joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52a9f6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
cmp esi, dword [0x535198]
jb 0x52aa28
mov dword [0x53514c], 9
mov dword [0x535150], 0
mov eax, 0xffffffff
jmp 0x52abe9
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 8], 0
test edx, edx
je 0x52abe7
mov al, byte [esi + 0x5351a0]
test al, 2
jne 0x52abe7
test al, 0x48
je 0x52aa6b
mov al, byte [esi + str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_SS]
cmp al, 0xa
je 0x52aa6b
dec edx
mov byte [ecx], al
mov dword [ebp - 8], 1
mov byte [esi + str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_SS], 0xa
inc ecx
push 0
lea eax, [ebp - 0x10]
push eax
push edx
push ecx
push dword [esi*4 + 0x5351e0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x52aac4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x52aaa8
mov dword [0x53514c], 9
mov dword [0x535150], eax
mov eax, 0xffffffff
jmp 0x52abe9
cmp eax, 0x6d
je 0x52abe7
push eax
call fcn.00526021
add esp, 4
mov eax, 0xffffffff
jmp 0x52abe9
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
mov al, byte [esi + 0x5351a0]
test al, 0x80
je 0x52abe2
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0xa
jne 0x52aae4
or al, 4
jmp 0x52aae6
and al, 0xfb
mov ebx, dword [ebp + 0xc]
mov byte [esi + 0x5351a0], al
mov edi, ebx
mov eax, dword [ebp - 8]
add eax, ebx
mov dword [ebp - 0xc], eax
cmp ebx, eax
jae 0x52abdc
mov al, byte [edi]
cmp al, 0x1a
je 0x52abca
cmp al, 0xd
je 0x52ab17
inc edi
mov byte [ebx], al
jmp 0x52abbe
mov ecx, dword [ebp - 0xc]
dec ecx
cmp ecx, edi
jbe 0x52ab3b
lea ecx, [edi + 1]
cmp byte [ecx], 0xa
jne 0x52ab32
add edi, 2
mov byte [ebx], 0xa
jmp 0x52abbe
mov edi, ecx
mov byte [ebx], al
jmp 0x52abbe
inc edi
push 0
lea eax, [ebp - 0x10]
lea ecx, [ebp - 1]
mov dword [ebp - 8], 0
push eax
push 1
push ecx
push dword [esi*4 + 0x5351e0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x52ab69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x52abbb
cmp dword [ebp - 0x10], 0
je 0x52abbb
test byte [esi + 0x5351a0], 0x48
je 0x52ab98
cmp byte [ebp - 1], 0xa
jne 0x52ab89
mov byte [ebx], 0xa
jmp 0x52abbe
mov byte [ebx], 0xd
inc ebx
mov al, byte [ebp - 1]
mov byte [esi + str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_SS], al
jmp 0x52abbf
cmp dword [ebp + 0xc], ebx
jne 0x52aba8
cmp byte [ebp - 1], 0xa
jne 0x52aba8
mov byte [ebx], 0xa
jmp 0x52abbe
push 1
push 0xffffffffffffffff
push esi
call fcn.00528417
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x52abbf
mov byte [ebx], 0xd
inc ebx
cmp edi, dword [ebp - 0xc]
jb 0x52ab01
jmp 0x52abdc
mov al, byte [esi + 0x5351a0]
test al, 0x40
jne 0x52abdc
or al, 2
mov byte [esi + 0x5351a0], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x52abe9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52b0bc
Capabilities:
Set environment variable

