joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408c80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x444c30]
jne 0x408c8a
repz ret
jmp fcn.0040b79c

Function at 0x40af67
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405117
and dword [ebp - 4], 0
cmp dword [0x445fc4], 0
mov ebx, eax
jne 0x40b018
push 0x402ab4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b0c9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402aa8
push edi
call esi
test eax, eax
je 0x40b0c9
push eax
call fcn.004050a5
mov dword [esp], 0x402a98
push edi
mov dword [0x445fc4], eax
call esi
push eax
call fcn.004050a5
mov dword [esp], 0x402a84
push edi
mov dword [0x445fc8], eax
call esi
push eax
call fcn.004050a5
mov dword [esp], 0x402a68
push edi
mov dword [0x445fcc], eax
call esi
push eax
call fcn.004050a5
pop ecx
mov dword [0x445fd4], eax
test eax, eax
je 0x40b018
push 0x402a50
push edi
call esi
push eax
call fcn.004050a5
pop ecx
mov dword [0x445fd0], eax
mov eax, dword [0x445fd0]
cmp eax, ebx
je 0x40b070
cmp dword [0x445fd4], ebx
je 0x40b070
push eax
call fcn.00405120
push dword [0x445fd4]
mov esi, eax
call fcn.00405120
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b070
test edi, edi
je 0x40b070
call esi
test eax, eax
je 0x40b067
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b067
test byte [ebp - 0xc], 1
jne 0x40b070
or dword [ebp + 0x10], 0x200000
jmp 0x40b0a9
mov eax, dword [0x445fc8]
cmp eax, ebx
je 0x40b0a9
push eax
call fcn.00405120
pop ecx
test eax, eax
je 0x40b0a9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b0a9
mov eax, dword [0x445fcc]
cmp eax, ebx
je 0x40b0a9
push eax
call fcn.00405120
pop ecx
test eax, eax
je 0x40b0a9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445fc4]
call fcn.00405120
pop ecx
test eax, eax
je 0x40b0c9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b0cb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a200
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x40a720
test edx, edx
je 0x40a720
call fcn.0040a217
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x40a760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0040a200
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x40a7d1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x40a796
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x411ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x411b9b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x411b36
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00411700
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x411b04
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x411c54
call fcn.00411b48
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x411bf3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00411700
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x411bac
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x411c54
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00411700
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x411c4f
jmp 0x411c54
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x411cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x411da4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x411d3f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00411860
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x411d0d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x411e5d
call fcn.00411d51
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x411dfc
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00411990
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x411db5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x411e5d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00411990
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x411e58
jmp 0x411e5d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x412f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x412fea
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x412f7d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004126c0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x412f43
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x4130b3
call fcn.00412f8f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x41304a
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00412ae0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x412ffb
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x4130b3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00412ae0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4130ae
jmp 0x4130b3
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4139a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x413a24
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x4139fc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x413a04
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.00413a29
Function at 0x4702a0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x28
mov eax, dword [0x67706c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push 0x6810e4
mov edx, str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 0x10]
call fcn.00450a80
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4702cd
mov eax, dword [eax]
lea ecx, [esp + 8]
push ecx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edx, dword [esp + 0x20]
test eax, eax
setne bl
cmp edx, 8
jb 0x47031b
mov ecx, dword [esp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x470311
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x470381
push edx
push ecx
call fcn.00487ad0
add esp, 8
test bl, bl
je 0x470331
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00487463
add esp, 0x28
ret
cmp dword [0x678bcc], 8
mov ecx, 0x678bb8
mov eax, dword [0x678bc8]
cmovae ecx, dword [0x678bb8]
add eax, eax
push eax
push ecx
push 1
push 0
push 0x666270
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 8]
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
mov al, bl
pop ebx
xor ecx, esp
call fcn.00487463
add esp, 0x28
ret
call fcn.004a0555
int3

Function at 0x471150
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x591e38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x67706c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
mov byte [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.00455908
push 0
push 0
push 0
push 0xa
push 0
push 0
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push 0
mov byte [esi + 8], 1
call fcn.004678f1
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi + 0x1c]
call fcn.00471220
test al, al
je 0x471217
mov dword [ebp - 4], 1
cmp byte [ebp - 0x10], 0
je 0x471207
mov edx, dword [ebp - 0x14]
add dword [edx], 0xffffffff
jne 0x471207
xor ecx, ecx
lea eax, [edx + 4]
xchg dword [eax], ecx
lea ecx, [edx + 8]
mov eax, closesocket
lock xadd dword [ecx], eax
test eax, 0x40000000
jne 0x471207
cmp eax, 0x80000000
jle 0x471207
lock bts dword [ecx], 0x1e
jb 0x471207
call fcn.0044835b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
call fcn.004aaab7
int3
Function at 0x473e6d
Capabilities:
Create thread

