebx], eax
add ebx, 4
jmp 0x163e7fd
call dword [esi + 0x125e858]
mov ebp, dword [esi + 0x125e860]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x123e87d]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x163e86e
sub esp, 0xffffff80
jmp 0x401480
Function at 0xc9d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c9d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc9d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc9d06a
add dl, dl
jne 0xc9d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc9d0dc
xor eax, eax
add dl, dl
jne 0xc9d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc9d17d
add dl, dl
jne 0xc9d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc9d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc9d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc9d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc9d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc9d075
mov eax, 1
add dl, dl
jne 0xc9d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc9d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc9d0e1
sub eax, ebx
mov ebx, 1
jne 0xc9d128
mov ecx, 1
add dl, dl
jne 0xc9d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc9d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc9d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc9d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc9d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc9d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc9d136
cmp eax, 0x7d00
jae 0xc9d16d
cmp eax, 0x500
jb 0xc9d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc9d075
cmp eax, 0x7f
ja 0xc9d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc9d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc9d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc9d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4021f3
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0xf0000000
push 0x18
push 0x414255
push 0x414255
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402272
push 0
push 0x18
push 0x414255
push 0x414255
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402272
mov eax, 0x41429c
jmp 0x4022cc
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004022e4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402297
push ebx
call fcn.00407182
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
nop
mov eax, dword [ebp - 8]
test eax, eax
je 0x4022c7
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00407188
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4022cc
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4022dd
push ebx
call fcn.00407182
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8