Disassembly:
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
test esi, esi
je 0x52b2ac
push 0x3d
push esi
call fcn.0052b59e
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x52b2ac
cmp ebp, esi
je 0x52b2ac
cmp byte [ebp + 1], 1
sbb eax, eax
mov ecx, dword [0x535178]
neg eax
mov dword [esp + 0x10], eax
cmp dword [0x535174], ecx
jne 0x52b119
mov eax, dword [0x535174]
push eax
call fcn.0052b316
add esp, 4
mov dword [0x535174], eax
cmp dword [0x535174], 0
jne 0x52b1a8
cmp dword [esp + 0x1c], 0
je 0x52b144
cmp dword [0x53517c], 0
je 0x52b144
call fcn.0052a40b
test eax, eax
je 0x52b1a8
jmp 0x52b2ac
cmp dword [esp + 0x10], 0
je 0x52b152
xor eax, eax
jmp 0x52b2b1
cmp dword [0x535174], 0
jne 0x52b17d
push 4
call fcn.00525f0a
add esp, 4
mov dword [0x535174], eax
test eax, eax
je 0x52b2ac
mov eax, dword [0x535174]
mov dword [eax], 0
cmp dword [0x53517c], 0
jne 0x52b1a8
push 4
call fcn.00525f0a
add esp, 4
mov dword [0x53517c], eax
test eax, eax
je 0x52b2ac
mov eax, dword [0x53517c]
mov dword [eax], 0
mov edi, dword [0x535174]
sub ebp, esi
push ebp
push esi
call fcn.0052b2b9
add esp, 8
mov ebx, eax
test ebx, ebx
jl 0x52b1fe
cmp dword [edi], 0
je 0x52b1fe
cmp dword [esp + 0x10], 0
je 0x52b1f9
lea eax, [edi + ebx*4]
cmp dword [eax], 0
je 0x52b1e2
mov ecx, dword [eax + 4]
inc ebx
mov dword [eax], ecx
add eax, 4
cmp dword [eax], 0
jne 0x52b1d4
lea eax, [ebx*4]
push eax
push edi
call fcn.0052b44c
add esp, 8
test eax, eax
je 0x52b239
jmp 0x52b234
mov dword [edi + ebx*4], esi
jmp 0x52b239
cmp dword [esp + 0x10], 0
jne 0x52b2a8
test ebx, ebx
jge 0x52b20f
neg ebx
lea eax, [ebx*4 + 8]
push eax
push edi
call fcn.0052b44c
add esp, 8
test eax, eax
je 0x52b2ac
lea ecx, [eax + ebx*4]
mov dword [ecx], esi
mov dword [ecx + 4], 0
mov dword [0x535174], eax
cmp dword [esp + 0x1c], 0
je 0x52b2a4
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00525f0a
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x52b2a4
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 1
sbb eax, eax
lea ecx, [ebp + ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov byte [ecx], 0
lea ecx, [ecx + 1]
and eax, ecx
push eax
push ebx
call ebp
push ebx
call fcn.00525ea2
add esp, 4
xor eax, eax
jmp 0x52b2b1
xor eax, eax
jmp 0x52b2b1
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x10446058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104461a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1044607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044606a
add dl, dl
jne 0x10446089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104460dc
xor eax, eax
add dl, dl
jne 0x10446096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044617d
add dl, dl
jne 0x104460a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104460b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104460bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104460c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104460d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10446075
mov eax, 1
add dl, dl
jne 0x104460ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104460f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104460e1
sub eax, ebx
mov ebx, 1
jne 0x10446128
mov ecx, 1
add dl, dl
jne 0x1044610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10446119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10446105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10446075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1044613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1044614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10446136
cmp eax, 0x7d00
jae 0x1044616d
cmp eax, 0x500
jb 0x10446168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10446075
cmp eax, 0x7f
ja 0x10446170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10446075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1044619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10446075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x5cda1c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf05bcfe0
jmp 0x5cda14
mov dword [esp], edx
jmp 0x5cdaa1
mov dword [esp + 4], ebp
mov dword [esp], esi
push edi
jmp 0x5cda57
bswap edi
call 0x5cda1c
imul ecx, dword [ebx - reloc.MSVCRT.dll_strncpy], 0xc
and al, 0x8a
or al, 0x24
jmp 0x5cda41
pop word [esp]
push eax
lea esp, [esp + 2]
jmp 0x5cda0a
lea ebp, [esp + 4]
rdtsc
rdtsc
xchg ebx, eax
not dh
jmp 0x5cda5d
pushfd
jmp 0x5cd64e
sub esp, 0xbc
jmp 0x5cda77
jmp 0x5cda36
mov esi, esp
call 0x5cda7f
jns 0x5cdae6
pop dword [esp]
lea edx, reloc.MSVCRT.dll_strncpy
mov ah, 0x6a
lea esp, [esp + 2]
call fcn.005cdd73
push esp
fimul dword [eax + 0x2f]
fisub dword [esi + esi*4 + 0x3f]
scasd eax, dword es:[edi]
retf 0xf739
push ebx
push esp
pushfd
mov word [esp], cx
push dword [esp]
jl 0x5cda75
pop word [esp]
push eax
lea esp, [esp + 2]
mov dword [esp + 4], ebp
mov dword [esp], esi
jmp 0x5cda11
Function at 0x5da40f
Capabilities:
Check for trap flag exception

