joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4193a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
sub esp, 0x14
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
je 0x4193bf
mov ecx, dword [eax]
jmp 0x4193c1
xor ecx, ecx
cmp ecx, esi
mov dword [ebp - 4], ecx
jne 0x4193cb
mov dword [ebp + 0x14], esi
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
xor ebx, ebx
inc ebx
cmp eax, esi
je 0x4193df
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4193e2
mov dword [ebp - 8], ebx
xor eax, eax
cmp dword [ebp - 8], ebx
sete al
cmp dword [ebp + 0x1c], esi
mov dword [ebp - 0x14], eax
je 0x419458
cmp dword [ebp + 0x14], esi
je 0x419458
cmp eax, esi
mov dword [ebp - 0x10], ebx
je 0x41940c
lea eax, [ecx + ecx + 2]
mov dword [ebp - 4], eax
call fcn.0042b470
mov edi, esp
lea eax, [ebp - 0xc]
push eax
push 0x20019
push esi
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x4194e6
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41945d
mov eax, esi
jmp 0x4194e6
mov dword [ebp - 0x10], esi
jmp 0x41940c
cmp dword [ebp - 0x10], 0
je 0x4194cc
push dword [ebp - 4]
push edi
call fcn.004191f8
cmp dword [ebp - 0x14], 0
pop ecx
pop ecx
je 0x4194cc
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [ebp - 4]
mov esi, eax
inc esi
cmp esi, ebx
jae 0x4194ad
push ebx
push edi
call fcn.004191f8
sub dword [ebp - 4], esi
push dword [ebp - 4]
lea eax, [esi + edi]
push eax
push dword [ebp + 0x1c]
call fcn.00419270
mov ebx, dword [ebp - 4]
add esp, 0x14
dec ebx
mov dword [ebp - 4], ebx
jmp 0x4194af
xor esi, esi
push ebx
add esi, edi
push esi
mov esi, dword [ebp + 0x14]
push esi
call fcn.004253a0
mov eax, dword [ebp + 0x18]
add esp, 0xc
cmp ebx, dword [eax]
jae 0x4194cf
mov byte [ebx + esi], 0
jmp 0x4194cf
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4194d8
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4194e4
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41ad1c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x41ad63
cmp edx, 0x10
jl 0x41ad4f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x41ad3c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x41ad63
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x41ad5b
and edx, 3
cmp edx, 3
jne 0x41ad77
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x41ad7c
cmp edx, 2
jne 0x41ad88
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x41ad8d
cmp edx, 1
jne 0x41ad93
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x420ecb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x420f08
cmp dword [ebp + 0x14], edi
je 0x420f08
cmp ecx, edi
jne 0x420f0f
call fcn.0042308e
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0042198c
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x420f23
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x420f44
cmp ebx, 0xffffffff
je 0x420f33
push ebx
push edi
push ecx
call fcn.00425710
add esp, 0xc
cmp esi, edi
je 0x420ef0
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x420ef0
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x420f60
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x420f67
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x421058
test word [esi + 0xc], 0x10c
je 0x420fbb
mov eax, dword [esi + 4]
test eax, eax
je 0x420fbb
jl 0x4210b9
cmp ebx, eax
mov edi, ebx
jb 0x420f8c
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x421060
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0042180b
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x421050
cmp ebx, dword [ebp - 0xc]
jb 0x421028
cmp dword [ebp - 0xc], 0
je 0x420fe5
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x420fda
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x420fe1
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x420ff0
mov eax, SysReAllocString
cmp ebx, eax
ja 0x420ff0
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x42108c
push eax
push dword [ebp - 8]
push esi
call fcn.004266c9
pop ecx
push eax
call fcn.004265cc
add esp, 0xc
test eax, eax
je 0x4210cb
cmp eax, 0xffffffff
je 0x4210b9
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x421050
push esi
call fcn.00425eeb
cmp eax, 0xffffffff
pop ecx
je 0x4210bd
cmp dword [ebp - 4], 0
je 0x42108c
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x420f6f
mov eax, dword [ebp + 0x14]
jmp 0x420f0a
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x421077
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00425710
add esp, 0xc
call fcn.0042308e
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x420f00
cmp dword [ebp + 0xc], 0xffffffff
je 0x4210a2
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00425710
add esp, 0xc
call fcn.0042308e
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x420f00
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x420f0a
or dword [esi + 0xc], 0x10
jmp 0x4210bd
Function at 0x42224c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435d20]
jne 0x422256
repz ret
jmp fcn.0042858c

Function at 0x422cd3
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x435308]
je 0x422cee
inc edi
cmp edi, 0x17
jb 0x422cdf
cmp edi, 0x17
jae 0x422e6e
push ebp
push 3
call fcn.00428934
cmp eax, 1
pop ecx
je 0x422e3a
push 3
call fcn.00428934
test eax, eax
pop ecx
jne 0x422d22
