joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c866f
Capabilities:
Encode data using xor

Disassembly:
sub ebx, dword [ecx + 0x74152110]
sub dh, byte [eax - 0x3f5b3f3a]
mov cl, byte [edx + 0x4b]
and dword [esi + 0xa015611], ebp
xor eax, 0x91622199
xchg byte ss:[ebx], al
js 0x4c8684
and dword [edi - 0x6f], ebp
sub eax, dword [ebx + ebp*4 + 0xecde9c6]
push esp
cmp al, 0x10
stc
adc byte [edx + 0x462266a0], ch
xchg esp, eax
jb 0x4c86e6
int 0x84
aad 0xa7
jge 0x4c869c
push cs
jne 0x4c86e2
dec ecx
sbb dword [ebx + 0x2dadc543], eax
lcall 0x3f12, 0xfec918e4
add edi, ebx
out dx, eax
out dx, eax
push esi
dec esp
and byte [ebx + 0x23], bh
mov edx, 0x83fa7bd1
cmc
or ah, byte [ecx - 0x45]
imul ebp, edx, 0xffffff89
mov ah, cl
retf 0xdfb2
daa
aad 0x39
mov dword [0x59c06073], eax
and dword [edi], eax
jae 0x4c8748
rcr byte [ecx + 0x21], 7
jne 0x4c873c
popal
jmp 0xcc5cc122
adc eax, 0x10faf05e
sbb dword [edx - 0x7bf0e4fc], esi
push 0x4f
dec edi
sub eax, eax
push esp
aam 0x5e
pushal
inc eax
mov bh, 0x32
xor ah, ah
aam 0x8a
pop edi
mov bh, 0xd7
dec esp
jae 0x4c86e6
and al, 0x13
adc eax, ebp
push esp
movsd dword es:[edi], dword [esi]
sub bl, byte [ebp - 0x135ffbc9]
dec esi
xchg esi, eax
mov edx, 0xf1fba1b0
movsd dword es:[edi], dword [esi]
mov dl, 5
into
stosb byte es:[edi], al
std
or byte [ebp - 0x6f8dbc76], dl
push 0x43
cmp al, 0x81
bound ebx, qword [edi + 0x43]
mov cl, 0xb5
sbb dword [edi], ecx
leave
invalid
Function at 0x548c6f
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
sal dword [0xef009345], 0x43
test byte [eax + 0x5d], cl
das
xchg ecx, eax
jmp 0xe1b0520a
pop ebx
push ecx
pop ebx
insd dword es:[edi], dx
lahf
jbe 0x548c53
inc dh
mov ah, 0x67
clc
adc al, byte [esp + edi*8 + 0x73e81596]
lds ebx, [eax - 0x69e3787a]
cmpsb byte [esi], byte es:[edi]
call 0xdba473d7
mov esp, 0xed635c0
jge 0x548ced
and al, 0x37
sbb eax, 0xe64e217e
push ecx
push ebp
inc eax
mov dword [0x3b94e1d5], eax
loope 0x548d00
add dl, ah
mov al, 0x5a
test byte [ecx + 0x54fa9160], ch
sub dl, byte [eax - 0x1d]
xor eax, 0xc6dde32
fisubr word [ebp + 0xc]
loop 0x548cfa
mov eax, dword [0xa551f7c5]
aam 0xd6
lock btr dword [ebp - 0x3b], esi
push edx
in eax, 0xcd
cli
and al, 0xa4
and dword [eax], eax
movsd dword es:[edi], dword [esi]
jb 0x548d41
sbb eax, 0x746b3058
les esp, [edx + esi]
jg 0x548cef
outsb dx, byte [esi]
bound edi, qword fs:[edi - 0x37]
xchg ecx, eax
jne 0x548d0d
out 0x3e, eax
fmul qword [edi]
jno 0x548cb8
retf 0xcc07
pop es
int3
les esp, [eax + 0x392742a2]
je 0x548d6e
sti
shl ebx, 1
div edi
int1
xchg esp, eax
lds esi, [ecx + 0x54697b07]
pop es
jnp 0x548d6c
push esp
scasb al, byte es:[edi]
int 0x23
inc edi
pushal
add dword [ebp - 0x1ab8cc94], eax
scasb al, byte es:[edi]
inc edi
in eax, 0xae
invalid
mov eax, 0xe5972b3
bnd jp 0x548d5d
xchg byte [ecx + 0x59], dh
inc edx
inc edi
aas
push edi
xor eax, 0xff46b154
mov ah, byte [eax]
xchg edx, eax
push ecx
adc byte [ebx + 0x3486710b], ah
aam 0x31
je 0x548dd7
xchg byte [esp + edx*8], dh
xor dword [esp + esi*2 - 0x4c], esi
sub byte [esi], al
mov ah, 0x28
push es
scasd eax, dword es:[edi]
jnp 0x548cec
sub dl, byte [esi + 0x27848503]
test dword [edi + 0xcf5a4c], eax
xchg ebp, eax
insd dword es:[edi], dx
or esi, dword [eax]
inc edi
xchg edx, eax
jb 0x548dd0
daa
dec esp
pop edx
iretd
lds ebp, [0x5697a4e5]
add byte [ebp + eax + 0x124113ed], 0x95
inc eax
jnp 0x548dc9
mov eax, dword [0xb5b7c599]
retf 0x9044
or byte [ecx + 0x566a149d], 0x41
mov ah, 0x8b
cli
mov esi, 0x441917a
and al, 0xb6
push ss
add al, 0x24
mov dh, 0x16
cmpsb byte [esi], byte es:[edi]
das
invalid

