joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53de00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x53de1f
xor edi, edi
mov eax, 0x14
call fcn.0042a440
jmp fcn.0053de00
sub esp, 0x68
mov ecx, dword [esp + 0x70]
cmp ecx, 0
je 0x53dfbb
mov ebx, dword [esp + 0x78]
cmp ebx, 0
je 0x53dfbb
mov ebx, dword [esp + 0x6c]
mov dword [esp], ebx
mov dword [esp + 4], ecx
lea esi, [0x62cb08]
lea edi, [esp + 8]
cld
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004ee240
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov ebx, dword [esp + 0x74]
mov dword [esp], ebx
mov ebx, dword [esp + 0x78]
mov dword [esp + 4], ebx
lea esi, [0x62cb08]
lea edi, [esp + 8]
cld
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004ee240
mov ebp, dword [esp + 0x48]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], eax
mov ebx, dword [esp + 0x54]
cmp ebp, ebx
je 0x53debf
mov byte [esp + 0x7c], 0
add esp, 0x68
ret
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x64], ebx
xor ecx, ecx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x5c], eax
mov ebx, dword [esp + 0x28]
cmp ecx, ebx
jge 0x53df51
mov dword [esp + 0x30], eax
cmp eax, 0
je 0x53dfb4
mov edx, dword [eax]
mov ebp, dword [eax + 4]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x40], ebp
mov edx, ebp
cmp ebp, 1
jne 0x53df5a
mov ebp, dword [esp + 0x34]
mov dword [esp], ebp
mov dword [esp + 0x38], edx
mov dword [esp + 4], edx
lea esi, [0x62ca58]
lea edi, [esp + 8]
cld
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00428080
mov edx, dword [esp + 0x38]
movzx ebx, byte [esp + 0x10]
cmp bl, 0
je 0x53df5a
mov eax, dword [esp + 0x30]
add eax, 8
mov ecx, dword [esp + 0x24]
inc ecx
mov ebx, dword [esp + 0x28]
cmp ecx, ebx
jl 0x53dee1
mov byte [esp + 0x7c], 1
add esp, 0x68
ret
mov ebx, dword [esp + 0x1c]
cmp ebx, dword [esp + 0x54]
jae 0x53dfad
mov ebp, dword [esp + 0x50]
lea ebp, [ebp + ebx*8]
mov edi, dword [ebp]
mov esi, dword [ebp + 4]
cmp edx, esi
jne 0x53dfa4
mov ebp, dword [esp + 0x34]
mov dword [esp], ebp
mov dword [esp + 0x38], edx
mov dword [esp + 4], edx
mov dword [esp + 0x3c], edi
mov dword [esp + 8], edi
mov dword [esp + 0x40], esi
mov dword [esp + 0xc], esi
call fcn.00428080
movzx ebx, byte [esp + 0x10]
cmp bl, 0
jne 0x53df3d
mov byte [esp + 0x7c], 0
add esp, 0x68
ret
call fcn.004116c0
ud2
mov dword [eax], eax
jmp 0x53deee
mov byte [esp + 0x7c], 0
add esp, 0x68
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3a391239
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3d752d6a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x431b20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x431b42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x431b49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x431b38
mov eax, 1
add ebx, ebx
jne 0x431b5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x431b50
jne 0x431b6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x431b50
xor ecx, ecx
sub eax, 3
jb 0x431b80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x431bf2
mov ebp, eax
add ebx, ebx
jne 0x431b8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x431b98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x431bbc
inc ecx
add ebx, ebx
jne 0x431ba8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x431b9d
jne 0x431bb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x431b9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x431bdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x431bcd
jmp 0x431b3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x431bdc
add edi, ecx
jmp 0x431b3e
pop esi
mov edi, esi
mov ecx, 0x36
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x431bfa
cmp byte [edi], 0xa
jne 0x431bfa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x431bff
lea edi, [esi + 0x2f000]
mov eax, dword [edi]
or eax, eax
je 0x431c77
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x36170]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x361ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x431c2c
mov ecx, edi
jns 0x431c5b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x361b0]
or eax, eax
je 0x431c71
mov dword [ebx], eax
add ebx, 4
jmp 0x431c49
call dword [esi + 0x361c0]
mov ebp, dword [esi + 0x361b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x431cab
sub esp, 0xffffff80
jmp 0x4019f8
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x984708e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xb9d384e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x431c9e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x431cd6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0042f487
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042f45f
jmp 0x431ce2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4332d1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x433313
call fcn.00436a09
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x433313