cmp dword [0x4352f0], 1
je 0x422e3a
cmp ebx, 0xfc
je 0x422e6d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x43e6a8
push ebp
call fcn.004271a5
add esp, 0xc
test eax, eax
je 0x422d58
push esi
push esi
push esi
push esi
push esi
call fcn.00421890
add esp, 0x14
push 0x104
mov esi, 0x43e6c1
push esi
push 0
mov byte [0x43e7c5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x422d9c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004271a5
add esp, 0xc
test eax, eax
je 0x422d9c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00421890
add esp, 0x14
push esi
call fcn.00421db0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x422de1
push esi
call fcn.00421db0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x43e9bc
push 0x42de44
sub ecx, eax
push ecx
push eax
call fcn.00428881
add esp, 0x14
test eax, eax
je 0x422de1
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00421890
add esp, 0x14
jmp 0x422de3
xor esi, esi
push 0x42de40
push ebx
push ebp
call fcn.004203a2
add esp, 0xc
test eax, eax
je 0x422e03
push esi
push esi
push esi
push esi
push esi
call fcn.00421890
add esp, 0x14
push dword [edi*8 + 0x43530c]
push ebx
push ebp
call fcn.004203a2
add esp, 0xc
test eax, eax
je 0x422e25
push esi
push esi
push esi
push esi
push esi
call fcn.00421890
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004286c4
add esp, 0xc
jmp 0x422e6d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x422e6d
cmp ebp, 0xffffffff
je 0x422e6d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x43530c]
push dword [esi]
call fcn.00421db0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4286c4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00422754
xor ebx, ebx
cmp dword [0x43efcc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x42879a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42887a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42dfdc
push edi
call esi
cmp eax, ebx
je 0x42887a
push eax
call fcn.004226e6
mov dword [esp], 0x42dfcc
push edi
mov dword [0x43efcc], eax
call esi
push eax
call fcn.004226e6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43efd0], eax
call esi
push eax
call fcn.004226e6
mov dword [0x43efd4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041fcb4
test eax, eax
pop ecx
pop ecx
je 0x428768
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00421890
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x42879a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004226e6
cmp eax, ebx
pop ecx
mov dword [0x43efdc], eax
je 0x42879a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004226e6
pop ecx
mov dword [0x43efd8], eax
mov eax, dword [0x43efd8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x42881f
cmp dword [0x43efdc], ecx
je 0x42881f
push eax
call fcn.0042275d
push dword [0x43efdc]
mov esi, eax
call fcn.0042275d
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x42881f
cmp edi, ebx
je 0x42881f
call esi
cmp eax, ebx
je 0x4287ec
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4287ec
test byte [ebp - 0x18], 1
jne 0x42881f
lea eax, [ebp - 0x10]
push eax
call fcn.0041fceb
test eax, eax
pop ecx
je 0x428807
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00421890
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x428816
or dword [ebp + 0x10], 0x200000
jmp 0x42885a
or dword [ebp + 0x10], 0x40000
jmp 0x42885a
mov eax, dword [0x43efd0]
cmp eax, dword [ebp - 8]
je 0x42885a
push eax
call fcn.0042275d
cmp eax, ebx
pop ecx
je 0x42885a
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42885a
mov eax, dword [0x43efd4]
cmp eax, dword [ebp - 8]
je 0x42885a
push eax
call fcn.0042275d
cmp eax, ebx
pop ecx
je 0x42885a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43efcc]
call fcn.0042275d
cmp eax, ebx
pop ecx
je 0x42887a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42887c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40453e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0x20019
xor edi, edi
xor esi, esi
push edi
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push reloc.OLEAUT32.dll_SysReAllocString
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4045a4
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push edi
push 0x407554
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40459b
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00404698
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004048b8
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x404735
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push 0x230
mov eax, 0x406928
call fcn.0040545b
xor eax, eax
mov byte [ebp - 0x231], al
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x4048ac
push str.__alloweddir
mov byte [ebp - 0x231], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x238], esi
pop ecx
cmp dword [ebp - 0x23c], eax
jle 0x4048a5
cmp dword [ebx + edi*4], 0
je 0x404898
push esi
push str.__alloweddir
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404898
mov eax, dword [ebx + edi*4]
xor ecx, ecx
mov byte [ebp - 0x231], cl
lea esi, [eax + esi*2]
cmp word [esi], cx
je 0x404892
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 0x104
jae 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x404892