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
push ebx
push ebx
push ebx
mov dword [edi], ebx
lea esi, [edi + 8]
mov dword [edi + 4], ebx
mov dword [esi], edi
mov dword [esi + 4], 0x473ec0
mov dword [edi + 0x10], ebx
mov word [edi + 0x30], bx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
push ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push esi
push 0x4733f7
push ebx
push ebx
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi], eax
mov eax, edi
mov byte [edi + 0x30], bl
pop edi
pop esi
pop ebx
ret

Function at 0x496770
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x496781
mov dword [esp + 4], eax
jmp 0x4ad7fc
ret
and dword [esi], edx
push 0xe2f38100
mov ecx, 0xc2c156f8
add ebp, dword [ebx]
adc eax, 0x681ee3

Function at 0x4acf85
Capabilities:
Read file via mapping

Disassembly:
sub dword [0x681632], edi
not esi
or edi, dword [0x681bf4]
inc edx
inc eax
not esi
xor ecx, 0x2d6e4892
rol edi, 2
call fcn.004e0471
call fcn.0049e126
ror edi, 2
xor ecx, 0x2d6e4892
not esi
dec eax
dec edx
not esi
xor edx, ebx
xor dword [0x6812fa], edi
or dword [0x681522], ebx
call fcn.0053db28
xor edi, 0xf18107f9
call fcn.004b623c
rol edi, 0x1f
xor esi, 0xf6f7ab44

Function at 0x4acfe0
Capabilities:
Read file via mapping

Disassembly:
mov dword [0x6818b3], edx
xor ebx, 0x20a2cb77
rol eax, 0xa
add edi, 0xf0ee9738
and dword [0x68190e], ebx
xchg ebx, eax
and dword [0x681448], esi
add eax, dword [0x681d71]
inc edx
mov dword [0x68181f], ecx
dec edx
call fcn.00512a89
call fcn.004df60d
inc edx
sub dword [0x681658], edx
dec edx
xchg ebx, eax
sub edi, 0xf0ee9738
ror eax, 0xa
xor ebx, 0x20a2cb77
xor dword [0x681512], edx
push esi
xchg eax, esi
not eax
or eax, dword [0x681ccb]
inc ebx
inc eax
and dword [0x68163d], ecx
call fcn.00401487
sub ebx, dword [0x681b3f]
Function at 0x4ad121
Capabilities:
Read file via mapping

Disassembly:
sal dword [ecx], 5
adc al, 0x68
add al, ch
lodsd eax, dword [esi]
scasb al, byte es:[edi]
std
inc dword [ecx - 0x1c34f515]
invalid
Function at 0x4ad7ba
Capabilities:
Read file via mapping

Disassembly:
sub byte [edi - 0x18], bh
mov eax, 0xe8fff8f4
cmpsb byte [esi], byte es:[edi]
adc eax, 0xf4e80005
sal bh, 0xff
jg 0x4ad7a4
into
sub dword [ecx], eax
add bh, dh
salc

Function at 0x4ad81b
Capabilities:
Read file via mapping

Disassembly:
push 0xe8d6f700
mov dh, 0x3d
push es
add al, ch
retf

Function at 0x4ada40
Capabilities:
Read file via mapping

Disassembly:
rol ecx, 0xc3
or ebp, eax
push 0xffffffffffffffdf
or eax, dword [eax]
inc ecx
sub eax, esp
xor eax, dword [0x681e8d]
not edi
add ecx, dword [0x681c4b]
or dword [0x68191b], esi
not edx
dec edi
xchg edi, esi
not ecx
call fcn.0052800c
add dword [0x681463], ebx
xchg edi, esi
add eax, 0x64ff9084
call fcn.0044407b
call fcn.0045703c
sub eax, 0x64ff9084
xchg edi, esi
sub dword [0x681570], ecx
not ecx
xchg edi, esi
inc edi
not edx
sub dword [0x68164b], ebx
not edi
add eax, esp
dec ecx
ror ebx, 0xb
sub eax, ecx
neg edx
sub ecx, ebx
xor esi, 0x2270ad9c
xchg esi, edx
xor edi, 0x323decc4
rol eax, 0x1b
call fcn.00497e72
sub ecx, ebx
inc ecx
not ecx
sub ecx, 0x5afc9908
not esi
add dword [0x6816a2], 0x93d8fabf
ror ebx, 0x19
neg ecx
call fcn.0040b7dd
sub esi, dword [0x681c49]
call fcn.005560fe
neg ecx
rol ebx, 0x19
mov dword [0x6812e7], 0x955d7f56
not esi
add ecx, 0x5afc9908
not ecx
dec ecx
add ecx, ebx
ror eax, 0x1b
xor edi, 0x323decc4
xchg esi, edx
push esi
sub eax, dword [0x681d90]
ror edx, 3
not ebx
or dword [0x6813bf], eax
add eax, 0x6813bf
Function at 0x4b68cf
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b623d