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x43330a
xor eax, eax
jmp 0x43331b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00433321
pop edi
pop esi
pop ebx
ret 4

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x6ee954f7
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..text
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x4d755ab1
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x5df4a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov dword [0x5f8734], 0xe1d
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x5df6d0
jmp 0x5df536
mov eax, dword [ebp - 0x1c]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x1d]
and bh, bl
test bh, 1
mov edi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edi
jne 0x5df5ad
jmp 0x5df5d1
mov dword [0x5f8734], 0x1d37
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x5df6d0
mov dword [0x5f8738], 0x9d8
mov dword [0x5f8734], 0x74a
mov ecx, dword fs:[0x18]
mov dword [0x5f8738], 0x1704
mov dword [0x5f8734], 0x1bee
mov eax, dword [ecx + 0x30]
mov dword [0x5f8738], 0x13ab
mov eax, dword [eax + 0xc]
mov ecx, eax
add ecx, 0x14
mov eax, dword [eax + 0x14]
mov dword [0x5f8734], 0xb65
cmp eax, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
je 0x5df522
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x3c]
mov byte [ebp - 0x1d], cl
mov dword [ebp - 0x1c], edx
jmp 0x5df4e5
mov eax, dword [ebp - 0x34]
mov dword [0x5f8734], 0x2594
mov dword [0x5f8738], 0x21f0
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x5df6d0
mov eax, 0x1516
mov ecx, dword [ebp - 0x28]
mov dx, word [ecx]
shr dx, 1
movzx esi, dx
cmp dx, 0
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], eax
je 0x5df6a0
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x5df5fb
mov eax, dword [ebp - 0x48]
mov ecx, eax
add ecx, 1
mov edx, dword [ebp - 0x2c]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ecx
mov word [ebp - 0x52], si
mov word [ebp - 0x54], bx
jb 0x5df63a
mov ax, word [ebp - 0x52]
mov word [ebp - 0x54], ax
mov ax, word [ebp - 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x4c]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x40]
cmp esi, edi
setb bh
and al, bh
test al, 1
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x55], bl
jne 0x5df5fb
mov al, byte [ebp - 0x55]
mov ecx, 0x1c56
test al, 1
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x44], ecx
jne 0x5df684
jmp 0x5df6a0
mov eax, dword [ebp - 0x5c]
mov dword [0x5f8738], 0x1e9d
mov dword [0x5f8734], 0x1cd
mov dword [ebp - 0x18], eax
jmp 0x5df6d0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x38]
cmp edx, esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x60], eax
jne 0x5df4e5
mov eax, dword [ebp - 0x60]
mov dword [0x5f8734], eax
mov dword [0x5f8738], 0x1e9d
jmp 0x5df522
mov eax, dword [ebp - 0x18]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5df6e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [0x5f8734], 0x1b1e
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [0x5f8738], 0x26bb
mov dword [ebp - 0x10], eax
jmp 0x5df734
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x5df778
jmp 0x5df810
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x5df761
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
jl 0x5df734
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x5df720
jmp 0x5df810
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x5df810
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x1e], dx
mov ax, word [ebp - 0x1e]
cmp ax, 0x64
jne 0x5df810
mov dword [0x5f8738], 0xcb4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x5df810
mov dword [0x5f8738], 0x1ac7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x5df810
mov dword [0x5f8734], 0xfffffca7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
sete dl
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1f]
test al, 1
jne 0x5df7fc
jmp 0x5df810
mov eax, 1
mov dword [0x5f8734], 0xffffe8ea
mov dword [ebp - 0x24], eax
jmp 0x5df81f
xor eax, eax
mov dword [0x5f8738], 0x888
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x5df8d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x5f8740], 0
mov byte [0x5f8744], 0
mov dword [0x5f8734], 0xd7
mov dword [0x5f873c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x5df928
xor eax, eax
mov dword [0x5f873c], 0
mov dword [ebp - 0x20], eax
jmp 0x5df95f
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x5f8738]
add eax, 0xfffff809
mov dword [0x5f8734], eax
mov eax, dword [0x5f873c]
add eax, 1
mov dword [0x5f873c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x5df928
jmp 0x5df917
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x5f8748], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x5f8738], 0x69c
mov edi, dword [0x5f8740]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x5f8748], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x5f8740], edx
mov dword [0x5f8734], 0x1aca