Disassembly:
jmp 0x5c078b
pushfd
or dword [esp], reloc.MSVCRT.dll_strncpy
popfd
rdtsc
nop
jmp 0x5c07a2
ret
push esi
mov word [esp + 1], si
lea esp, [esp + 4]
jmp 0x5c0780

Function at 0x5eff4d
Capabilities:
Encrypt data using aes

Disassembly:
call 0x5bddcd
shl edx, 8
xchg ebp, ebx
lea ebp, [eax*4]
jmp 0x5efdce
jmp 0x5bde8f
lea esp, [esp + 4]
jmp 0x5be43c
xor edx, esi
push ebp
mov ebp, eax
jmp 0x5efdf5
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x5efe3a
add ebp, 3
movzx esi, byte [ebp]
pop ebp
mov bl, cl
mov di, sp
jmp 0x5efdd5
movzx edx, byte [eax + 4]
jmp 0x5efe59
shl edx, 8
xor edx, esi
mov dword [ecx], edx
jmp 0x5efe24
push edx
jmp 0x5f0644
movzx esi, byte [eax + 5]
shl edx, 8
xor edx, esi
jmp 0x5efe43
mov dword [esp], eax
popal
jmp 0x5efee7
movzx edx, byte [eax + 8]
push edi
pushal
jmp 0x5efe90
xor edx, esi
jmp 0x5efecf
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
jmp 0x5efeae
movzx esi, byte [eax + 0xb]
jmp 0x5efef3
lea edi, [edi + 9]
movzx esi, byte [edi]
pop edi
shl edx, 8
jmp 0x5efec4
shl edx, 8
xor edx, esi
mov dword [ecx + 8], edx
jmp 0x5eff01
movzx edx, byte [eax + 0xc]
jmp 0x5eff75
shl edx, 8
xor edx, esi
mov dword [ecx + 4], edx
jmp 0x5efea6
xor edx, esi
shl edx, 8
xor edx, eax
jmp 0x5eff4d
mov dword [esi], edx
pop esi
jmp 0x5eff55
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
jmp 0x5eff21
push esi
mov esi, ecx
lea esi, [esi + 0xc]
jmp 0x5eff2a
mov eax, edx
shr eax, 0x10
mov esi, 0xff
jmp 0x5eff96
movzx esi, byte [eax + 0xd]
shl edx, 8
xor edx, esi
jmp 0x5eff40
xor eax, 0x1000000
mov ebx, dword [esp]
call fcn.005effa5
mul dword [ebp - 0xb]
pushfd
outsd dx, dword [esi]
stosd dword es:[edi], eax
adc al, 0x87
and eax, esi
and eax, esi
mov eax, dword [eax*4 + reloc.MSVCRT.dll_strncpy]
lea esp, [esp + 0x40]
jmp 0x5eff80
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
jmp 0x5eff17
mov edx, eax
lea edx, [edx + 6]
movzx esi, byte [edx]
pop edx
jmp 0x5effca

Function at 0x5effa5
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
mov bl, ah
mov bx, word [esp]
jmp 0x5effb3
mov bp, dx
jmp 0x5f0031
and edi, 0xff0000
bswap ebx
xchg bh, bl
mov ebx, eax
lea ebp, reloc.MSVCRT.dll_strncpy
jmp 0x5f0015
mov bp, 0x7e9a
jmp 0x5f0067
mov edi, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
push cx
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp 0x5effd8
mov ebx, dword [ecx + 4]
and eax, 0xff000000
bswap ebp
mov bp, word [esp]
sbb bp, 0x3db
jmp 0x5effec
shr edi, 8
xchg bl, bh
push eax
and edi, esi
jmp 0x5f0002
mov bp, 0xaba5
lea ebp, [ebp*4]
shr edi, 0x18
lea ebp, [eax*4]
jmp 0x5f0196
xor eax, edi
lea ebp, [eax - 0xe4]
ror edi, cl
mov edi, edx
jmp 0x5f003b
mov edi, edx
and edi, esi
call fcn.005f00fb
movzx edi, byte [edi*4 + 0x5c9018]
not bp
lea ebp, [ecx*4]
xor eax, edi
jmp 0x5f013a
Function at 0x5f00fb
Capabilities:
Encrypt data using aes