Function at 0x5a360f
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebx], eax
out dx, eax
add byte [edx - 0x7e], ch
push ds
in eax, dx
les ebp, [edx]
mov ecx, 0x296f0e11
add dword [esi + 0xc25ab3c], esp
call dword [edx - 0x33b71d2e]
xchg byte [ebp + 0x4ec510aa], ah
out dx, al
jle 0x5a3639
out dx, eax
neg byte [edx]
lcall 0x3cae, 0x63a12ee
pop esi
cmp al, byte [esi]
scasb al, byte es:[edi]
cmp al, 0x5e
cli
sahf
pop eax
pop ecx
invalid
Function at 0x5efcef
Capabilities:
Encode data using xor

Disassembly:
lahf
bound ecx, qword [ebx - 0xb]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
popal
je 0x5efc4e
cmpsb byte [esi], byte es:[edi]
idiv dword [0xcb15dea3]
inc ebp
mov ebx, 0xd1dbde59
sbb ch, byte [edi + 0x400489a7]
sbb byte [eax - 0x26], 0xfe
mov byte [0x6c641101], al
jne 0x5efc1e
add byte [ebx + 0x27ed9f3d], cl
dec ecx
cld
mov esp, 0x2901fb98
sbb dword es:[eax + ecx*2 + 0x7c], edx
xor al, 0xf2
xor byte [eax], bl
loopne 0x5efc4f
aad 3
add dword [esi + 0x76], ecx
retf
out dx, eax
jbe 0x5efcb4
pop es
jp 0x5efc86
sbb esp, dword [ebx]
nop
shl edx, cl
lds esp, [edx - 0x33dfed88]
test byte [eax], ch
dec eax
and byte [eax + 0x51], ah
push ecx
cmc
je 0x5efd0c
movsd dword es:[edi], dword [esi]
xor bh, byte [ebp + 0x2f]
jp 0x5efd80
pushal
sar dl, cl
mov cs, esi
xchg ecx, eax
dec edx
dec ebp
sbb bl, 0xb5
ret
pushal
xchg dword [esi - 0x1d], eax
inc eax
mov ebx, ebp
mov ecx, 0xa0caff33
sahf
adc eax, 0x5df9ad09
lodsd eax, dword [esi]
stc
pop ebp
pop eax
rcl ebx, 0xb1
or ecx, 0xe772304c
pop eax
xor dword [ebp - 0x42], esp
mov byte [ecx], ch
jbe 0x5efd71
std
push eax
int 0xd1
or esi, dword [eax - 0x49]
mov al, byte [0x8ccbe5b]
push ecx
in eax, 0x32
aam 0xab
mov bl, 0xc2
pop ds
inc esp
pop ds
les esp, [ebx - 0x6299b5dc]
mov ecx, 0x8bd790b5
out 0x96, al
xchg ecx, eax
add eax, 0x730ca17d
adc dl, byte [ecx - 0x43]
and bl, dh
cld
adc dword [ebp + 0x225117a5], esp
pop ecx
inc esp
push edi
popal
inc ecx
int3
Function at 0x5f445f
Capabilities:
Encode data using xor