Function at 0x4d1dd0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.004886f0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.004c5fa0
mov ebx, eax
push ebx
push esi
call fcn.004c5e80
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4d1e59
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4d1e33
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004c5ef0
push esi
call fcn.004c6040
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4d1e59
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.004c5fa0
mov ebx, eax
push ebx
push esi
call fcn.004c5e80
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4d1ec8
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4d1eae
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004c5ef0
push esi
call fcn.004c6040
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x4d1e51
push esi
call fcn.004c6040
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x51ed60
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x51ed74
mov dword [esp + 0x18], fcn.0051d540
jmp fcn.004c7b30
mov dword [esp + 0x18], fcn.0051c7e0
jmp fcn.004c7860
Function at 0x55ffe1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x110
call fcn.004886f0
mov eax, dword [0x67706c]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x11c]
push ebp
mov dword [esp + 4], ecx
mov edx, dword [eax]
cmp edx, 8
ja case.default.0x55fef6
jmp dword [edx*4 + 0x560140]
lea eax, [esp + 4]
push eax
push str._unsupported_
push str.othername
call fcn.0054da00
add esp, 0xc
jmp 0x560107
lea eax, [esp + 4]
push eax
push str._unsupported_
push str.X400Name
call fcn.0054da00
add esp, 0xc
jmp 0x560107
lea eax, [esp + 4]
push eax
push str._unsupported_
push str.EdiPartyName
call fcn.0054da00
add esp, 0xc
jmp 0x560107
mov eax, dword [eax + 4]
lea ecx, [esp + 4]
push ecx
push dword [eax + 8]
push str.email
call fcn.0054dbc0
add esp, 0xc
jmp 0x560107
mov eax, dword [eax + 4]
lea ecx, [esp + 4]
push ecx
push dword [eax + 8]
push 0x5f6e78
call fcn.0054dbc0
add esp, 0xc
jmp 0x560107
mov eax, dword [eax + 4]
lea ecx, [esp + 4]
push ecx
push dword [eax + 8]
push 0x5f6e7c
call fcn.0054dbc0
add esp, 0xc
jmp 0x560107
push 0x100
lea ecx, [esp + 0x14]
push ecx
push dword [eax + 4]
call fcn.005546f0
add esp, 0xc
test eax, eax
je 0x56010b
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push str.DirName
call fcn.0054da00
add esp, 0xc
jmp 0x560107
mov eax, dword [eax + 4]
mov ebp, dword [eax + 8]
mov eax, dword [eax]
cmp eax, 4
jne 0x56001e
movzx eax, byte [ebp + 3]
push eax
movzx eax, byte [ebp + 2]
push eax
movzx eax, byte [ebp + 1]
push eax
movzx eax, byte [ebp]
push eax
push str._d._d._d._d
lea eax, [esp + 0x24]
push 0x100
push eax
call fcn.004ccf60
add esp, 0x1c
jmp 0x5600ac
cmp eax, 0x10
jne 0x5600c5
push ebx
push esi
push edi
mov byte [esp + 0x1c], 0
xor ebx, ebx
movzx ecx, byte [ebp]
movzx eax, byte [ebp + 1]
shl ecx, 8
or ecx, eax
lea eax, [esp + 0x14]
push ecx
push 0x5f52bc
push 5
push eax
call fcn.004ccf60
lea edx, [esp + 0x24]
add esp, 0x10
lea ebp, [ebp + 2]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x560060
lea edi, [esp + 0x1c]
sub edx, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x560070
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 7
je 0x5600a3
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x560090
mov ax, word [0x66479c]
mov word [edi], ax
inc ebx
cmp ebx, 8
jl 0x560031
pop edi
pop esi
pop ebx
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push str.IP_Address
call fcn.0054da00
add esp, 0xc
jmp 0x560107
lea eax, [esp + 4]
push eax
push str._invalid_
push str.IP_Address
call fcn.0054da00
add esp, 0xc
jmp 0x560107
push dword [eax + 4]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.004cf3c0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
push str.Registered_ID
call fcn.0054da00
add esp, 0x18
test eax, eax
jne 0x560123
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00487463
add esp, 0x110
mov ecx, dword [esp + 4]
mov eax, ecx
mov ecx, dword [esp + 0x110]
pop ebp
xor ecx, esp
call fcn.00487463
add esp, 0x110
ret
Function at 0x586410
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x586470
push 0
push 0
call fcn.0058b6e1
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x586439
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x586457
cmp eax, 0xffffffff
je 0x586457
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x58c2a5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058c124