Disassembly:
lea ecx, reloc.MSVCRT.dll_strncpy
mov edi, dword [ecx]
pop ecx
clc
pushal
mov bp, 0x2ad3
jmp 0x5f00c1
push ecx
mov ecx, edi
lea ecx, [ecx*4]
jmp 0x5f0075
lea edi, [edx - 0x79]
sub esp, 7
add esp, 1
pop edi
lea esp, [esp + 2]
jmp 0x5f00e2
mov ebp, 0xff00
and edi, ebp
xor eax, edi
jmp 0x5f00a5
lea edi, [ecx + 0x10]
pushal
jmp 0x5f011f
lea esp, [esp + 0x20]
xor eax, dword [ecx]
neg di
lea edi, [ebx + edi]
jmp 0x5f00cc
lea esp, [esp + 2]
mov bp, 0xc985
lea esp, [esp + 2]
jmp 0x5f0099
mov ax, word [esp]
jmp 0x5f015a
xor ebx, eax
mov dword [edi], eax
mov eax, dword [esp]
mov al, byte [esp]
jmp 0x5f0109
mov eax, dword [ecx + 8]
xor eax, ebx
call fcn.005f0143

Function at 0x5f0143
Capabilities:
Encrypt data using aes

Disassembly:
bswap ecx
mov ax, word [esp]
jmp 0x5f01ac
mov dword [ecx + 0x14], ebx
jmp 0x5f017a
xor edx, eax
jmp 0x5f04d1
mov dword [ecx + 0x18], eax
mov bl, dh
mov bl, ah
jmp 0x5f0164
mov eax, edi
mov cl, dh
mov edx, dword [eax + 0xc]
ror ecx, cl
jmp 0x5f01bb
mov ecx, edx
mov edi, esi
shr ecx, 8
mov di, ax
jmp 0x5f02bb
mov ebx, 0x5ca81c
lea esp, [esp + 0x24]
jmp 0x5bdd87
lea ecx, [ebx + ebp]
mov dword [esp], edx
call fcn.005f0204
mov edi, edx
jmp 0x5f043f
neg di
pushal
lea eax, [eax + 4]
dec cx
xchg edi, ebx
jmp 0x5f0281
xor ecx, edi
jmp 0x5f03db
movzx edi, byte [edi*4 + 0x5c9018]
jmp 0x5f02c8
mov byte [esp], ch
lea esp, [esp + 2]
shr edi, 0x18
clc
jmp 0x5f02de
add ebx, 4
inc edx
mov dx, word [esp]
jmp 0x5f0341
mov dx, ax
push cx
lea esp, [esp + 2]
xor ecx, dword [eax]
jmp 0x5f0308
or cx, 0x802
jmp 0x5f0360
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
jmp 0x5f032b
push ebp
jmp 0x5f03ab
mov dword [eax + 0x14], edx
mov ecx, dword [esp]
setne ch
btr ecx, edi
mov cx, 0x231
jmp 0x5f034a
xor ecx, dword [ebx]
sub esp, 0x17
lea esp, [esp + 3]
lea esp, [esp + 0x14]
lea edi, [eax + 0x10]
jmp 0x5f031e
sub esp, 0x1c
push word [esp + 0x10]
push bp
mov dword [esp + 4], eax
jmp 0x5f03b6
mov ebp, eax
add ebp, 8
mov ecx, dword [ebp]
pop ebp
jmp 0x5f0390
xor ecx, edx
lea edx, [ebx*4]
push ebp
jmp 0x5f03fb
mov edx, dword [eax + 0xc]
push ebp
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x5f03e5
and edx, ebp
xor ecx, edx
lea esp, [esp + 4]
jmp 0x5f037e
xor edx, ecx
call fcn.005f041f
popfd
pop ds
invalid
mov ebp, eax
add ebp, 0x18
mov dword [ebp], ecx
pop ebp
setnp dh
jmp 0x5f03c2
and edx, esi
mov edx, dword [edx*4 + reloc.MSVCRT.dll_strncpy]
push di
clc
jmp 0x5f02fb
mov dword [ecx + 0x1c], edx
lea eax, [edx - 0xa2]
mov bx, si
lea ecx, [edx*4]
jmp 0x5f01d8
Function at 0x5f0204
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
and ecx, esi
sub esp, 0xa
pushfd
lea esp, [esp + 2]
jmp 0x5f0227
lea esp, [esp + 4]
popal
sub esp, 9
pop dword [esp]
jmp 0x5f01e6
clc
lea esp, [esp + 2]
jmp 0x5f0255
mov ecx, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
shr edi, 0x10
push bx
lea esp, [esp]
jmp 0x5f0211
lea esp, [esp + 0x14]
and ecx, 0xff0000
jmp 0x5f0261
and edi, esi
mov edi, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
pushfd
jmp 0x5f0238
and edi, 0xff000000
xor ecx, edi
mov di, bp
call fcn.005f02a2
xchg edx, eax
add dword [ecx + reloc.MSVCRT.dll_strncpy], edx
ret 0x3750