Disassembly:
and byte [ebx + eax - 0x37dbcfcf], ah
insd dword es:[edi], dx
fst st(7)
out dx, al
cmp eax, 0xa7d1a6d9
mov ah, byte [ebp - 0x13]
adc dword [ecx + 0x67], eax
jl 0x5f4483
jl 0x5f4483
inc esp
inc esi
std
xor al, 0x95
jecxz 0x5f4499
sub al, 0xa6
pop es
pop esp
dec ebx
xchg esi, eax
sar byte [ecx - 0xf], 1
insd dword es:[edi], dx
mov dword [0xdfd890e7], eax
add eax, 0x31293dfc
unpckhps xmm0, xmmword [ecx + 0x74]
adc dword [ebp - 0x77], esp
test byte [esp + edx*2 + 0x40], ch
cmc
scasd eax, dword es:[edi]
mov dword gs:[esp + ebp*2 - 0x500abfac], eax
repe scasd eax, dword es:[edi]
test dword [eax], esi
sti
das
jl 0x5f4463
dec esp
jecxz 0x5f445a
adc dword [esi], ebp
pushfd
and al, 0x10
xor ebp, dword [ebp + 0x4707b23a]
pop es
inc edi
cmc
and edi, esi
pop ebx
aam 0xfe
xlatb
push ecx
in eax, 3
jo 0x5f444a
jne 0x5f44fd
jecxz 0x5f449f
push eax
jno 0x5f4519
dec esi
fist word [edi + ecx*4]
vmaxpd ymm4, ymm5, ymmword [ebx - 0x2eb1dff0]
inc esp
push ecx
mov ch, 0x11
les esp, [ecx - 0x2d]
xor byte [eax + ebp*4 - 0x376dd496], dl
mov ecx, 0xc1d093ce
out 0x4f, eax
into
inc ebp
push eax
pop es
xchg edx, eax
xor eax, 0x554f14b8
push ecx
scasd eax, dword es:[edi]
popal
idiv byte [esi*8 - 0xb161380]
shl byte [ebp + 0x6403af0e], 0x17
and byte [eax - 0xa4f5f89], dl
push edx
xchg edx, eax
into
ror byte [ebx + 0x53921daa], 1
outsb dx, byte [esi]
adc eax, 0x6135e803
dec ebp
sahf
and ah, byte [esi - 0x1a554adb]
sahf
sbb eax, 0x156e5392
add ebp, eax
xor eax, 0x229e4d61
cmpsb byte [esi], byte es:[edi]
and eax, 0x64e5aab5
sahf
mov dword [0x3410a7ce], eax
pushal
fldenv [0xb030e4b6]
clc
in al, 0x30
mov al, 0xf8
add byte ss:[edx - 0x36], bh
outsb dx, byte [esi]
push ecx
outsd dx, dword ss:[esi]
shl byte [ecx], 0xe5
add al, 0x92
pushal
test al, 0xbb
add byte [esi + 0x520dcb9c], cl
push edi
shl byte [ebp - 0x5b278a5f], 0xc7
fld qword [ecx + 0x722f6575]
mov dl, byte [edi + 0x7d96534a]
push edx
or eax, dword [ebx + 0x1321a44a]
dec edi
xor dh, ah
pushal
aad 0xe9
sub eax, 0x1da126f1
sub dl, byte [edi]
xchg ecx, eax
les edi, [esi + 0x616025f1]
je 0x5f452b
dec eax
push es
jmp 0x923f1d22
Function at 0x630ecf
Capabilities:
Encode data using xor

