joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53e1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x53e2c4
cmp byte [edx], 0
je 0x53e2b7
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.0053e150
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.0053e150
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.0053e0c0
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x53e281
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.0053e100
fmul qword [0x6e4410]
push ecx
fstp qword [esp]
call fcn.0051a618
fadd qword [0x6e4408]
add esp, 8
call fcn.0051a230
mov byte [ebx], al
inc ebx
dec edi
jne 0x53e254
lea ecx, [esp + 0x20]
push ecx
call fcn.0053e100
fmul qword [0x6e4410]
push ecx
fstp qword [esp]
call fcn.0051a618
add esp, 8
call fcn.0051a230
cmp esi, ebx
je 0x53e2ad
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x53e2a6
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53e690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x53e6c0
mov byte [edi + esi], 2
jmp 0x53e6f7
test al, 4
je 0x53e6ca
mov byte [edi + esi], 0xd
jmp 0x53e6f7
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x53e6e3
mov byte [edi + esi], 2
jmp 0x53e6f7
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x53e6f3
mov byte [edi + esi], 0x19
jmp 0x53e6f7
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x53e6a7
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x53e76b
cmp dl, 0xd
je 0x53e76b
xor edx, edx
jmp 0x53e770
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x53e75b
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x53e790
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.0053d050
mov esi, eax
add esp, 8
test esi, esi
jne 0x53e7b1
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.0053fdf0
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x53e7d6
push esi
call fcn.0053d0e0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.005270b2
push ebx
push edi
mov ebp, eax
call fcn.0053fe60
push 0x53e810
push ebp
push esi
call fcn.00541190
push esi
call fcn.0053d0e0
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x53fb20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x8187e0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x818708]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x53fb9b
push 0x4c
push 1
call fcn.0051cf2c
mov esi, eax
add esp, 8
test esi, esi
jne 0x53fb63
push 0x8187e0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x818708]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x80eb20]
inc eax
lea edx, [esi + 0xc]
mov dword [0x80eb20], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.00543670
add esp, 8
mov byte [esi + 0x3c], 1
push 0x8187e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x540020
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.0051db90
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.005270b2
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x54011a
call fcn.0051db90
cmp dword [eax], 0
je 0x540067
call fcn.0051db90
mov ebp, dword [eax]
jmp 0x54006a
or ebp, 0xffffffff
call fcn.0053fbb0
test esi, esi
mov dword [eax], ebp
jne 0x54007f
call fcn.0051db90
cmp dword [eax], 4
je 0x5400cf
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x5400b2
cmp esi, 0xffffffff
je 0x5400f4
test al, 6
je 0x5400b2
call fcn.0053fbb0
mov ecx, dword [eax]
push ecx
push ebx
call fcn.005436a0
add esp, 4
push eax
push 0x24
push 9
call fcn.00540400
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x540112
test al, 6
je 0x5400c0
test ah, 2
je 0x540112
test esi, esi
jbe 0x54011e
test ah, 2
je 0x54011e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.0051db90
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.005270b2
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x54011a
jmp 0x540054
call fcn.0053fbb0
mov eax, dword [eax]
push eax
push ebx
call fcn.005436a0
add esp, 4
push eax
push 0x24
push 2
call fcn.00540400
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x54012b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x540134
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x556f27
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x556f5f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00554f29
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00554f01
jmp 0x556f6b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x55861a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x55865c
call fcn.0055eea8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x55865c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x558653
xor eax, eax
jmp 0x558664
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0055866a
pop edi
pop esi
pop ebx
ret 4

Function at 0x55e587
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x55e5b5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x55e5d3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0055e4ed
jmp 0x55e5d3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x55e5d3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0055e4ed
test edi, edi
mov eax, edi
jne 0x55e5bd
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x40ea81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40ea90
pop dword [ebp - 0x14]
mov eax, 0xe38b201c
add eax, 0x1cb5ca74
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3e6aa
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x26bb5de7
add ecx, 0xd944f1e3
mov ebx, eax
mov edi, 0x7865e137
sub edi, 0x7822b337
add edi, dword [ebp - 0x14]
mov edx, 0x8bbe14aa
sub dword [ebp - 0x10], edx
mov esi, dword [edi]
add dword [ebp - 0x10], ebx
xor esi, edx
sub dword [ebp - 0xc], esi
mov dword [ebx], esi
xor dword [ebp - 0xc], 0xc109172c
add ebx, 0x1ba1462c
add ebx, 0xe45eb9d8
add edi, 0x3ecf252e
sub edi, 0x3ecf252a
loop 0x40eae4
add eax, 0xe87682fd
add eax, 0x178aaefe
mov ebx, eax
add eax, 0xc43d3a45
sub eax, 0xc43d3a40
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x404000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x40401a
push 0x4046d2
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor al, al
jmp 0x40406e
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x24]
test ecx, ecx
jne 0x40402e
mov edx, dword [ebp + 8]
cmp dword [edx + 0x38], 0
jne 0x40403f
push 0x4046e2
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor al, al
jmp 0x40406e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCancelIrp]
movzx ecx, al
test ecx, ecx
jne 0x404061
push 0x4046f2
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor al, al
jmp 0x40406e
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00401140
mov al, 1
pop ebp
ret 4
Function at 0x405000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], 0
push 0x405362
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
mov edx, dword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov eax, dword [edx]
push eax
push 0
push 0
push 0x40
lea ecx, [ebp - 0x18]
push ecx
call sub.ntoskrnl.exe_ObReferenceObjectByName
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x405057
push 0x405384
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x4050ad
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0x405396
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x4050aa
cmp dword [ebp - 8], 1
jne 0x405096
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004050c0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x40507d
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4050c0
Capabilities:
Create device object
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x405308
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x2c]
push edx
lea eax, [ebp - 0x28]
push eax
push 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x40511d