Function at 0x5f02a2
Capabilities:
Encrypt data using aes

Disassembly:
lea edi, [esp + 0xf9]
jmp 0x5f028c

Function at 0x5f041f
Capabilities:
Encrypt data using aes

Disassembly:
cmp ebx, 0x5ca840
call fcn.005f0428
pop esi
aam 0x4a
sub eax, 0x80c16edc
inc ebx
cli
aad 0x89
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x24]
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x24]
jmp 0x5f0409

Function at 0x5f0428
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
lea esp, [esp + 2]
jmp 0x5f04a2
pop edi
not ebx
jmp 0x5f0486
lea edi, [esi + edi]
xchg ebx, eax
pop eax
mov ebp, ebx
jmp 0x5f0450
lea esp, [esp + 4]
pop ebp
mov bx, di
mov bx, si
mov bx, sp
jmp 0x5f04b5
mov esi, dword [esp]
mov ebx, 0x37c4ddf4
mov ebx, eax
mov bp, word [esp]
jmp 0x5f0470
jne 0x5bdd87
push 0xa
mov eax, dword [esp]
lea esi, reloc.MSVCRT.dll_strncpy
jmp 0x5f0466
pop ebx
ret

Function at 0x5f415f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edx, [esi*4]
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x5f40a5
mov dword [esp + 0x1c], eax
sub esp, 0xa
jmp 0x5f3fb8
lea esp, [esp + 4]
push 0x38
jmp 0x5f3fce
lea esp, [esp + 5]
lea esp, [esp + 2]
lea esp, [esp + 3]
lea esp, [esp + 4]
popal
mov eax, dword [esp]
jmp 0x5f3fa2
mov eax, dword [esp]
sub esp, 4
jmp 0x5f4004
cmp ecx, eax
lea esp, [esp + 8]
mov byte [ebp - 0xc], 0x80
call fcn.005f3fea
mov eax, dword [esp]
jmp 0x5f403c
lea esp, [esp + 4]
jmp 0x5f4054
sub eax, ecx
lea ecx, [edx*4]
mov cx, di
jmp 0x5f409a
xor ecx, ecx
jmp 0x5f4143
call fcn.005da28a
mov eax, 0xb0a0d5af
mov ecx, dword [esp]
jmp 0x5f4062
lea ecx, [edx + ebp]
mov ecx, edx
lea ecx, [ebp - 0xc]
push ecx
jmp 0x5f4078
movzx edx, byte [eax + 1]
mov ebx, dword [esp]
movzx ebx, byte [eax]
jmp 0x5f4112
mov ebp, eax
add ebp, reloc.MSVCRT.dll_strncpy
movzx ebx, byte [ebp]
pop ebp
jmp 0x5f40ef
mov dx, 0xc00e
push ebx
jmp 0x5f3ec8
not bx
jmp 0x5f40fb
shl edx, 8
or edx, ebx
not ebx
bsf ebx, edi
jmp 0x5f40d9
movzx ebx, byte [eax - 2]
jmp 0x5f411a
shl edx, 8
or edx, ebx
push ebp
jmp 0x5f40b1
shl edx, 8
sub esp, 4
lea esp, [esp + 1]
add esp, 0
lea esp, [esp + 3]
jmp 0x5f4175
add eax, 4
sub esp, 3
lea esp, [esp + 3]
jmp 0x5f4156
lea esp, [esp + 4]
lea eax, [esi + 0x1a]
clc
bswap edx
mov dx, word [esp]
jmp 0x5f40cf
cmp ecx, 0xe
call 0x5f415f
ljmp 0x32a
or edx, ebx
mov dword [ebp + ecx*4 + 0x34], edx
inc ecx
jmp 0x5f412d
Function at 0x70fcad
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp + 1]
jmp 0x70fcd8
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x70fd1f
mov word [esp + 2], ax
lea esp, [esp + 1]
mov dword [esp + 0x24], esi
push ax
lea esp, [esp]
pushfd
jmp 0x70fcb3
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x70fd09