Disassembly:
retf 0xe1ee
mov esi, dword [esi + 0x31b343cd]
in al, 0x34
xchg edi, eax
and ebp, esp
and dword [ebx + 0x29], eax
pop es
ror dword [0x86c17365], 0xd1
mov edx, 0xc9735388
pop es
in eax, 6
and dh, ah
pop eax
cli
nop
paddd mm0, qword [ebp + 0x2ef368b9]
mov ecx, 0x46c2c26f
xchg ecx, eax
dec edi
add cl, ah
mov byte [0x1576930c], al
lodsb al, byte [esi]
loope 0x630de6
ret 0x9146
out dx, eax
cmp dl, bh
xor dword [ecx - 0x4acf4ee6], 0xffffffc1
and ebp, ebp
nop
popal
sub edx, 0x72
or ah, byte [edi + 0x4e]
test eax, 0xc3ffb3fe
inc ecx
jecxz 0x630e31
arpl word [ecx + 0x13a7d204], sp
and edx, dword [eax]
xlatb
sub eax, 0x4db3e70c
out 0xb3, eax
dec ebp
and ebx, dword [ebx - 0x2e081e71]
mov bl, 0xac
jge 0x630e04
xor bl, byte [ecx + ecx*2 - 0xf]
fsub qword [ecx + 0x33]
fmul dword [ebp + 0x125c4be1]
add ebx, ebp
psrlw mm0, qword [eax]
invalid
cmpsb byte [esi], byte es:[edi]
loope 0x630ed4
adc esp, dword [ebx]
sal dword [esi], cl
xchg esi, eax
setb byte [ebx - 0x3a]
pop ecx
xchg esp, eax
std
jp 0x630e67
push ecx
out dx, eax
adc edx, dword [edi]
add byte [ecx], dh
dec ebx
jmp 0xf26edfad
xor bl, ch
xchg byte [ebx - 0x2d], al
repne movsb byte es:[edi], byte cs:[esi]
shr dword [esi], cl
repne movsb byte es:[edi], byte [esi]
add dword [esi - 0x33131bed], edi
mov ebx, 0x533fb29e
adc dword [ebp - 0x283a6d39], esp
jl 0x630e9e
pop eax
sub ecx, dword [eax + 0x31]
add dword [ecx], 0x90130187
push eax
pop ds
add byte [edi], 0x3e
add edx, dword [eax - 0x2ae40bf1]
dec ecx
xor dword [edx + 0x51], esi
push ebx
cmp dword [ebx + 0x3760ec33], eax
enter 0xc0c, 0xf
cmp dword fs:[ebp - 0x520d1e82], 0xffffffe2
adc byte [eax + 0x41fe0aca], ch
adc dword [ecx - 0x19], esi
mov edx, 0x931db9c8
add eax, 0x13d13e87
mov gs, word [edi - 0x2e97ce58]
invalid