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00404698
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x220], eax
je 0x404883
mov ecx, 0x104
cmp dword [ebp - 0x220], ecx
jae 0x404883
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x404883
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x404883
lea eax, [ebp - 0x218]
mov ecx, section..data
push eax
call fcn.00404a3b
mov byte [ebp - 0x231], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00401780
mov esi, dword [ebp - 0x238]
inc edi
cmp edi, dword [ebp - 0x23c]
jl 0x40479b
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0x231]
call fcn.00405416
ret

Function at 0x404ace
Capabilities:
Accept command line arguments

Disassembly:
push esi
push 1
call fcn.00404972
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call fcn.00404735
test al, al
jne 0x404afd
xor eax, eax
inc eax
jmp 0x404b0c
push esi
call fcn.00404935
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
ret 0x10
Function at 0x40b448
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
xor eax, eax
cmp dword [0x415010], 1
je 0x40b464
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
mov ebx, dword [eax + 4]
movzx eax, byte [eax]
cmp eax, 0xd1
je 0x40b494
jg 0x40b48c
cmp eax, 0xcc
je 0x40b573
add esp, 0xc
pop ebx
pop esi
pop edi
xor eax, eax
pop ebp
ret
cmp eax, 0xdd
jne 0x40b482
nop
sub esp, 0xc
mov edx, dword [esp + 0x2c]
cmp byte [edx], 0xdd
mov eax, 0x4143e4
je 0x40b4aa
mov eax, 0x414410
push eax
call 0x40cdb8
add esp, 0x10
mov edi, dword [esp + 0x20]
movzx esi, byte [edi + 1]
cmp esi, 0xc
mov ebp, 1
mov edx, 4
jl 0x40b590
mov edi, 0xc
jmp 0x40b53e
movzx esi, byte [ebx + edx + 1]
mov eax, esi
test al, al
je 0x40b560
push eax
movzx eax, byte [ebx + edx + 7]
push eax
movzx eax, byte [ebx + edx + 6]
push eax
movzx eax, byte [ebx + edx + 5]
push eax
movzx eax, byte [ebx + edx + 4]
push eax
movzx eax, byte [ebx + edx + 3]
push eax
movzx eax, byte [ebx + edx + 2]
push eax
mov eax, ecx
and eax, 7
push eax
mov cl, byte [edx + ebx]
shr cl, 3
movzx eax, cl
mov edx, esi
push eax
movzx ecx, dl
push ecx
push ebp
push 0x414438
call 0x40cdb8
add esp, 0x30
mov ecx, dword [esp + 0x20]
mov edx, edi
movzx esi, byte [ecx + 1]
add edi, 8
inc ebp
cmp esi, edi
jl 0x40b590
mov cl, byte [edx + ebx]
test cl, cl
je 0x40b4d8
cmp cl, 0xff
movzx esi, byte [ebx + edx + 1]
jne 0x40b4e3
mov eax, esi
inc al
jne 0x40b4e3
sub esp, 8
push ebp
push 0x414485
jmp 0x40b569
sub esp, 8
push ebp
push 0x41449d
call 0x40cdb8
add esp, 0x10
jmp 0x40b52c
sub esp, 0xc
push 0x4144b0
call 0x40cd60
add esp, 0x10
mov edx, dword [esp + 0x20]
cmp byte [edx + 1], 0xa
ja 0x40b59d
lea esi, [esi]
mov eax, 1
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ecx, byte [ebx + 4]
sub esp, 8
push ecx
push edx
call fcn.00401ee0
pop edi
pop ebp
push eax
push 0x4144d0
call 0x40cdb8
pop ecx
pop esi
movzx eax, byte [ebx + 5]
push eax
push dword [esp + 0x2c]
call fcn.00401ee0
pop ebp
pop edx
push eax
push 0x4144e0
call 0x40cdb8
pop esi
pop edi
movzx ebp, byte [ebx + 6]
push ebp
push dword [esp + 0x2c]
call fcn.00401ee0
pop edx
pop ecx
push eax
push 0x4144f5
call 0x40cdb8
pop edi
pop ebp
movzx edi, byte [ebx + 0xa]
push edi
push dword [esp + 0x2c]
call fcn.00401ee0
pop ecx
pop esi
push eax
push 0x41450b
call 0x40cdb8
pop eax
pop edx
movzx esi, byte [ebx + 8]
push esi
push 0x414522
call 0x40cdb8
pop ebp
movzx ecx, byte [ebx + 7]
pop eax
push ecx
push dword [esp + 0x2c]
call fcn.00401ee0
pop esi
pop edi
push eax
push 0x414537
call 0x40cdb8
pop edx
pop ecx
movzx edx, byte [ebx + 9]
push edx
push 0x414548
call 0x40cdb8
add esp, 0x10
mov eax, 1
jmp 0x40b595
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x1fba3253
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x659b02d1
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x4f3d22f6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1f180dc2
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xf0000000
xor ebx, ebx
push 0x18
push ebx
push ebx
lea eax, [ebp - 8]
push eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x401081
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x1c
push 0x4030a0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
push ebx
push edi
push 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push 0x1ec
push dword [ebp + 8]
push esi
push ebx
push 1
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
cmp dword [ebp - 4], ebx
je 0x401072
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 8], ebx
je 0x401081
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x401088
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0xf0000000
xor edi, edi
push 0x18
push edi
push edi
lea eax, [ebp - 8]
push eax
mov esi, edx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x401101
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x1c
push 0x4030a0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
push edi
push edi
push 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push dword [ebp + 8]
push esi
push edi
push 1
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
cmp dword [ebp - 4], edi
je 0x4010f2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 8], edi
je 0x401101
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
leave
ret 4