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x5f8744], cl
mov dword [0x5f8734], 0x24a1
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x5f8744]
mov esi, dword [0x5f8740]
mov byte [ebx + esi], cl
mov dword [0x5f8734], 0x17ba
mov esi, dword [0x5f873c]
add esi, 1
mov dword [0x5f873c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x5df95f
mov dword [0x5f8734], 0x19d
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5e0520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x5f873c], 0
mov dword [0x5f8740], 0
mov dword [0x5f874c], 0
mov dword [0x5f8738], 0x1f51
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
cmp eax, 0
je 0x5e06cd
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x5e0588
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x5f8734], 0xe18
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x5f873c], edx
mov dword [0x5f8738], 0x9fe
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x5f8740], edx
mov dword [0x5f8734], 0xfffff931
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x5f8744], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x5f8738], 0x26b8
mov cl, byte [0x5f8744]
mov edx, dword [0x5f8740]
mov byte [edi + edx], cl
mov edx, dword [0x5f8738]
mov ebx, edx
add ebx, 0x2ee
mov dword [0x5f8734], ebx
mov ebx, dword [0x5f873c]
movzx ebx, byte [edi + ebx]
mov ecx, dword [0x5f8740]
movzx ecx, byte [edi + ecx]
add ecx, ebx
mov dword [0x5f8734], 0x1bba
and ecx, 0xff
mov dword [0x5f874c], ecx
mov cl, byte [edi + ecx]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
mov ch, byte [ebx + esi]
mov bl, cl
add bl, byte [0x5f8751]
mov byte [0x5f8750], bl
mov byte [0x5f8751], ch
mov byte [0x5f8752], cl
xor ch, cl
add edx, 0x1245
mov dword [0x5f8734], edx
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [0x5f8734]
add edx, 0xc87
mov dword [0x5f8734], edx
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x38], esi
je 0x5e06cb
mov eax, dword [0x5f873c]
mov ecx, dword [0x5f8740]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
jmp 0x5e0588
jmp 0x5e06cd
mov dword [0x5f8738], 0x17fb
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5e0a20
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov esi, dword [0x5f8738]
add esi, 0xd41
mov dword [0x5f8738], esi
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x63
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0x1e
mov dword [0x5f8734], 0x1613
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
call fcn.005e06e0
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.005dfa90
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x5e0b56
mov eax, dword [ebp - 0x34]
mov dword [0x5f8734], 0x748
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.005dfef0
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov dword [0x5f8734], 0x624
mov edx, dword [ebp - 0x2c]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x54], ecx
mov dword [0x5f8738], 0x2425
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x5e0b56
mov eax, dword [ebp - 0x3c]
add eax, 0x2629
mov dword [0x5f8734], 0x1f4e
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add esp, 0x48
pop esi
pop ebp
ret
Function at 0x5e0ef0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov dword [0x5f8738], 0xdcc
call fcn.00401080
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
jne 0x5e108a
lea eax, [esp + 0x40]
mov dword [0x5f8734], 0x8f5
mov ecx, dword [0x5f8738]
add ecx, 0x14ca
mov dword [0x5f8738], ecx
mov dword [esp + 0x28], eax
call fcn.005df6e0
cmp eax, 0
sete dl
mov byte [esp + 0x27], dl
xor eax, eax
mov cl, byte [esp + 0x27]
test cl, 1
mov dword [esp + 0x20], eax
jne 0x5e0f65
jmp 0x5e1082
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.005e0170
lea ecx, [0x5e00a0]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x90], 0x138400
mov dword [0x5f8734], 0xa58
mov edx, dword [0x5f8720]
mov dword [esp + 0x7c], edx
mov edx, dword [0x5f8724]
mov dword [esp + 0x64], edx
mov edx, dword [0x5f8728]
mov dword [esp + 0x54], edx
mov edx, dword [0x5f872c]
mov dword [esp + 0x84], edx
mov dword [0x5f8738], 0xfffff8f0
mov edx, dword [0x5f8730]
mov dword [esp + 0x44], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x5e1012
mov eax, dword [esp + 0x14]
add eax, 0x3c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
cmp dword [edx + ecx], 0x4550
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
je 0x5e1026
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x18], eax
jmp 0x5e0fdb
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x40]
mov dword [esp + 0x58], eax
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x50], eax
mov dword [0x5f8734], 0x22cb
mov dword [0x5f8738], 0xa7d
mov eax, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.005e0a20
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x5f8738], 0x10cf
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov esp, ebp
pop ebp
ret