Function at 0x638d7f
Capabilities:
Encode data using xor

Disassembly:
adc ch, byte [ebp + 0x13]
in eax, dx
scasb al, byte es:[edi]
xchg ebx, eax
pop es
inc edx
imul esp, dword [ebx - 0x7a581676], 0xffffffd0
push edx
jo 0x638ded
adc bh, bl
adc byte [esi], dh
or ebp, dword [ebx]
enter 0x3933, 0xffffffffffffffd8
jb 0x638e05
xor edi, dword [ecx]
fdiv dword [edx + 0x68]
sbb esp, ecx
adc al, 0x63
stosd dword es:[edi], eax
jecxz 0x638db9
add al, 0x8a
out dx, eax
popfd
mov eax, dword [0x9701522c]
xor al, ah
jne 0x638da6
or byte [esi + 0x44], 0x22
sbb dl, byte [ecx + 0x31]
fst st(2)
xchg edx, ecx
shl byte [esi], cl
xchg edx, ecx
add dword [ebx - 0x7aee1f39], esp
loop 0x638e1e
test dword [esi], ebp
loop 0x638e1e
cmp cl, ah
add ebp, dword [ecx]
mov cl, 0xcf
dec ebp
invalid
jne 0x638d98
dec eax
loopne 0x638dc2
mov dl, 0x68
adc al, 0xc0
scasd eax, dword es:[edi]
and dword [edi + 1], edx
movsb byte es:[edi], byte [esi]
jne 0x638dfa
out dx, al
pop esp
ljmp 0x3822:0x7f570f5e
Function at 0x10016550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1001655f
pop dword [ebp - 0x20]
mov eax, 0x1001655f
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x417fd
push 0
mov eax, 0x5f9cfd33
sub eax, 0x4f999c57
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x4c48
xor esi, esi
add esi, eax
mov edx, 0xb390df37
sub edx, 0xa38d2137
add edx, dword [ebp - 0x20]
mov edi, 0xce673d49
xor dword [ebp - 4], 0x49653d9e
mov ebx, dword [edx]
sub dword [ebp - 0xc], edi
xor ebx, edi
sub dword [ebp - 0x1c], 0x7028c132
mov dword [esi], ebx
sub dword [ebp - 0xc], 0x6ce9a5a0
add esi, 0x86be2566
sub esi, 0x86be2562
add edx, 4
loop 0x100165af
add eax, 0x123f3
mov ebx, eax
add eax, 0x142ea18e
sub eax, 0x142ea189
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.10016550
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.10016550
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100023fd
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
xor edi, edi
cmp dword [esp + 0x14], edi
je 0x1000240f
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
jmp 0x10002415
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
call fcn.100032c3
mov esi, eax
pop ecx
cmp esi, edi
je 0x1000243f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x29c]
push esi
mov edi, eax
call dword [sym.imp.msvcr100.dll_free]
pop ecx
jmp 0x1000244d
push str.memory_allocation_error
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowOutOfMemoryError_8
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x100032c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x100032d2
pop dword [ebp - 0x2c]
mov eax, 0x9fb47fef
sub eax, 0x8fb44d1d
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xd105167e
sub dword [ebp - 0x3c], 0x82b2d133
mov dword [ebp - 0x38], 0x79d7798b
sub dword [ebp - 0x38], 0x47a42d46
mov dword [ebp - 0x34], 0x723090bd
add dword [ebp - 0x34], 0xda1bb371
mov dword [ebp - 0x30], 0x2316439c
sub dword [ebp - 0x30], 0x2316439c
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xd0b4723c
add dword [ebp - 0x3c], 0xa3bdf71a
mov dword [ebp - 0x38], 0xa378bd83
sub dword [ebp - 0x38], 0x620c5c0e
mov dword [ebp - 0x34], 0x374aee9c
sub dword [ebp - 0x34], 0xd3db8230
mov dword [ebp - 0x30], 0xc4a9c412
sub dword [ebp - 0x30], 0xc4a9c412
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x34169
push 0
call eax
mov ecx, 0x398a
mov esi, eax
mov edx, 0x81b814ac
add edx, 0x8e49f154
add edx, dword [ebp - 0x2c]
mov ebx, 0xa5d29683
mov dword [ebp - 0x20], 0xacab5b72
mov edi, dword [edx]
mov dword [ebp - 0x14], 0x7883e0cd
xor edi, ebx
sub dword [ebp - 0x14], 0x2cf766c9
mov dword [esi], edi
xor dword [ebp - 4], esi
add esi, 0xede1259b
add esi, 0x121eda69
add edx, 4
loop 0x100033de
add eax, 0xd8fb
mov ebx, eax
add eax, 0x7bb16cde
add eax, 0x844e9327
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10006ed9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xe0
mov eax, dword [0x1001cf10]
xor eax, ebp
mov dword [ebp + 0x74], eax
push edi
lea eax, [ebp - 0x5c]
push eax
push 0x20019
xor edi, edi
and dword [ebp - 0x5c], edi
push edi
push str.SystemCurrentControlSetControlTimeZoneInformation
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006f4f
and dword [ebp - 0x60], edi
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
push edi
push str.ActiveTimeBias
push dword [ebp - 0x5c]
mov dword [ebp - 0x64], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
jne 0x10006f41
mov edi, dword [ebp - 0x68]
push dword [ebp - 0x5c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
pop ebx
je 0x10006f61
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.kernel32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x10006f61
mov edi, dword [ebp - 0x58]
lea eax, [ebp + 0x54]
push eax
mov eax, edi
call fcn.100067f8
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.msvcr100.dll__strdup]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop edi
call fcn.100122d0
add ebp, 0x78
leave
ret