Function at 0x70fccc
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp]
pop word [esp]
call fcn.0070fcad

Function at 0x70fd00
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
call fcn.0070e23b
pop word [esp + 2]
call 0x70fb3f
mov dword [esp + 0xf], ecx
mov word [esp + 9], bp
sub esp, 0x10
jmp 0x70fc51
pop dword [esp + 5]
mov dword [esp + 7], ebx
pop dword [esp + 8]
mov byte [esp], bh
mov dword [esp + 1], esi
mov byte [esp + 4], dl
call fcn.0070fb9d
mov word [esp + 8], bp
cld
pop word [esp + 1]
push word [esp + 5]
jmp 0x70fc29
sub esp, 7
lea esp, [esp + 2]
lea esp, [esp + 0x10]
popfd
lea esp, [esp + 4]
jmp 0x70fc7b
add esp, 0x18
mov word [esp + 5], bp
cmc
sub esp, 2
pushfd
push word [esp + 5]
jmp 0x70fbef
call fcn.0070fc3b
lcall 0x4bc, 0x17e49d0d
sahf
or eax, 0xbc17e49d
add al, 0x9e
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
pop ss
jbe 0x70fc81
arpl word [esi], ax
cmc
pop edx
jbe 0x70fcfa
push ecx
dec ecx
fnstcw word [eax - 0x769762b5]
insb byte es:[edi], dx
and al, 0x24
call fcn.0070fccc
mov eax, dword [eax]
jmp 0x70fd2d
mov eax, dword [eax + 8]
push eax
jmp 0x70e236

Function at 0x70fd95
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
push dword [esp + 1]
mov dword [esp + 0x24], esp
call 0x70fd00
jmp 0x70fd50
Function at 0x464a8c
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
push esi
call sub.user32.dll_IsIconic
test eax, eax
je 0x464aa5
push 9
push esi
call sub.user32.dll_ShowWindow
mov eax, dword [0x4a6460]
cmp dword [eax], 2
jne 0x464ab9
mov eax, dword [0x4a5fcc]
cmp dword [eax], 4
jg 0x464aed
mov eax, dword [0x4a6460]
cmp dword [eax], 1
jne 0x464b7c
mov eax, dword [0x4a5fcc]
cmp dword [eax], 4
jg 0x464aed
mov eax, dword [0x4a5fcc]
cmp dword [eax], 4
jne 0x464b7c
mov eax, dword [0x4a62ac]
cmp dword [eax], 0
jle 0x464b7c
xor ebx, ebx
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov ebp, eax
push 0xffffffffffffffff
push edi
push ebp
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x464b34
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 0
push edi
push ebp
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
test bl, bl
jne 0x464b88
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoA
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [esp + 4]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
jmp 0x464b88
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x464c5c
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464d6f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
mov edx, 0x44
call fcn.00406ed8
lea eax, [ebp - 0x5c]
mov edx, 0x10
call fcn.00406ed8
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push edi
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x70], 0xb
mov dword [ebp - 0x6c], esi
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x74]
mov ecx, 1
mov eax, 0x464d8c
call fcn.004095ec
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00408470
mov eax, dword [ebp - 0x60]
call fcn.0040459c
push eax
mov eax, ebx
call fcn.0040459c
push eax
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x464d54
cmp dword [ebp + 0x10], 0
je 0x464d14
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
cmp byte [ebp + 8], 0
je 0x464d25
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.user32.dll_WaitForInputIdle
cmp dword [ebp + 0xc], 0
je 0x464d54
lea eax, [ebp - 8]
mov edx, 8
call fcn.00406ed8
mov eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x464b9c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464d76
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.00404100
ret

Function at 0x47805c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4780b6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0047804c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00475d20
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00475838
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4780bd
lea eax, [ebp - 4]
call fcn.004040dc
ret
Function at 0x47eaf4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47eb22
mov eax, ebx
call fcn.0047f5a8
cmp dword [ebx + 0x40], 0
je 0x47eb1b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47eb93
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47eb85
cmp dword [ebx + 8], 0
je 0x47eb44
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47eb56
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47eb85
cmp dword [ebx + 8], 0
je 0x47eb37
cmp eax, 3
je 0x47eb69
dec eax
jne 0x47eb37
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47eb37
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47eb37
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47ebb1
cmp dword [ebx + 0x14], 0xcc
je 0x47ebb1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047ebbc
pop ebx
ret