push 0x40532a
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor eax, eax
jmp 0x405232
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
mov byte [edx + 0x10], 0
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
call fcn.00401000
push 0
push 0x31323334
push 0x20
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x20
push ecx
call dword [sym.imp.ntoskrnl.exe_ExInitializePagedLookasideList]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x1c]
and eax, 0x2014
mov ecx, dword [ebp - 4]
or eax, dword [ecx + 0x1c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x20]
mov dword [eax + 0x20], edx
push 0x40533c
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x88], edx
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 0x8c], eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x4051d3
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, dword [ebp - 0xc]
jmp 0x405232
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x405200
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [ebp - 0xc], 0xc0000001
mov eax, dword [ebp - 0xc]
jmp 0x405232
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
and eax, 0xffffff7f
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
push 0x405356
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4052bc
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.004052cc
pop ebp
jmp fcn.00405240
Function at 0x91b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x91b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x91b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x91b06a
add dl, dl
jne 0x91b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x91b0dc
xor eax, eax
add dl, dl
jne 0x91b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x91b17d
add dl, dl
jne 0x91b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x91b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x91b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x91b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x91b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x91b075
mov eax, 1
add dl, dl
jne 0x91b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x91b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x91b0e1
sub eax, ebx
mov ebx, 1
jne 0x91b128
mov ecx, 1
add dl, dl
jne 0x91b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x91b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x91b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x91b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x91b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x91b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x91b136
cmp eax, 0x7d00
jae 0x91b16d
cmp eax, 0x500
jb 0x91b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x91b075
cmp eax, 0x7f
ja 0x91b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x91b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x91b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x91b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40a0af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40a0be
pop dword [ebp - 0x24]
mov eax, 0xca19fca5
add eax, 0x3626a419
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xda081663
sub dword [ebp - 0x34], 0x8bb5d118
mov dword [ebp - 0x30], 0xdd3b701b
sub dword [ebp - 0x30], 0xab0823d6
mov dword [ebp - 0x2c], 0xe29ba4f9
sub dword [ebp - 0x2c], 0x964f60cb
mov dword [ebp - 0x28], 0xc9fba917
sub dword [ebp - 0x28], 0xc9fba917
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xd0f2e76a
add dword [ebp - 0x34], 0xa37f81ec
mov dword [ebp - 0x30], 0x16dc77ce
sub dword [ebp - 0x30], 0xd5701659
mov dword [ebp - 0x2c], 0x58e64328
sub dword [ebp - 0x2c], 0xf576d6bc
mov dword [ebp - 0x28], 0xbe94800f
sub dword [ebp - 0x28], 0xbe94800f
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x10a47de4
sub eax, 0x1063adb0
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x38477
push 0
call eax
mov ecx, 0x49f1
xor edi, edi
add edi, eax
mov ebx, 0x415400
add ebx, dword [ebp - 0x24]
mov edx, 0x928c0c5b
xor dword [ebp - 0x20], eax
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0xc64b46f0
sub esi, edx
sub dword [ebp - 0x18], ecx
mov dword [edi], esi
xor dword [ebp - 0x18], eax
add edi, 4
add ebx, 4
loop 0x40a1cb
add eax, 0x11a97
mov ebx, eax
add eax, 0x45163a42
add eax, 0xbae9c5c3
mov ecx, 0xbf066deb
sub ecx, 0xbec66deb
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x40a6c1
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
cmp dword [0x412664], 0
je 0x40a6cd
mov al, 1
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
push 0
push 1
push 0
push 0x40f27c
mov edi, 0x412664
push edi
call esi
test eax, eax
jne 0x40a70f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x40a70b
push 8
push 1
push 0
push str.__SunJavaKernel
push edi
call esi
test eax, eax
jne 0x40a70f
xor al, al
jmp 0x40a711
mov al, 1
pop edi
pop esi
ret
Function at 0x8bb058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008bb1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8bb07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8bb06a
add dl, dl
jne 0x8bb089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8bb0dc
xor eax, eax
add dl, dl
jne 0x8bb096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8bb17d
add dl, dl
jne 0x8bb0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bb0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bb0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bb0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8bb0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8bb075
mov eax, 1
add dl, dl
jne 0x8bb0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bb0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8bb0e1
sub eax, ebx
mov ebx, 1
jne 0x8bb128
mov ecx, 1
add dl, dl
jne 0x8bb10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8bb119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8bb105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8bb075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8bb13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8bb14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8bb136
cmp eax, 0x7d00
jae 0x8bb16d
cmp eax, 0x500
jb 0x8bb168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8bb075
cmp eax, 0x7f
ja 0x8bb170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8bb075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8bb19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8bb075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x404d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404d32
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004054e0
pop ecx
mov esi, eax
test esi, esi
jne 0x404d65
push 1
call fcn.00404530
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407288], eax
mov dword [0x40728c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404dbb
mov ebx, dword [0x407358]
mov esi, ebx
xor ecx, ecx
jmp 0x404dde
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404dc6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404dd9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404dc1
lea eax, [ecx + 1]
push eax
call fcn.004054e0
pop ecx
mov edi, eax
mov dword [0x407294], eax
cmp dword [0x407294], 0
jne 0x404e05
push 1
call fcn.00404530
pop ecx
mov esi, ebx
jmp 0x404e3a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404e0e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404e35
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x404e25
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404e09
mov byte [edi], 0
cmp ebx, dword [0x407358]
je 0x404e51
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219