Function at 0x10007644
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.advapi32.dll_CryptAcquireContextA]
push edi
xor ebx, ebx
push ebx
push 1
push ebx
mov edi, str.J2SE
push edi
lea eax, [ebp - 8]
push eax
mov byte [ebp - 1], bl
call esi
test eax, eax
jne 0x1000767f
push 8
push 1
push ebx
push edi
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jne 0x1000767f
xor al, al
jmp 0x100076d4
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x2ac]
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x2e0]
mov edi, eax
cmp edi, ebx
je 0x100076c7
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptGenRandom]
test eax, eax
je 0x100076b9
mov byte [ebp - 1], 1
mov eax, dword [esi]
push ebx
push edi
push dword [ebp + 0x10]
push esi
call dword [eax + 0x300]
push ebx
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10007e22
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [0x1001cf68]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.1000a207
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10007e43
xor al, al
jmp 0x10007e74
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push eax
push esi
call fcn.100032c3
push esi
mov ebx, eax
call dword [sym.imp.msvcr100.dll_free]
add esp, 0xc
cmp ebx, 0xffffffff
je 0x10007e83
mov eax, dword [esp + 0x18]
dec eax
je 0x10007e71
dec eax
je 0x10007e78
dec eax
dec eax
jne 0x10007e83
mov al, 1
pop ebx
pop esi
ret 0x10
mov al, 1
test bl, 0x10
jne 0x10007e73
test al, bl
je 0x10007e73
xor al, al
jmp 0x10007e73
Function at 0x10007e87
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x14], 4
push edi
mov byte [ebp - 1], 0
je 0x10007f2d
cmp dword [ebp + 0x14], 1
je 0x10007f2d
push dword [0x1001cf68]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.1000a207
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10007ec2
xor al, al
jmp 0x10007f30
push esi
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
push edi
call esi
cmp eax, 0xffffffff
je 0x10007f1f
push ebx
test eax, 0x400
je 0x10007ef7
push edi
push dword [ebp + 8]
call fcn.1000773c
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10007f1e
push edi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
push ebx
mov edi, ebx
call esi
cmp eax, 0xffffffff
je 0x10007f1e
test al, 0x10
jne 0x10007f1e
cmp byte [ebp + 0x18], 0
je 0x10007f0b
and eax, 0xfffffffe
jmp 0x10007f0e
or eax, 1
push eax
push edi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x10007f1e
mov byte [ebp - 1], 1
pop ebx
push edi
call dword [sym.imp.msvcr100.dll_free]
mov al, byte [ebp - 1]
pop ecx
pop esi
jmp 0x10007f30
mov al, byte [ebp + 0x18]
pop edi
leave
ret 0x18

Function at 0x10008088
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor edi, edi
push edi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.100032c3
mov esi, eax
add esp, 0xc
cmp esi, edi
jne 0x100080a7
xor al, al
jmp 0x10008123
push esi
call fcn.100032c3
pop ecx
test eax, eax
je 0x100080bc
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
jmp 0x100080a3
push edi
push 0x200080
push 1
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10008112
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0x50
je 0x100080b2
cmp edi, 0xb7
je 0x100080b2
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100080b2
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
push str.Could_not_open_file
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowIOExceptionWithLastError_8
jmp 0x100080b2
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
ret 0xc

Function at 0x10008128
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push dword [0x1001cf68]
xor bl, bl
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a207
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1000814c
xor al, al
jmp 0x1000818c
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10008182
push esi
test al, 0x10
je 0x10008171
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
jmp 0x10008177
call dword [sym.imp.kernel32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x10008182
mov bl, 1
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
mov al, bl
pop esi
pop ebx
ret 0xc
Function at 0x401cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop ebp
ret

Function at 0x401cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x417d34
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00417db3
jae 0x417d40
xor ecx, ecx
call fcn.00417db3
jae 0x417d6a
xor eax, eax
call fcn.00417db3
jae 0x417d7b
mov al, 0x10
call fcn.00417db3
adc al, al
jae 0x417d5c
jne 0x417da8
stosb byte es:[edi], al
jmp 0x417d41
call fcn.00417dbf
dec ecx
loop 0x417d87
mov eax, ebp
call fcn.00417dbd
jmp 0x417da9
lodsb al, byte [esi]
shr eax, 1
je 0x417dcf
adc ecx, 2
mov ebp, eax
jmp 0x417da9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00417dbd
cmp eax, 0x7d00
jae 0x417da7
cmp eax, 0x500
jae 0x417da8
cmp eax, 0x7f
ja 0x417da9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x417d41
pop ebp
ret 8